Analysis Report CDC GUIDES COVID-19 Second Outbreak Warning release.scr

Overview

General Information

Sample Name: CDC GUIDES COVID-19 Second Outbreak Warning release.scr (renamed file extension from scr to exe)
Analysis ID: 319216
MD5: dc8d9c9a86fe4830053697c1dc59dc6f
SHA1: a63fa3cc878efe75ecf849111c3e3d417fef4fdd
SHA256: 5dcd1649d97e0da882778ec70677be52b49603b6596b044518f02c278d93d0f2

Most interesting Screenshot:

Detection

Quasar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Quasar RAT
.NET source code references suspicious native API functions
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
May check the online IP address of the machine
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Creates processes with suspicious names
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains strange resources
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe ReversingLabs: Detection: 12%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe ReversingLabs: Detection: 12%
Multi AV Scanner detection for submitted file
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe ReversingLabs: Detection: 12%
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe ReversingLabs: Detection: 12%
Yara detected Quasar RAT
Source: Yara match File source: 0000000F.00000002.372345849.0000000003BE5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.831738365.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.358547843.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.355201046.00000000037C5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.376779243.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.269160984.0000000004035000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 2172, type: MEMORY
Source: Yara match File source: Process Memory Space: CDC GUIDES COVID-19 Second Outbreak Warning release.exe PID: 2764, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 4080, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 6588, type: MEMORY
Source: Yara match File source: Process Memory Space: CDC GUIDES COVID-19 Second Outbreak Warning release.exe PID: 5820, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 6824, type: MEMORY
Source: Yara match File source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\ Jump to behavior

Networking:

