Windows Analysis Report
Scan 368 1.doc

Overview

General Information

Sample name: Scan 368 1.doc
Analysis ID: 1427899
MD5: f22c33e0af52d382e821ff26fe23f30b
SHA1: 15bdcdd580cbb66c67d8fd90151e25fc285f7de3
SHA256: 50297c7705e690b43057219bc9a89cfb49e6d739742bbf4d904b64832b1cfefc
Tags: doc
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Drops PE files with a suspicious file extension
Injects a PE file into a foreign processes
Installs a global keyboard hook
Installs new ROOT certificates
Machine Learning detection for dropped file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Equation Editor Network Connection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Microsoft Office Child Process
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Powershell Defender Exclusion
Sigma detected: SCR File Write Event
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Suspicious Screensaver Binary File Creation
Stores large binary data to the registry
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Found malware configuration
Source: 5.2.obimohohj75.scr.35e1930.5.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.gmail.com", "Username": "micromeqbd@gmail.com", "Password": "tssveohxktcpzhdm"}
Multi AV Scanner detection for domain / URL
Source: covid19help.top Virustotal: Detection: 24% Perma Link
Source: https://covid19help.top/xobizx.scr Virustotal: Detection: 23% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\xobizx[1].scr ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\xobizx[1].scr Virustotal: Detection: 47% Perma Link
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Virustotal: Detection: 47% Perma Link
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Virustotal: Detection: 47% Perma Link
Multi AV Scanner detection for submitted file
Source: Scan 368 1.doc Virustotal: Detection: 47% Perma Link
Source: Scan 368 1.doc ReversingLabs: Detection: 47%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\xobizx[1].scr Joe Sandbox ML: detected

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 172.67.175.222 Port: 443 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\obimohohj75.scr
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\obimohohj75.scr Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 172.67.175.222:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.22:49164 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.22:49165 version: TLS 1.2

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 4x nop then jmp 00710C95h 5_2_0071064B
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 4x nop then jmp 008D0C95h 13_2_008D064B
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: covid19help.top
Source: global traffic DNS query: name: api.ipify.org
Source: global traffic DNS query: name: api.ipify.org
Source: global traffic DNS query: name: api.ipify.org
Source: global traffic DNS query: name: api.ipify.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 172.67.175.222:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.175.222:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 104.26.12.205:443 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 104.26.12.205:443 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.26.12.205:443 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 104.26.12.205:443 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.26.12.205:443 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 104.26.12.205:443 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.26.12.205:443 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.26.12.205:443 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 104.26.13.205:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 104.26.13.205:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 104.26.13.205:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 104.26.13.205:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 104.26.13.205:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 104.26.13.205:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 104.26.13.205:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 104.26.13.205:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 104.26.13.205:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.26.13.205:443
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 172.67.175.222 172.67.175.222
Source: Joe Sandbox View IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View IP Address: 104.26.13.205 104.26.13.205
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: Joe Sandbox View JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1
May check the online IP address of the machine
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe DNS query: name: api.ipify.org
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /xobizx.scr HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: covid19help.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F50586BA-2E23-4FD0-A214-B66A4504F162}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /xobizx.scr HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: covid19help.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: unknown DNS traffic detected: queries for: covid19help.top
Source: obimohohj75.scr, 0000000E.00000002.626533099.000000000266B000.00000004.00000800.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.627290510.00000000022FE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.ipify.org
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005466000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000376000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOR
