Edit tour

Windows Analysis Report
Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Overview

General Information

Sample Name:	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe
Analysis ID:	1312819
MD5:	fc7bfa776d061fc26712f3e7807132ad
SHA1:	19026b6eb5c1c272d33bda3eab8197bec692abab
SHA256:	fa98139b94cc56890af27e6dd02deb4da64b930e801492a966e0f13103808e2f
Tags:	AridViperexeporthopeminorhockey-net
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Initial sample is a PE file and has a suspicious name

Uses 32bit PE files

AV process strings found (often used to terminate AV products)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to query the security center for anti-virus and firewall products

PE file contains sections with non-standard names

PE file contains more sections than normal

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe (PID: 7144 cmdline: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe MD5: FC7BFA776D061FC26712F3E7807132AD)

WINWORD.EXE (PID: 6232 cmdline: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Palestinian heritage - what it is and what its forms are.docx" /o " MD5: 0B9AB9B9C4DE429473D6450D4297A123)

Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe (PID: 6624 cmdline: "C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe" -S MD5: FC7BFA776D061FC26712F3E7807132AD)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	ReversingLabs: Detection: 15%
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Virustotal: Detection: 22%			Perma Link

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.23.41

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623889122.0000000003E25000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623889122.0000000003E71000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520379241.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41/
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E19000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.00000000012E9000.00000004.00000020.00020000.00000000.sdmp, sys-app.log.0.dr	String found in binary or memory: http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E69000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/&
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520379241.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/0R7AzFA15X7JT.k
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E12000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E61000.00000004.00001000.00020000.00000000.sdmp, sys-app.log.0.dr	String found in binary or memory: http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/301WkQP1w201
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E2B000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001317000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623889122.0000000003E71000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.00000000012E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/58qi223ZpSVQ
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/58qi223ZpSVQS)
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/58qi223ZpSVQm)
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/58qi223ZpSVQv6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E77000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/58qi223ZpSVQxow/on8wielMn1kciojusjku/
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/9VB3908FyOD2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/fuiafC2C7q8F
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E19000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/rK9WneycEM3g
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/rK9WneycEM3gc6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/vjSxfP5Ecm9h
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/wy2A13PxWw5lI6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520379241.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41:80/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/1tjs0cRKqy7RW7g
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623889122.0000000003E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41:80/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/301WkQP1w201/mUmHQ14UO7EV
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623889122.0000000003E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.181.23.41:80/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/58qi223ZpSVQ
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520379241.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net/
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E51000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E41000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E51000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E41000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/41xxIG3vApo1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E51000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E41000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/6xp298X38QRX
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/LdVj6E1BF58N
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.410224641.0000000003E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/a6dlgykyHJ5p
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/gfw23H8p4o3L
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/gfw23H8p4o3LM
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520373337.0000000003E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/hqtYy32fyqss
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520379241.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/hqtYy32fyqssZK~
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520373337.0000000003E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/hqtYy32fyqsscn
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520379241.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net/kv
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520379241.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net:80/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/hqtYy32fyqss
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/ImS0pODt3fkV=
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/J5t395b89D1a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/J5t395b89D1ae
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520379241.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/Tm1yTI5qHn9u
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E41000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/k8NZL4c5tZUc
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/mUmHQ14UO7EV
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E19000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/on8wielMn1kc
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	String found in binary or memory: http://www.google.com/bot.html)
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002EA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/bot.html)ed
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002EBB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/bot.html)q
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392540997.0000000001094000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/bot.html)tup1H
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.aadrm.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.aadrm.com/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.cortana.ai
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.microsoftstream.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.office.net
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.onedrive.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://api.scheduler.
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://augloop.office.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://cdn.entity.
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://clients.config.office.net
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://clients.config.office.net/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://config.edge.skype.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://cortana.ai
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://cortana.ai/api
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://cr.office.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://d.docs.live.net
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://designerapp.officeapps.live.com/designerapp
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://dev.cortana.ai
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://devnull.onenote.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://directory.services.
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://ecs.office.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://graph.windows.net
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://graph.windows.net/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://invites.office.com/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://lifecycle.office.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://login.windows.local
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://make.powerautomate.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://management.azure.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://management.azure.com/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://messaging.action.office.com/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://messaging.office.com/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://ncus.contentsync.
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://officeapps.live.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://onedrive.live.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://outlook.office.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://outlook.office.com/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://outlook.office365.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://outlook.office365.com/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000002.392775999.0000000000E16000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392640890.0000000000E16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://porthopeminorhockey.net/
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E27000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E20000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392540997.0000000001067000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392540997.0000000001085000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000002.392848954.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392540997.000000000109B000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392515127.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392540997.0000000001010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392640890.0000000000E1D000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392540997.00000000010AB000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000002.392848954.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392515127.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392540997.0000000001010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/K5P1f1QLuM3s
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E27000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/W26RaOBcdo2D
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E51000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E41000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.00000000012E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/11zKuDybz072
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/11zKuDybz072E
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/53k4J88xbr2FU
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623889122.0000000003E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://porthopeminorhockey.net:8888/
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E39000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E41000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/3rJ5Qf1yDM25
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/3rJ5Qf1yDM255
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E48000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E41000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/vqgiY2Q88BN8
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pothopeminorhockey.net/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://settings.outlook.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://staging.cortana.ai
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://substrate.office.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://tasks.office.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://wus2.contentsync.
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: 9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	String found in binary or memory: https://www.yammer.com