barindex
May check the online IP address of the machine
Source: unknown DNS query: name: ip-api.com
Source: unknown DNS query: name: ip-api.com
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49736 -> 185.244.26.221:4782
Source: global traffic TCP traffic: 192.168.2.3:49736 -> 185.244.26.221:4782
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: ip-api.com
Source: unknown DNS traffic detected: queries for: ip-api.com
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.267762525.0000000002F82000.00000004.00000001.sdmp, CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.831738365.0000000000402000.00000040.00000001.sdmp, vlc.exe, 0000000E.00000002.353478457.0000000002A3F000.00000004.00000001.sdmp, vlc.exe, 0000000F.00000002.372076333.0000000002E5F000.00000004.00000001.sdmp, vlc.exe, 00000014.00000002.358547843.0000000000402000.00000040.00000001.sdmp, vlc.exe, 00000015.00000002.376779243.0000000000402000.00000040.00000001.sdmp String found in binary or memory: http://api.ipify.org/
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.839822026.0000000003207000.00000004.00000001.sdmp, 9FFWrx9i8Kuq.exe.5.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.839822026.0000000003207000.00000004.00000001.sdmp, 9FFWrx9i8Kuq.exe.5.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.839709535.00000000031D9000.00000004.00000001.sdmp String found in binary or memory: http://crl.m0odoca
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.267762525.0000000002F82000.00000004.00000001.sdmp, CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.831738365.0000000000402000.00000040.00000001.sdmp, vlc.exe, 0000000E.00000002.353478457.0000000002A3F000.00000004.00000001.sdmp, vlc.exe, 0000000F.00000002.372076333.0000000002E5F000.00000004.00000001.sdmp, vlc.exe, 00000014.00000002.358547843.0000000000402000.00000040.00000001.sdmp, vlc.exe, 00000015.00000002.376779243.0000000000402000.00000040.00000001.sdmp String found in binary or memory: http://freegeoip.net/xml/
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.837102867.0000000002EDC000.00000004.00000001.sdmp String found in binary or memory: http://ip-api.com
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.267762525.0000000002F82000.00000004.00000001.sdmp, CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.837102867.0000000002EDC000.00000004.00000001.sdmp, CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.831738365.0000000000402000.00000040.00000001.sdmp, vlc.exe, 0000000E.00000002.353478457.0000000002A3F000.00000004.00000001.sdmp, vlc.exe, 0000000F.00000002.372076333.0000000002E5F000.00000004.00000001.sdmp, vlc.exe, 00000014.00000002.358547843.0000000000402000.00000040.00000001.sdmp, vlc.exe, 00000015.00000002.376779243.0000000000402000.00000040.00000001.sdmp String found in binary or memory: http://ip-api.com/json/
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.837102867.0000000002EDC000.00000004.00000001.sdmp String found in binary or memory: http://ip-api.com4
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.839822026.0000000003207000.00000004.00000001.sdmp, 9FFWrx9i8Kuq.exe.5.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ocsp.thawte.com0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://s.symcd.com06
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.837474746.0000000002F23000.00000004.00000001.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.837102867.0000000002EDC000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: https://d.symcb.com/cps0%
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: https://d.symcb.com/rpa0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: https://d.symcb.com/rpa0.
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.839822026.0000000003207000.00000004.00000001.sdmp, 9FFWrx9i8Kuq.exe.5.dr String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: https://www.globalsign.com/repository/0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.267762525.0000000002F82000.00000004.00000001.sdmp, CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.831738365.0000000000402000.00000040.00000001.sdmp, vlc.exe, 0000000E.00000002.353478457.0000000002A3F000.00000004.00000001.sdmp, vlc.exe, 0000000F.00000002.372076333.0000000002E5F000.00000004.00000001.sdmp, vlc.exe, 00000014.00000002.358547843.0000000000402000.00000040.00000001.sdmp, vlc.exe, 00000015.00000002.376779243.0000000000402000.00000040.00000001.sdmp String found in binary or memory: http://api.ipify.org/
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.839822026.0000000003207000.00000004.00000001.sdmp, 9FFWrx9i8Kuq.exe.5.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.839822026.0000000003207000.00000004.00000001.sdmp, 9FFWrx9i8Kuq.exe.5.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.839709535.00000000031D9000.00000004.00000001.sdmp String found in binary or memory: http://crl.m0odoca
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.267762525.0000000002F82000.00000004.00000001.sdmp, CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.831738365.0000000000402000.00000040.00000001.sdmp, vlc.exe, 0000000E.00000002.353478457.0000000002A3F000.00000004.00000001.sdmp, vlc.exe, 0000000F.00000002.372076333.0000000002E5F000.00000004.00000001.sdmp, vlc.exe, 00000014.00000002.358547843.0000000000402000.00000040.00000001.sdmp, vlc.exe, 00000015.00000002.376779243.0000000000402000.00000040.00000001.sdmp String found in binary or memory: http://freegeoip.net/xml/
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.837102867.0000000002EDC000.00000004.00000001.sdmp String found in binary or memory: http://ip-api.com
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.267762525.0000000002F82000.00000004.00000001.sdmp, CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.837102867.0000000002EDC000.00000004.00000001.sdmp, CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.831738365.0000000000402000.00000040.00000001.sdmp, vlc.exe, 0000000E.00000002.353478457.0000000002A3F000.00000004.00000001.sdmp, vlc.exe, 0000000F.00000002.372076333.0000000002E5F000.00000004.00000001.sdmp, vlc.exe, 00000014.00000002.358547843.0000000000402000.00000040.00000001.sdmp, vlc.exe, 00000015.00000002.376779243.0000000000402000.00000040.00000001.sdmp String found in binary or memory: http://ip-api.com/json/
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.837102867.0000000002EDC000.00000004.00000001.sdmp String found in binary or memory: http://ip-api.com4
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.839822026.0000000003207000.00000004.00000001.sdmp, 9FFWrx9i8Kuq.exe.5.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ocsp.thawte.com0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://s.symcd.com06
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.837474746.0000000002F23000.00000004.00000001.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.837102867.0000000002EDC000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.842466971.00000000063A0000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: https://d.symcb.com/cps0%
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: https://d.symcb.com/rpa0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: https://d.symcb.com/rpa0.
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.839822026.0000000003207000.00000004.00000001.sdmp, 9FFWrx9i8Kuq.exe.5.dr String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe String found in binary or memory: https://www.globalsign.com/repository/0