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000376000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.341543164.00000000002FB000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr.2.dr, pgZzUFYKXcIRkU.exe.5.dr, xobizx[1].scr.2.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000376000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.341543164.00000000002FB000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr.2.dr, pgZzUFYKXcIRkU.exe.5.dr, xobizx[1].scr.2.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005466000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.341543164.0000000000376000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.341543164.00000000002FB000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr.2.dr, pgZzUFYKXcIRkU.exe.5.dr, xobizx[1].scr.2.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: obimohohj75.scr, 00000005.00000002.371272562.000000000261B000.00000004.00000800.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 0000000D.00000002.378702669.000000000232B000.00000004.00000800.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.626533099.000000000264D000.00000004.00000800.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.626533099.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.627290510.0000000002241000.00000004.00000800.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.627290510.00000000022E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: obimohohj75.scr, 00000005.00000002.371692371.00000000035E1000.00000004.00000800.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.625847603.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: obimohohj75.scr, 0000000E.00000002.626533099.0000000002662000.00000004.00000800.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.627290510.00000000022E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipif8
Source: obimohohj75.scr, 00000005.00000002.371692371.00000000035E1000.00000004.00000800.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.626533099.000000000264D000.00000004.00000800.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.625847603.0000000000402000.00000040.00000400.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.626533099.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.627290510.0000000002241000.00000004.00000800.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.627290510.00000000022E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: pgZzUFYKXcIRkU.exe, 00000016.00000002.627290510.00000000022E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: obimohohj75.scr, 0000000E.00000002.626533099.000000000264D000.00000004.00000800.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.627290510.00000000022E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/T
Source: obimohohj75.scr, 0000000E.00000002.626533099.000000000264D000.00000004.00000800.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.626533099.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.627290510.0000000002241000.00000004.00000800.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.627290510.00000000022E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/t
Source: EQNEDT32.EXE, 00000002.00000002.341543164.00000000002FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/dOzJ
Source: EQNEDT32.EXE, 00000002.00000002.341543164.00000000002FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/t
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.341543164.00000000002FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/xobizx.scr
Source: EQNEDT32.EXE, 00000002.00000002.341543164.00000000002FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/xobizx.scrC:
Source: EQNEDT32.EXE, 00000002.00000002.341543164.00000000002CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/xobizx.scrY.
Source: EQNEDT32.EXE, 00000002.00000002.341543164.00000000002CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/xobizx.scra
Source: EQNEDT32.EXE, 00000002.00000002.341543164.00000000002CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/xobizx.scrj
Source: EQNEDT32.EXE, 00000002.00000002.341543164.00000000002CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/xobizx.scrkkC:
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000349000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr, 0000000E.00000002.627022282.0000000005449000.00000004.00000020.00020000.00000000.sdmp, pgZzUFYKXcIRkU.exe, 00000016.00000002.628212267.0000000005BC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: EQNEDT32.EXE, 00000002.00000002.341543164.0000000000376000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.341543164.00000000002FB000.00000004.00000020.00020000.00000000.sdmp, obimohohj75.scr.2.dr, pgZzUFYKXcIRkU.exe.5.dr, xobizx[1].scr.2.dr String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: unknown Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown HTTPS traffic detected: 172.67.175.222:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.22:49164 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.22:49165 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 5.2.obimohohj75.scr.35e1930.5.raw.unpack, A1HZ.cs .Net Code: _5O4
Source: 5.2.obimohohj75.scr.361c350.6.raw.unpack, A1HZ.cs .Net Code: _5O4
Installs a global keyboard hook
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\obimohohj75.scr
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: Scan 368 1.doc, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 5.2.obimohohj75.scr.35e1930.5.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.obimohohj75.scr.361c350.6.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.obimohohj75.scr.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.obimohohj75.scr.361c350.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.obimohohj75.scr.35e1930.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable editing") from the yellow bar aboveASSIGNMENTMCS 473: MARKETING MANAGEMENT & STRATEGYSTUDENT
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\xobizx[1].scr Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\obimohohj75.scr Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_001DD280 5_2_001DD280
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_001DB398 5_2_001DB398
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_001DEBA8 5_2_001DEBA8
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_001DDCE9 5_2_001DDCE9
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_001DC600 5_2_001DC600
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_001DD756 5_2_001DD756
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_001DFA48 5_2_001DFA48
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_001DC4C4 5_2_001DC4C4
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002E1A38 5_2_002E1A38
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002E1D41 5_2_002E1D41
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002EB048 5_2_002EB048
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002EB480 5_2_002EB480
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002E34F0 5_2_002E34F0