Source: unknown

DNS traffic detected: queries for: porthopeminorhockey.net

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E61000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamecomctl32.DLL.MUIj% vs Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392540997.0000000001051000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamecomctl32.DLL.MUIj% vs Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Section loaded: sfc.dll

Jump to behavior

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Static PE information: Number of sections : 11 > 10

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	ReversingLabs: Detection: 15%
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Virustotal: Detection: 22%

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Palestinian heritage - what it is and what its forms are.docx" /o "
Source: unknown	Process created: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe "C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe" -S
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Palestinian heritage - what it is and what its forms are.docx" /o "	Jump to behavior

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.lnk.0.dr

LNK file: ..\..\..\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Mutant created: \Sessions\1\BaseNamedObjects\m3..0919

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

File created: C:\Users\user\AppData\Roaming\uydyrek5.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

File created: C:\Users\user\AppData\Local\Temp\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.lnk

Jump to behavior

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	String found in binary or memory: ;application/vnd.adobe.air-application-installer-package+zip
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	String found in binary or memory: application/vnd.groove-help
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	String found in binary or memory: "application/x-install-instructions

Source: classification engine

Classification label: mal52.winEXE@4/10@63/2

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Static file information: File size 3386880 > 1048576

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2a1c00

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Static PE information: section name: .didata