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: vlc.exe, 0000000E.00000002.352476510.0000000000ACB000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Source: vlc.exe, 0000000E.00000002.352476510.0000000000ACB000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Yara detected Quasar RAT
Source: Yara match File source: 0000000F.00000002.372345849.0000000003BE5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.831738365.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.358547843.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.355201046.00000000037C5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.376779243.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.269160984.0000000004035000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 2172, type: MEMORY
Source: Yara match File source: Process Memory Space: CDC GUIDES COVID-19 Second Outbreak Warning release.exe PID: 2764, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 4080, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 6588, type: MEMORY
Source: Yara match File source: Process Memory Space: CDC GUIDES COVID-19 Second Outbreak Warning release.exe PID: 5820, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 6824, type: MEMORY
Source: Yara match File source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 0000000F.00000002.372345849.0000000003BE5000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000005.00000002.831738365.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000014.00000002.358547843.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 0000000E.00000002.355201046.00000000037C5000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000015.00000002.376779243.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000000.00000002.269160984.0000000004035000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Patchwork malware Author: Florian Roth
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Patchwork malware Author: Florian Roth
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Patchwork malware Author: Florian Roth
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0000000F.00000002.372345849.0000000003BE5000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000005.00000002.831738365.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000014.00000002.358547843.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 0000000E.00000002.355201046.00000000037C5000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000015.00000002.376779243.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000000.00000002.269160984.0000000004035000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Patchwork malware Author: Florian Roth
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Patchwork malware Author: Florian Roth
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Patchwork malware Author: Florian Roth
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Detected potential crypto function
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_02D5FA70 0_2_02D5FA70
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D91FA8 0_2_05D91FA8
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D94660 0_2_05D94660
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D90910 0_2_05D90910
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D90040 0_2_05D90040
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D990F0 0_2_05D990F0
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D990E0 0_2_05D990E0
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D9A212 0_2_05D9A212
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_02D5FA70 0_2_02D5FA70
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D91FA8 0_2_05D91FA8
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D94660 0_2_05D94660
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D90910 0_2_05D90910
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D90040 0_2_05D90040
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D990F0 0_2_05D990F0
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D990E0 0_2_05D990E0
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D9A212 0_2_05D9A212
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 5_2_0142F090 5_2_0142F090
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 5_2_0142F960 5_2_0142F960
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 5_2_0142ED48 5_2_0142ED48
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 5_2_066CE6DB 5_2_066CE6DB
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 5_2_066C8EB8 5_2_066C8EB8
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 5_2_066C4A60 5_2_066C4A60
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 5_2_066C5864 5_2_066C5864
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 5_2_067342B8 5_2_067342B8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 14_2_00D0FA70 14_2_00D0FA70
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 14_2_04E21FA8 14_2_04E21FA8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 14_2_04E24890 14_2_04E24890
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 14_2_04E2487F 14_2_04E2487F
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 14_2_04E20040 14_2_04E20040
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 14_2_04E20910 14_2_04E20910
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 14_2_04E28AE1 14_2_04E28AE1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 14_2_04E28AF0 14_2_04E28AF0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 14_2_04E24B08 14_2_04E24B08
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 15_2_050E1FA8 15_2_050E1FA8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 15_2_050E0910 15_2_050E0910
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 15_2_050E0040 15_2_050E0040
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 15_2_050E487F 15_2_050E487F
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 15_2_050E4890 15_2_050E4890
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 15_2_050E8AE1 15_2_050E8AE1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 15_2_050E8AF0 15_2_050E8AF0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 20_2_032EF090 20_2_032EF090
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 20_2_032EF960 20_2_032EF960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 20_2_032EED48 20_2_032EED48
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 21_2_02E2F090 21_2_02E2F090
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 21_2_02E2F960 21_2_02E2F960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 21_2_02E2ED48 21_2_02E2ED48