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002E36F0 5_2_002E36F0
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002EB968 5_2_002EB968
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002E1A28 5_2_002E1A28
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002E0A41 5_2_002E0A41
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002E2BF8 5_2_002E2BF8
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002EAC02 5_2_002EAC02
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002EAC10 5_2_002EAC10
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002EBDA0 5_2_002EBDA0
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002E0DB0 5_2_002E0DB0
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002E0DC0 5_2_002E0DC0
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_002E0FF9 5_2_002E0FF9
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_00345200 13_2_00345200
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_0034EBA8 13_2_0034EBA8
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_0034DD2C 13_2_0034DD2C
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_00343E04 13_2_00343E04
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_0034C600 13_2_0034C600
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_0034FA48 13_2_0034FA48
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_00344559 13_2_00344559
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_00346FE0 13_2_00346FE0
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_00551A38 13_2_00551A38
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_00551D41 13_2_00551D41
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_0055B048 13_2_0055B048
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_0055B480 13_2_0055B480
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_0055B968 13_2_0055B968
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_00550A41 13_2_00550A41
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_00551A28 13_2_00551A28
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_00552BF0 13_2_00552BF0
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_00552BF8 13_2_00552BF8
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_0055ABFA 13_2_0055ABFA
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_0055AC10 13_2_0055AC10
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_00550DC0 13_2_00550DC0
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_00550DB0 13_2_00550DB0
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_0055BDA0 13_2_0055BDA0
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_00550FF9 13_2_00550FF9
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 14_2_001C3900 14_2_001C3900
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 14_2_001CF360 14_2_001CF360
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 14_2_001C8C00 14_2_001C8C00
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 14_2_001C4518 14_2_001C4518
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 14_2_001CBE88 14_2_001CBE88
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 14_2_001C3C48 14_2_001C3C48
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 14_2_001CE551 14_2_001CE551
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 14_2_00460980 14_2_00460980
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 14_2_00466550 14_2_00466550
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 14_2_004655F0 14_2_004655F0
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 14_2_00468120 14_2_00468120
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 14_2_00461A40 14_2_00461A40
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 14_2_00468778 14_2_00468778
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 22_2_001C3900 22_2_001C3900
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 22_2_001CF360 22_2_001CF360
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 22_2_001C8C00 22_2_001C8C00
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 22_2_001C4518 22_2_001C4518
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 22_2_001CBE88 22_2_001CBE88
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 22_2_001C3C48 22_2_001C3C48
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 22_2_001CE54A 22_2_001CE54A
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 22_2_004B6550 22_2_004B6550
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 22_2_004B55F0 22_2_004B55F0
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 22_2_004B0980 22_2_004B0980
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 22_2_004B8120 22_2_004B8120
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 22_2_004B1A40 22_2_004B1A40
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 22_2_004B8778 22_2_004B8778
Document contains embedded VBA macros
Source: tmp786B.tmp.5.dr OLE indicator, VBA macros: true
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: tmp786B.tmp.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Yara signature match
Source: Scan 368 1.doc, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 5.2.obimohohj75.scr.35e1930.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.obimohohj75.scr.361c350.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.obimohohj75.scr.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.obimohohj75.scr.361c350.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.obimohohj75.scr.35e1930.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: xobizx[1].scr.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: obimohohj75.scr.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: pgZzUFYKXcIRkU.exe.5.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5.2.obimohohj75.scr.35e1930.5.raw.unpack, YsTq4S.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obimohohj75.scr.35e1930.5.raw.unpack, YsTq4S.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obimohohj75.scr.35e1930.5.raw.unpack, ZNczHvI78.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obimohohj75.scr.35e1930.5.raw.unpack, ZNczHvI78.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obimohohj75.scr.35e1930.5.raw.unpack, ZNczHvI78.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obimohohj75.scr.35e1930.5.raw.unpack, ZNczHvI78.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obimohohj75.scr.35e1930.5.raw.unpack, G2Tmmpnyphl.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obimohohj75.scr.35e1930.5.raw.unpack, G2Tmmpnyphl.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, G2ZSj4grjIGLRxUPme.cs Security API names: _0020.SetAccessControl