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE			Jump to behavior

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe TID: 6864

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392640890.0000000000E1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC>}8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.00000000012E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: select * from antivirusproduct	memstr_19439f5a-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: execquery	memstr_f4328cbe-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: _newenum	memstr_07bc9ba0-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: displayname	memstr_396963e3-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: #getantivirusproductinfoexception :	memstr_bf4c6856-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: no avu	memstr_f94f55ba-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: hh:nn:ss	memstr_e6a5ae21-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: :=>>	memstr_78304f76-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: inthex :	memstr_e461ba70-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: :=>> sart...	memstr_da2ec518-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: procresponse$0$intf	memstr_83621f61-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: procresponse$0$intf'	memstr_a47f90bf-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: procresponse$2$intf	memstr_6dd5da8b-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: procresponse$2$intf'	memstr_b8cbed4d-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: procresponse$1$intf	memstr_311ba64d-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: procresponse$1$intf'	memstr_163e948d-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: val_0	memstr_e744b573-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: opres	memstr_eb2e41d8-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: procresponse$actrec	memstr_1e81e8d2-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: procresponse$actrecpq	memstr_1c720f6c-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: c123d	memstr_5d5a0aa6-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: l123g	memstr_5dc2b00c-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: s123s	memstr_bffca4c8-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: mm-dd-yyyy_hh-nn-ss	memstr_4c5d9873-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: d123l	memstr_ffdad779-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: val_2 :	memstr_06b2fa90-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: val_3 :	memstr_3f2b8873-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: tform1.sendhttppost$0$intf	memstr_937307e8-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: tform1.sendhttppost$0$intf'	memstr_51bb9330-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: tform1.sendhttppost$actrec	memstr_5e9ea0ab-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: hmozilla/5.0 (compatible; googlebot/2.1; +http://www.google.com/bot.html)	memstr_e3eb78d8-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: %text/html, application/xhtml+xml, /	memstr_c8b83536-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: url :	memstr_85d73846-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: stcode :	memstr_96bd4584-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: res :	memstr_d388f60e-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: excp :	memstr_0a621934-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: sendhttppost :	memstr_8183749d-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: :: guri : u	memstr_0e2f608c-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: cnrgxc	memstr_3278bb47-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: pkohqzxxd	memstr_8fcca179-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: shhmkr	memstr_caec3a31-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: xqqjjwdgu	memstr_9460c475-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: up--stcode :	memstr_7816c729-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: up--strcontent :	memstr_4e04b876-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: :=>> upfle :=>> $	memstr_a9d488e6-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: tform1.delterequest$0$intf	memstr_6b3ad2c7-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: tform1.delterequest$0$intf'	memstr_8f55507c-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: strlist	memstr_378fb23c-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: tform1.delterequest$actrec	memstr_f1732f18-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: :=>> u	memstr_9c1cd44c-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: aijfhr	memstr_70c0d3af-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: dproc finish.	memstr_4af5d34e-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: gf :	memstr_f2c6c592-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: qqqqqqq3	memstr_64e2594f-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: windows monu	memstr_50bb5940-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: computername	memstr_2e5ea1b0-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: username	memstr_9015f375-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: no av	memstr_2858f240-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: secvnnkjl	memstr_a7274fa9-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: gfgwzqnql	memstr_e23acfe1-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: empty...	memstr_77ba0b5f-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: fcmpzxlop	memstr_196e7230-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: m3..0919	memstr_7dd14d8a-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: obnponshx	memstr_8a023b75-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: >\palestinian heritage - what it is and what its forms are.docx	memstr_fa48c62f-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: resource_1docx	memstr_1fa8e538-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: "open	memstr_cb271b47-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: resst :	memstr_ac2343fa-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: timer2.interval : s	memstr_e040c3c3-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: \sys-app.log	memstr_a0821d81-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: timer5timer :	memstr_300f195c-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: applicationvariables	memstr_803148a0-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: sysinit	memstr_fe13576e-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.win.comconst	memstr_61fb2581-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.varutils	memstr_2bc8f896-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.sysconst	memstr_b2def8d8-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.internal.excutils	memstr_201423be-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.character	memstr_f76d190e-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.rtlconsts	memstr_7e4a740b-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.psapi	memstr_7ab7bc38-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.shfolder	memstr_978fded5-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.imagehlp	memstr_1d4c7ab0-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.ansistrings	memstr_6aede8fb-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.strutils	memstr_3d7470cb-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.diagnostics	memstr_e1528fb9-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.math	memstr_1c9a0605-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.hash	memstr_25aaed68-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.messages	memstr_88486094-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.msxmlintf	