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 21_2_055F5198 21_2_055F5198
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 21_2_055F51A8 21_2_055F51A8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 21_2_055F10B8 21_2_055F10B8
PE / OLE file has an invalid certificate
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Static PE information: invalid certificate
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Static PE information: invalid certificate
PE file contains strange resources
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vlc.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vlc.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9FFWrx9i8Kuq.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9FFWrx9i8Kuq.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vlc.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vlc.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9FFWrx9i8Kuq.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9FFWrx9i8Kuq.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000000.200975576.0000000000BCA000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameZzjjddspu2.exe0 vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.272315963.0000000005390000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.272529925.0000000005520000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamePtgjunquq.dll4 vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.267762525.0000000002F82000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameClassLibrary3.dll< vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.267762525.0000000002F82000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameClient.exe" vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.833556159.0000000000B8A000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameZzjjddspu2.exe0 vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.839822026.0000000003207000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDyxylehx1.exe8 vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.833725048.0000000000F38000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.832620216.000000000045A000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameClient.exe" vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.842823257.00000000061E0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Binary or memory string: OriginalFilenameZzjjddspu2.exe0 vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000000.200975576.0000000000BCA000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameZzjjddspu2.exe0 vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.272315963.0000000005390000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.272529925.0000000005520000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamePtgjunquq.dll4 vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.267762525.0000000002F82000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameClassLibrary3.dll< vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.267762525.0000000002F82000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameClient.exe" vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.833556159.0000000000B8A000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameZzjjddspu2.exe0 vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.839822026.0000000003207000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDyxylehx1.exe8 vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.833725048.0000000000F38000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.832620216.000000000045A000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameClient.exe" vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.842823257.00000000061E0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Binary or memory string: OriginalFilenameZzjjddspu2.exe0 vs CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Yara signature match
Source: 0000000F.00000002.372345849.0000000003BE5000.00000004.00000001.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000005.00000002.831738365.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000014.00000002.358547843.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000E.00000002.355201046.00000000037C5000.00000004.00000001.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000015.00000002.376779243.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.269160984.0000000004035000.00000004.00000001.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: xRAT_1 date = 2017-12-11, hash2 = f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a, hash1 = 92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b, author = Florian Roth, description = Detects Patchwork malware, reference = https://goo.gl/Pg3P4W, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_KeyLogger_1 date = 2018-02-08, hash1 = c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: xRAT_1 date = 2017-12-11, hash2 = f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a, hash1 = 92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b, author = Florian Roth, description = Detects Patchwork malware, reference = https://goo.gl/Pg3P4W, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_KeyLogger_1 date = 2018-02-08, hash1 = c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: xRAT_1 date = 2017-12-11, hash2 = f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a, hash1 = 92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b, author = Florian Roth, description = Detects Patchwork malware, reference = https://goo.gl/Pg3P4W, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_KeyLogger_1 date = 2018-02-08, hash1 = c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000F.00000002.372345849.0000000003BE5000.00000004.00000001.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000005.00000002.831738365.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000014.00000002.358547843.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000E.00000002.355201046.00000000037C5000.00000004.00000001.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000015.00000002.376779243.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.269160984.0000000004035000.00000004.00000001.