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, G2ZSj4grjIGLRxUPme.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, G2ZSj4grjIGLRxUPme.cs Security API names: _0020.AddAccessRule
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, NZ3F1JZLvRhU8cxwHy.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winDOC@26/22@5/3
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$an 368 1.doc Jump to behavior
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Mutant created: \Sessions\1\BaseNamedObjects\sgWhCAggfQPwpXhx
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR5BC5.tmp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................&.........................s..............U............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................V&.........................s............................x............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................&.........................s..............U............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................&.........................s............................x............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................&.........................s..............U............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n................................&.........................s..............U.............x............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................&.........................s..............U.............x............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........&.........................s..............U..... .......x............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................&.........................s..............U.............x............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................'.........................s............................x............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................'.........................s..............U............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......'.........................s..............U.....$.......x............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................='.........................s..............U.............x............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................O'.........................s............................x............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................['.........................s..............U............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s..............U.....2.......x............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................y'.........................s..............U.............x............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................'.........................s....................l.......x............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................'.........................s..............U............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................'.........................s..............U.............x............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................'.........................s..............U.............x............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................0%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................?%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................U%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................d%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n...............................{%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........%.........................s.................... ....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......%.........................s....................$....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................&.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................(........&.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................(.......*&.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................(.......R&.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................(.......j&.........................s....................l....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................(.......z&.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................(........&.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................(........&.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Console Write: ................`. ............... .....(.P.....................x............................................................................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D....... .......HJ.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D....... .......TJ.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D....... .......iJ.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D....... .......uJ.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D.......@........J.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D.......@........J.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n.......<.......D.......@........J.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D.......@........K.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........K.........................s.................... .......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D...............'K.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D...............EK.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D...............SK.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....eK.........................s....................$.......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D....... .......wK.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D.......@........K.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D.......@........K.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D.......@........K.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D.......@........K.........................s....................l.......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D.......@........K.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....<.......D.......@........L.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....<.......D.......@........L.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0........C.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0........C.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0........D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0........D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0.......#D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0......./D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n.......................0.......AD.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0.......MD.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.0......._D.........................s.................... .......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0.......kD.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0.......}D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0........D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......D.........................s....................$.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0........D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0........D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0........D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0........D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................D.........................s....................l.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................E.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................E.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................'E.........................s............................................
Source: C:\Windows\SysWOW64\schtasks.exe Console Write: ................................E.R.R.O.R.:. ............................8......................................h...............................
Source: C:\Windows\SysWOW64\schtasks.exe Console Write: ................................E.R.R.O.(.P..............................8..............................................j.......(. .............
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: Scan 368 1.doc Virustotal: Detection: 47%
Source: Scan 368 1.doc ReversingLabs: Detection: 47%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\obimohohj75.scr "C:\Users\user\AppData\Roaming\obimohohj75.scr"
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obimohohj75.scr"
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pgZzUFYKXcIRkU" /XML "C:\Users\user\AppData\Local\Temp\tmp786B.tmp"
Source: unknown Process created: C:\Windows\System32\taskeng.exe taskeng.exe {028588F3-95E8-48BE-8F64-19174D00F448} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe Process created: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Users\user\AppData\Roaming\obimohohj75.scr "C:\Users\user\AppData\Roaming\obimohohj75.scr"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pgZzUFYKXcIRkU" /XML "C:\Users\user\AppData\Local\Temp\tmp8CF4.tmp"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\obimohohj75.scr "C:\Users\user\AppData\Roaming\obimohohj75.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obimohohj75.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pgZzUFYKXcIRkU" /XML "C:\Users\user\AppData\Local\Temp\tmp786B.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Users\user\AppData\Roaming\obimohohj75.scr "C:\Users\user\AppData\Roaming\obimohohj75.scr" Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process created: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pgZzUFYKXcIRkU" /XML "C:\Users\user\AppData\Local\Temp\tmp8CF4.tmp"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: credssp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: ncrypt.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: bcrypt.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: msvcp140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: ktmw32.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\taskeng.exe Section loaded: ktmw32.dll Jump to behavior
Source: C:\Windows\System32\taskeng.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Windows\System32\taskeng.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\taskeng.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\taskeng.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\taskeng.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: wbemcomn2.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: webio.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: credssp.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Section loaded: vaultcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: wbemcomn2.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: credssp.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Section loaded: vaultcli.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Jump to behavior
Source: Scan 368 1.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\Scan 368 1.doc
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, G2ZSj4grjIGLRxUPme.cs .Net Code: P5aVvXVtpi System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002E412C push edx; ret 2_2_002E44D7
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002E6026 push ebx; ret 2_2_002E6027
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002E5C3E push esp; ret 2_2_002E5C3F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002DC10C pushfd ; retf 002Dh 2_2_002DC10D
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002E601E push ebx; ret 2_2_002E601F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002E4067 pushfd ; iretd 2_2_002E4101
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002DE466 pushad ; retf 2_2_002DE4F4
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002D8F60 push eax; retf 2_2_002D8F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002D9778 pushad ; ret 2_2_002D9779
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002DC278 push eax; retn 002Dh 2_2_002DC27D
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002DC340 push C8002DC3h; retn 002Dh 2_2_002DC345