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: xRAT_1 date = 2017-12-11, hash2 = f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a, hash1 = 92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b, author = Florian Roth, description = Detects Patchwork malware, reference = https://goo.gl/Pg3P4W, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_KeyLogger_1 date = 2018-02-08, hash1 = c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: xRAT_1 date = 2017-12-11, hash2 = f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a, hash1 = 92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b, author = Florian Roth, description = Detects Patchwork malware, reference = https://goo.gl/Pg3P4W, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_KeyLogger_1 date = 2018-02-08, hash1 = c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: xRAT_1 date = 2017-12-11, hash2 = f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a, hash1 = 92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b, author = Florian Roth, description = Detects Patchwork malware, reference = https://goo.gl/Pg3P4W, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_KeyLogger_1 date = 2018-02-08, hash1 = c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: vlc.exe.0.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: vlc.exe.0.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: vlc.exe.0.dr, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.b40000.0.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.b40000.0.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.0.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.b00000.0.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.b00000.1.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 14.2.vlc.exe.340000.0.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 14.0.vlc.exe.340000.0.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 15.2.vlc.exe.600000.0.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 15.0.vlc.exe.600000.0.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 20.2.vlc.exe.df0000.1.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: vlc.exe.0.dr, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.b40000.0.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.b40000.0.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.0.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.b00000.0.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.b00000.1.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 14.2.vlc.exe.340000.0.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 14.0.vlc.exe.340000.0.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 15.2.vlc.exe.600000.0.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 15.0.vlc.exe.600000.0.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 20.2.vlc.exe.df0000.1.unpack, u0006/u0008.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, ufffd?u23de?u2b96???ue028??ufd45???ufffd??ue0ca?.cs Base64 encoded string: 'PWj6lHXDOxrLfwXNzfnaLMjOfzO9+W+4JxWWiTvfenV8SQApGzJ0Di/b8fuXcZ0M5PrXoL7V9sk8b6uX8xhtZw==', 'm0LUgy1TBJLS/Rv0+i1hOxLPRvKMsf09np12UQ5OrwBPWWSUYbRf+y9WQJ8KY1h7++uGSo0tWuw0x8ypgzipLl1b12b1d2xLp6CNHiFEtAk=', 'NcFtjbDOcsw7Evd3coMC0y4koy/SRZGydhNmno81ZOWOvdfg7sv0Cj5ad2ROUfX4QMscAIjYJdjrrs41+qcQwg==', 'T5995aiahDmRotzNR+wPzkhM3KlC5s/O43KC/1X3Cxu2swVztTyi14Z01j5qsLhy+ZSCP+lJl3YSu4KaMkTl74E6v3MGTgcDoCAikm98Vzg=', 'jLorJj8inqFdgz/bM7KXpwKX+vdTgIpVKMMjF72veNdt62nzBlqRLeihc0RWxDu4tSOd4DuvQwCqGcdB8QTCyQ=='
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, ufffd?u23de?u2b96???ue028??ufd45???ufffd??ue0ca?.cs Base64 encoded string: 'PWj6lHXDOxrLfwXNzfnaLMjOfzO9+W+4JxWWiTvfenV8SQApGzJ0Di/b8fuXcZ0M5PrXoL7V9sk8b6uX8xhtZw==', 'm0LUgy1TBJLS/Rv0+i1hOxLPRvKMsf09np12UQ5OrwBPWWSUYbRf+y9WQJ8KY1h7++uGSo0tWuw0x8ypgzipLl1b12b1d2xLp6CNHiFEtAk=', 'NcFtjbDOcsw7Evd3coMC0y4koy/SRZGydhNmno81ZOWOvdfg7sv0Cj5ad2ROUfX4QMscAIjYJdjrrs41+qcQwg==', 'T5995aiahDmRotzNR+wPzkhM3KlC5s/O43KC/1X3Cxu2swVztTyi14Z01j5qsLhy+ZSCP+lJl3YSu4KaMkTl74E6v3MGTgcDoCAikm98Vzg=', 'jLorJj8inqFdgz/bM7KXpwKX+vdTgIpVKMMjF72veNdt62nzBlqRLeihc0RWxDu4tSOd4DuvQwCqGcdB8QTCyQ=='
Source: classification engine Classification label: mal100.troj.evad.winEXE@11/5@2/2
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Mutant created: \Sessions\1\BaseNamedObjects\QSR_MUTEX_aEyHRwA2EwWBI7cCGO
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Mutant created: \Sessions\1\BaseNamedObjects\QSR_MUTEX_aEyHRwA2EwWBI7cCGO
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Jump to behavior
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe ReversingLabs: Detection: 12%
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe ReversingLabs: Detection: 12%
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File read: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File read: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe 'C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe'
Source: unknown Process created: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe'
Source: unknown Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe'
Source: unknown Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process created: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process created: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe 'C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe'
Source: unknown Process created: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe'
Source: unknown Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe'
Source: unknown Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process created: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process created: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_02D5B712 pushfd ; iretd 0_2_02D5B771
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_02D5F438 pushfd ; iretd 0_2_02D5F43D
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_02D5B712 pushfd ; iretd 0_2_02D5B771
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_02D5F438 pushfd ; iretd 0_2_02D5F43D
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 5_2_066CD100 push es; ret 5_2_066CD104
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 5_2_066CDF3F push es; ret 5_2_066CDF40
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Code function: 14_2_00D0B718 pushfd ; iretd 14_2_00D0B771
Source: initial sample Static PE information: section name: .text entropy: 7.95282361002
Source: initial sample Static PE information: section name: .text entropy: 7.95282361002
Source: initial sample Static PE information: section name: .text entropy: 7.95282361002
Source: initial sample Static PE information: section name: .text entropy: 7.95282361002

Persistence and Installation Behavior:

barindex
Creates processes with suspicious names
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: \cdc guides covid-19 second outbreak warning release.exe Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: \cdc guides covid-19 second outbreak warning release.exe Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: \cdc guides covid-19 second outbreak warning release.exe Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: \cdc guides covid-19 second outbreak warning release.exe Jump to behavior
Drops PE files
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Jump to dropped file
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Jump to dropped file
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Jump to dropped file
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Jump to dropped file

Boot Survival:

barindex
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe\:Zone.Identifier:$DATA Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe\:Zone.Identifier:$DATA Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vlc Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vlc Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vlc Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vlc Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File opened: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File opened: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File opened: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe File opened: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.272529925.0000000005520000.00000004.00000001.sdmp, vlc.exe, 0000000E.00000002.354177047.00000000036E1000.00000004.00000001.sdmp, vlc.exe, 0000000F.00000002.372345849.0000000003BE5000.00000004.00000001.sdmp, 9FFWrx9i8Kuq.exe, 00000026.00000002.837912973.0000000004387000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLLHEAD
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000000.00000002.272529925.0000000005520000.00000004.00000001.sdmp, vlc.exe, 0000000E.00000002.354177047.00000000036E1000.00000004.00000001.sdmp, vlc.exe, 0000000F.00000002.372345849.0000000003BE5000.00000004.00000001.sdmp, 9FFWrx9i8Kuq.exe, 00000026.00000002.837912973.0000000004387000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLLHEAD
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Window / User API: threadDelayed 676 Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Window / User API: threadDelayed 1715 Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Window / User API: threadDelayed 676 Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Window / User API: threadDelayed 1715 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe TID: 4664 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe TID: 6232 Thread sleep count: 676 > 30 Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe TID: 6232 Thread sleep count: 1715 > 30 Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe TID: 5884 Thread sleep count: 44 > 30 Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe TID: 5884 Thread sleep time: -110000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 6668 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 6868 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 4912 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 1380 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe TID: 4664 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe TID: 6232 Thread sleep count: 676 > 30 Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe TID: 6232 Thread sleep count: 1715 > 30 Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe TID: 5884 Thread sleep count: 44 > 30 Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe TID: 5884 Thread sleep time: -110000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 6668 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 6868 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 4912 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 1380 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\ Jump to behavior
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.842823257.00000000061E0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: vlc.exe, 0000000F.00000002.372076333.0000000002E5F000.00000004.00000001.sdmp Binary or memory string: vmware
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.837912973.0000000004387000.00000004.00000001.sdmp Binary or memory string: vmware+microsoft corporation
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.842823257.00000000061E0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.842823257.00000000061E0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.842823257.00000000061E0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.842823257.00000000061E0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: vlc.exe, 0000000F.00000002.372076333.0000000002E5F000.00000004.00000001.sdmp Binary or memory string: vmware
Source: 9FFWrx9i8Kuq.exe, 00000026.00000002.837912973.0000000004387000.00000004.00000001.sdmp Binary or memory string: vmware+microsoft corporation
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.842823257.00000000061E0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.842823257.00000000061E0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.842823257.00000000061E0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Memory allocated: page read and write | page guard Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
.NET source code references suspicious native API functions
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, ??u08bd????ue13eu26f9?ue3e2???uedca?uef61???.cs Reference to suspicious API methods: ('????????????????????', 'LoadLibrary@kernel32.dll'), ('????????????????????', 'GetProcAddress@kernel32.dll')
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, ??uf6f5???ue4b2?????????????.cs Reference to suspicious API methods: ('????????????????????', 'MapVirtualKeyEx@user32.dll')
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, ??u08bd????ue13eu26f9?ue3e2???uedca?uef61???.cs Reference to suspicious API methods: ('????????????????????', 'LoadLibrary@kernel32.dll'), ('????????????????????', 'GetProcAddress@kernel32.dll')
Source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, ??uf6f5???ue4b2?????????????.cs Reference to suspicious API methods: ('????????????????????', 'MapVirtualKeyEx@user32.dll')