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002E5FBD push edx; ret 2_2_002E5FBF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002E5CB5 push edx; ret 2_2_002E5CB7
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002DB58A push edx; retf 2_2_002DB58B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002E5E9F push esp; ret 2_2_002E5EBB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002E44E5 push edx; ret 2_2_002E44E7
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002DB6C9 pushad ; ret 2_2_002DB6F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002E5EC2 push esp; ret 2_2_002E5EC3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002E44DB push edx; ret 2_2_002E44DF
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_001D328A push eax; retf 5_2_001D32B1
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_001D32BD pushad ; retf 5_2_001D32C1
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Code function: 5_2_001D6564 pushad ; retf 5_2_001D6565
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_00349AAA push 8B00386Fh; iretd 13_2_00349AAF
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_0034328A push eax; retf 13_2_003432B1
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Code function: 13_2_00346564 pushad ; retf 13_2_00346565
Source: xobizx[1].scr.2.dr Static PE information: section name: .text entropy: 7.972982095360775
Source: obimohohj75.scr.2.dr Static PE information: section name: .text entropy: 7.972982095360775
Source: pgZzUFYKXcIRkU.exe.5.dr Static PE information: section name: .text entropy: 7.972982095360775
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, PVkO9JPMvYVLdClLiN.cs High entropy of concatenated method names: 'O6IweqlMMq', 'TANwRH6kgp', 'bGvwEfJ77Z', 'rM8w9FZrkv', 'Fixw6GvwZc', 'PDywFT5kk0', 'XELwi24PNo', 'SJWwKXd5KJ', 'XTbwqV1n72', 'EwDwdRKlLJ'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, G2ZSj4grjIGLRxUPme.cs High entropy of concatenated method names: 'YIhPIsXwfr', 'VVrPpluOgh', 'kffP51yyQY', 'OvvPQvVSgK', 'DX3PGXwffY', 'Tv8PlxpmSe', 'R7gP36uZTf', 'qPNPr0PA3V', 'NMoPTg8rTC', 'i7sPBnh4e3'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, wGPs2vQ5cYwwpfdFSH.cs High entropy of concatenated method names: 'Dispose', 'uS9bX3QGmU', 'beEn9lFdKd', 'n6yaaoa0lg', 'nkXbNlSmSw', 'qKNbzo24Ds', 'ProcessDialogKey', 'qjvn43RO6w', 'uYjnbasTPQ', 'zjLnnf6rJV'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, TqrvIDXhqvyk4oYo0r.cs High entropy of concatenated method names: 'tfmYuGBEIE', 'G7mYNOU9Un', 'ej6g4l4Kcb', 'rBFgbS3TQr', 'EjeYdJuwGn', 'KtIYs01sHl', 'oVDYAAyNDM', 'uPhYMO91vG', 'tELYtIvJ4G', 'ykGY748qiu'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, r7NahfGaRHXpwgcPPG.cs High entropy of concatenated method names: 'uVpGm3nCBi', 'W79GSJ6Wof', 'LmGQ0fQVbd', 'gkXQ6oXtng', 'qcbQF2sath', 'W8rQjQ9LHr', 'be7Qih5Ubd', 'RhlQKUUuIP', 'OMTQWlnEe0', 'eKsQq0qSfL'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, qwk4Qv9QyJCsNVKKDQ.cs High entropy of concatenated method names: 'Udj1bMaVsi', 'nMH1PuDKRs', 'iZE1VkblbB', 'Yw81pfPXcy', 'E4u15jsu3V', 'M5P1G8A6vY', 'vr81l9lpc9', 'h6FgLdgCsv', 'hSjgufeTDa', 'bLrgXdrXab'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, EvTKrVrZpdRryOCsZq.cs High entropy of concatenated method names: 'ksHgEXIT20', 'hE4g9dC4ma', 'Tkrg0iChJj', 'o2Gg64uxlJ', 'TPygMYEqVJ', 'CZpgF3begY', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, ayoI2QBSC5k9Z01VqM.cs High entropy of concatenated method names: 'lgovgW8gX', 'I2ACoa5tu', 'OgUkVvfe4', 'hnaSj06D8', 'C09R0Gywf', 'f1oHyVKvQ', 'E2aCOrQpiLXr2oBsR7', 'ftMvVEnB3Yc9XUxYKk', 'hIegt8GCq', 'hCVhByf6x'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, BeQ1AODg6yeryL4ZqA.cs High entropy of concatenated method names: 'IY9gpXI0H6', 'qbEg5B9Qwv', 'my5gQm4Req', 'FPxgGA67Ag', 'sLdglTndow', 'GvZg3gw0wp', 'sg0grXqF5m', 'FvvgTgXmty', 'F9JgBhTm0b', 'HnogfhAqBO'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, SVlNQVmaF6b5jAqO4n.cs High entropy of concatenated method names: 'RBUlIPDtbo', 'JHjl50Orrt', 'm1xlGhhhUm', 'EsCl3vlvi8', 's5Plry7g6b', 'hWjG2fYg6f', 'DrlGOCTy6J', 'vyYGLc8c3l', 'UnpGuUB1EE', 'sPFGXoEm27'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, hpPwguNbTVJhGmC5km.cs High entropy of concatenated method names: 'oB2QCPFPgI', 'YPiQkw9di2', 'iyFQepyOBY', 'GphQRBkdD9', 'pi6QxbXpf5', 'eajQc7itEK', 'qKNQYTyXMC', 'uB1Qgi0Hxf', 'QuNQ1MxF17', 'PtVQh7PpiT'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, XAJRNj3qJUtDMUjdFC.cs High entropy of concatenated method names: 'd6g3pj1OTn', 'wFJ3QBktl4', 'ein3l5DLkR', 'KUUlNdVrFk', 'Bfelz1JSuk', 'vtV340pdvK', 'Qs43bRH9tm', 'P9p3nJLSZA', 'Prf3P6JQvi', 'F2f3VtyiUv'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, mr35evWRIA6iQ3eJNAp.cs High entropy of concatenated method names: 'eRi1JfjkT2', 'fXp1yHs2mW', 'njE1vFA6Gd', 'Smf1CjiGl8', 'iGC1mDK56w', 'B5b1kUQrKJ', 'W0Y1SIhxpW', 'EB21eJAkpp', 'rNR1RBJH3p', 'mnh1HxoRwQ'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, w41cn5eEcjXfVPc9W3.cs High entropy of concatenated method names: 'HKob3rBlE3', 'Bi7bro8Jsc', 'C53bBb0bSw', 'xn0bf11WC3', 'BTgbxBYA4y', 'TkPbcd8w5Y', 'Oi0jjcL0PVlYobv2fx', 'H85hNKNv6R1UjIdrs2', 'QP2bb3USh4', 'ANCbPdDU0x'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, t2dMxJW6jcRIsPOcotc.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'SCFhMxbSAV', 'zmRhtjKkQ0', 'eiKh7OAnN1', 'jR7hUPF1O5', 'AE3h26VhKE', 'xYXhOkDjlp', 'GWnhLvaKhv'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, NZ3F1JZLvRhU8cxwHy.cs High entropy of concatenated method names: 'IPA5M3VwxE', 'aka5tgU2MO', 'j7r57WIwqO', 'uQM5UfovU6', 'MlF52FEjAr', 'Sab5OISHt2', 'FPT5LfMtc5', 'lKO5u6xso0', 'rdq5XhgYAh', 'omZ5N8Ns0u'
Source: 5.2.obimohohj75.scr.61d0000.10.raw.unpack, EYWFh7SMXfbjDQJxdS.cs High entropy of concatenated method names: 'zEE3JKpQAH', 'Ro63ycSvIc', 'pe33vDv3pN', 'vQs3CdFmU4', 'fdb3m4pwI9', 'Elc3kgJwQL', 'C053SZxhuZ', 'DqT3erjTFv', 'yBg3RnFRgD', 'xfb3H1k1Xh'

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\xobizx[1].scr Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\obimohohj75.scr Jump to dropped file
Installs new ROOT certificates
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\xobizx[1].scr Jump to dropped file
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr File created: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\obimohohj75.scr Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pgZzUFYKXcIRkU" /XML "C:\Users\user\AppData\Local\Temp\tmp786B.tmp"