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Memory written: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Memory written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Memory written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Memory written: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Memory written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Memory written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process created: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process created: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process created: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Process created: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Jump to behavior
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.836473892.00000000018D0000.00000002.00000001.sdmp, 9FFWrx9i8Kuq.exe, 00000026.00000002.834891803.0000000001D20000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.836473892.00000000018D0000.00000002.00000001.sdmp, 9FFWrx9i8Kuq.exe, 00000026.00000002.834891803.0000000001D20000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.836473892.00000000018D0000.00000002.00000001.sdmp, 9FFWrx9i8Kuq.exe, 00000026.00000002.834891803.0000000001D20000.00000002.00000001.sdmp Binary or memory string: Progman
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.836473892.00000000018D0000.00000002.00000001.sdmp, 9FFWrx9i8Kuq.exe, 00000026.00000002.834891803.0000000001D20000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.836473892.00000000018D0000.00000002.00000001.sdmp, 9FFWrx9i8Kuq.exe, 00000026.00000002.834891803.0000000001D20000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.836473892.00000000018D0000.00000002.00000001.sdmp, 9FFWrx9i8Kuq.exe, 00000026.00000002.834891803.0000000001D20000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.836473892.00000000018D0000.00000002.00000001.sdmp, 9FFWrx9i8Kuq.exe, 00000026.00000002.834891803.0000000001D20000.00000002.00000001.sdmp Binary or memory string: Progman
Source: CDC GUIDES COVID-19 Second Outbreak Warning release.exe, 00000005.00000002.836473892.00000000018D0000.00000002.00000001.sdmp, 9FFWrx9i8Kuq.exe, 00000026.00000002.834891803.0000000001D20000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9FFWrx9i8Kuq.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D9EC10 GetUserNameA, 0_2_05D9EC10
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Code function: 0_2_05D9EC10 GetUserNameA, 0_2_05D9EC10
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\CDC GUIDES COVID-19 Second Outbreak Warning release.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Quasar RAT
Source: Yara match File source: 0000000F.00000002.372345849.0000000003BE5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.831738365.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.358547843.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.355201046.00000000037C5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.376779243.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.269160984.0000000004035000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 2172, type: MEMORY
Source: Yara match File source: Process Memory Space: CDC GUIDES COVID-19 Second Outbreak Warning release.exe PID: 2764, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 4080, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 6588, type: MEMORY
Source: Yara match File source: Process Memory Space: CDC GUIDES COVID-19 Second Outbreak Warning release.exe PID: 5820, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 6824, type: MEMORY
Source: Yara match File source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected Quasar RAT
Source: Yara match File source: 0000000F.00000002.372345849.0000000003BE5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.831738365.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.358547843.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.355201046.00000000037C5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.376779243.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.269160984.0000000004035000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 2172, type: MEMORY
Source: Yara match File source: Process Memory Space: CDC GUIDES COVID-19 Second Outbreak Warning release.exe PID: 2764, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 4080, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 6588, type: MEMORY
Source: Yara match File source: Process Memory Space: CDC GUIDES COVID-19 Second Outbreak Warning release.exe PID: 5820, type: MEMORY
Source: Yara match File source: Process Memory Space: vlc.exe PID: 6824, type: MEMORY
Source: Yara match File source: 21.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.CDC GUIDES COVID-19 Second Outbreak Warning release.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 319216 Sample: CDC GUIDES COVID-19 Second ... Startdate: 18/11/2020 Architecture: WINDOWS Score: 100 41 Malicious sample detected (through community Yara rule) 2->41 43 Multi AV Scanner detection for dropped file 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 5 other signatures 2->47 7 CDC GUIDES COVID-19 Second Outbreak Warning release.exe 1 4 2->7         started        11 vlc.exe 2->11         started        13 vlc.exe 1 2->13         started        process3 file4 29 C:\Users\user\AppData\Roaming\...\vlc.exe, PE32 7->29 dropped 31 C:\Users\user\...\vlc.exe:Zone.Identifier, ASCII 7->31 dropped 33 CDC GUIDES COVID-1...ing release.exe.log, ASCII 7->33 dropped 49 Injects a PE file into a foreign processes 7->49 15 CDC GUIDES COVID-19 Second Outbreak Warning release.exe 15 3 7->15         started        20 vlc.exe 2 11->20         started        22 vlc.exe 2 13->22         started        signatures5 process6 dnsIp7 35 devils.shacknet.us 185.244.26.221, 4782, 49736 VAMU-ASIP-TRANSITVAMURU Netherlands 15->35 37 ip-api.com 208.95.112.1, 49735, 80 TUT-ASUS United States 15->37 27 C:\Users\user\AppData\...\9FFWrx9i8Kuq.exe, PE32 15->27 dropped 39 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->39 24 9FFWrx9i8Kuq.exe 2 15->24         started        file8 signatures9 process10 signatures11 51 Machine Learning detection for dropped file 24->51
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.95.112.1
 unknown United States
53334 TUT-ASUS false
185.244.26.221
 unknown Netherlands
47158 VAMU-ASIP-TRANSITVAMURU false

Contacted Domains

Name IP Active
ip-api.com 208.95.112.1 true
devils.shacknet.us 185.244.26.221 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://ip-api.com/json/ false
    		high