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT Jump to behavior
Stores large binary data to the registry
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory allocated: 1D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory allocated: 25B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory allocated: 3F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory allocated: 8030000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory allocated: 5FF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory allocated: 9030000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory allocated: A030000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory allocated: A4F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory allocated: 8030000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Memory allocated: 340000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Memory allocated: 22C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Memory allocated: 590000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Memory allocated: 60C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Memory allocated: 51E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Memory allocated: 70C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Memory allocated: 80C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Memory allocated: 8680000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Memory allocated: 60C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory allocated: 1C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory allocated: 25B0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory allocated: 700000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Memory allocated: 1C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Memory allocated: 2240000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Memory allocated: 1F20000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Thread delayed: delay time: 1200000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Thread delayed: delay time: 1200000
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2097 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5178 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1585 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4162 Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Window / User API: threadDelayed 1458
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Window / User API: threadDelayed 8392
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2820
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3607
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1548
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2166
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Window / User API: threadDelayed 9449
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Window / User API: threadDelayed 401
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1912 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr TID: 3416 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr TID: 3148 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3408 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3428 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3244 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3436 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3444 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3328 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\taskeng.exe TID: 3484 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe TID: 3836 Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe TID: 3520 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr TID: 3588 Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr TID: 3944 Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr TID: 3944 Thread sleep time: -1200000s >= -30000s
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr TID: 3972 Thread sleep count: 1458 > 30
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr TID: 3972 Thread sleep count: 8392 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3712 Thread sleep count: 2820 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3720 Thread sleep count: 3607 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4004 Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4052 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3800 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3884 Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3908 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3784 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe TID: 4048 Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe TID: 3108 Thread sleep time: -17524406870024063s >= -30000s
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe TID: 3108 Thread sleep time: -7200000s >= -30000s
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe TID: 1640 Thread sleep count: 9449 > 30
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe TID: 1640 Thread sleep count: 401 > 30
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2436 Thread sleep time: -60000s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Thread delayed: delay time: 1200000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obimohohj75.scr"
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obimohohj75.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Memory written: C:\Users\user\AppData\Roaming\obimohohj75.scr base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Memory written: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe base: 400000 value starts with: 4D5A
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\obimohohj75.scr "C:\Users\user\AppData\Roaming\obimohohj75.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obimohohj75.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pgZzUFYKXcIRkU" /XML "C:\Users\user\AppData\Local\Temp\tmp786B.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Process created: C:\Users\user\AppData\Roaming\obimohohj75.scr "C:\Users\user\AppData\Roaming\obimohohj75.scr" Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process created: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pgZzUFYKXcIRkU" /XML "C:\Users\user\AppData\Local\Temp\tmp8CF4.tmp"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Process created: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe "C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe"
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Queries volume information: C:\Users\user\AppData\Roaming\obimohohj75.scr VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Queries volume information: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Queries volume information: C:\Users\user\AppData\Roaming\obimohohj75.scr VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Queries volume information: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe VolumeInformation
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 5.2.obimohohj75.scr.35e1930.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obimohohj75.scr.361c350.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.obimohohj75.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obimohohj75.scr.361c350.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obimohohj75.scr.35e1930.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000002.625847603.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.371692371.00000000035E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: obimohohj75.scr PID: 3128, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: obimohohj75.scr PID: 3512, type: MEMORYSTR
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe File opened: C:\FTP Navigator\Ftplist.txt
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Roaming\obimohohj75.scr Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Roaming\pgZzUFYKXcIRkU.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Yara detected Credential Stealer
Source: Yara match File source: 5.2.obimohohj75.scr.35e1930.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obimohohj75.scr.361c350.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.obimohohj75.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obimohohj75.scr.361c350.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obimohohj75.scr.35e1930.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000002.627290510.00000000022A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.625847603.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.626533099.0000000002600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.371692371.00000000035E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: obimohohj75.scr PID: 3128, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: obimohohj75.scr PID: 3512, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: pgZzUFYKXcIRkU.exe PID: 3964, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 5.2.obimohohj75.scr.35e1930.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obimohohj75.scr.361c350.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.obimohohj75.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obimohohj75.scr.361c350.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.obimohohj75.scr.35e1930.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000002.625847603.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.371692371.00000000035E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: obimohohj75.scr PID: 3128, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: obimohohj75.scr PID: 3512, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1427899 Sample: Scan 368 1.doc Startdate: 18/04/2024 Architecture: WINDOWS Score: 100 62 Multi AV Scanner detection for domain / URL 2->62 64 Found malware configuration 2->64 66 Malicious sample detected (through community Yara rule) 2->66 68 15 other signatures 2->68 8 WINWORD.EXE 336 14 2->8         started        10 taskeng.exe 1 2->10         started        process3 process4 12 EQNEDT32.EXE 11 8->12         started        17 EQNEDT32.EXE 8->17         started        19 pgZzUFYKXcIRkU.exe 10->19         started        dnsIp5 60 covid19help.top 172.67.175.222, 443, 49163 CLOUDFLARENETUS United States 12->60 48 C:\Users\user\AppData\...\obimohohj75.scr, PE32 12->48 dropped 50 C:\Users\user\AppData\Local\...\xobizx[1].scr, PE32 12->50 dropped 94 Installs new ROOT certificates 12->94 96 Office equation editor establishes network connection 12->96 98 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 12->98 21 obimohohj75.scr 1 10 12->21         started        100 Multi AV Scanner detection for dropped file 19->100 102 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 19->102 104 Machine Learning detection for dropped file 19->104 106 2 other signatures 19->106 25 pgZzUFYKXcIRkU.exe 19->25         started        28 powershell.exe 19->28         started        30 powershell.exe 19->30         started        32 2 other processes 19->32 file6 signatures7 process8 dnsIp9 44 C:\Users\user\AppData\...\pgZzUFYKXcIRkU.exe, PE32 21->44 dropped 46 C:\Users\user\AppData\Local\...\tmp786B.tmp, XML 21->46 dropped 78 Multi AV Scanner detection for dropped file 21->78 80 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 21->80 82 Machine Learning detection for dropped file 21->82 90 3 other signatures 21->90 34 obimohohj75.scr 21->34         started        38 powershell.exe 4 21->38         started        40 powershell.exe 4 21->40         started        42 schtasks.exe 21->42         started        56 104.26.13.205, 443, 49165 CLOUDFLARENETUS United States 25->56 58 api.ipify.org 25->58 84 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 25->84 86 Tries to steal Mail credentials (via file / registry access) 25->86 88 Tries to harvest and steal ftp login credentials 25->88 92 2 other signatures 25->92 file10 signatures11 process12 dnsIp13 52 104.26.12.205, 443, 49164 CLOUDFLARENETUS United States 34->52 54 api.ipify.org 34->54 70 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 34->70 72 Tries to steal Mail credentials (via file / registry access) 34->72 74 Installs a global keyboard hook 34->74 76 Installs new ROOT certificates 38->76 signatures14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.67.175.222
 covid19help.top United States
13335 CLOUDFLARENETUS true
104.26.12.205
 unknown United States
13335 CLOUDFLARENETUS false
104.26.13.205
 unknown United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
covid19help.top 172.67.175.222 true
api.ipify.org 172.67.74.152 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.ipify.org/ false
    		high
    https://covid19help.top/xobizx.scr true unknown