memstr_cdf33194-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.structuredquerycondition	memstr_5577ecfc-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.propsys	memstr_8a0eeee9-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.objectarray	memstr_0a4d4f6b-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.urlmon	memstr_193861c9-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.wininet	memstr_3d6dcd68-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.regstr	memstr_f1f2ba4a-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.shellapi	memstr_6599f0a0-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.ipexport	memstr_bf9a6b16-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.winsock2	memstr_d54f47ce-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.qos	memstr_0bf8d11a-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.commctrl	memstr_c117c24c-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.inifiles	memstr_7a24225f-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.ioutils	memstr_6f82969d-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.knownfolders	memstr_db3dcbbc-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.netconsts	memstr_8717a38d-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.win.crtl	memstr_f9d55537-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.winhttp	memstr_f43cd385-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: idstream	memstr_f97f33e6-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: idresourcestrings	memstr_0cdb5a88-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.winsock	memstr_c134fa84-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.iphlpapi	memstr_5442b48a-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.iprtrmib	memstr_ba825b77-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.iptypes	memstr_ae3e91bf-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: idwship6	memstr_4db18b18-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: ididn	memstr_55e17a98-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: idstackconsts	memstr_cdf3ac23-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: idresourcestringsprotocols	memstr_36001d62-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: idresourcestringscore	memstr_93c02eef-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: idassignednumbers	memstr_94e20f79-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: idipaddress	memstr_3f345aba-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: idcharsets	memstr_4a55cfc3-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.net.httpclientcomponent	memstr_54a0f6a9-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: vcl.graphutil	memstr_dac0761b-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: vcl.consts	memstr_ceef9d9c-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.uiconsts	memstr_c3c8d6e2-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.uxtheme	memstr_b3fe59f7-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.multimon	memstr_a3e88bdb-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: vcl.themesvcl.forms	memstr_74a7970b-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.peninputpanel	memstr_18180d91-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.msinkaut	memstr_4bd1e56c-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.tpcshrd	memstr_d7745df0-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.dwmapi	memstr_5422e255-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.msctf	memstr_b4f8d827-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: vcl.actnlistvcl.menus	memstr_b9a386c6-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.imm	memstr_93f36442-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.commdlg	memstr_b389511b-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: vcl.comstrs	memstr_475168ed-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.winspool	memstr_0e22404f-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: vcl.listactns	memstr_2201389c-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: vcl.toolwin	memstr_fc2181fd-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.richedit	memstr_1beb90a7-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: vcl.clipbrd	memstr_7594a454-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.flatsb	memstr_13cbad4f-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.shellscaling	memstr_1eb7b931-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.win.taskbar	memstr_e63d65a6-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winapi.dlgs	memstr_51e4f5eb-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.widestrutils	memstr_feae3cf5-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: system.maskutils	memstr_d633a254-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: vcl.mask	memstr_38f608ad-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: vcl.imaging.jconsts	memstr_9906c48c-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: pjjjh$8	memstr_4c71298b-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: pjjh$8	memstr_de724594-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: pjjjhh8	memstr_898b9d26-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: pjjhh8	memstr_dd5aeee8-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: pjjjhd8	memstr_902c444d-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: pjjhd8	memstr_83dbd127-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: t=hthh	memstr_2b0fca35-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: software\microsoft\windows nt\currentversioncurrentmajorversionnumbercurrentminorversionnumbercurrentversion.currentbuildcurrentbuildnumberu	memstr_f6dd7138-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: qqqqqq3	memstr_9702a287-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: delphi picturedelphi component	memstr_91522869-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: defaultusrpwdm	memstr_c3c31091-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: taskbarcreated	memstr_7b8a6e2e-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: taskbarcreatedtaskbarbuttoncreatedu	memstr_d6a5fd75-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: winhttp.dll	memstr_1fe67f1f-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: https	memstr_8b32f5f9-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: kernel32.dll	memstr_9994220b-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: getfilesizeex	memstr_aac8bcf7-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000000.351761309.00000000008E1000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: false	memstr_dd97b9a4-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E39000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: jzzwjqasf=revts1rpuc03mtzunzcxx2hhcmr6x1hqntryn3dw&secvnnkjl=ifdpbmrvd3mgrgvmzw5kzxi%3d&gfgwzqnql=v2luzg6slc	memstr_acf2d2b9-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E39000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: zvcm1zx2fyzv9kb2n4lmv4zq==>	memstr_2aed0693-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E39000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 0application/x-www-form-urlencoded; charset=utf-8%3d&9) a connection with the server could not be established	memstr_57f3772c-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E39000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: zvcm1zx2fyzv9kb2n4lmv4zq==>> sendhttppost : error sending data: (12007) the server name or address could not be resolved	memstr_706681cd-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E39000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 10:29:48 :=>> excp : 7 :: guri : http://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/	memstr_b5eccc87-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E39000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: hx=bt	memstr_18ffdab7-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E39000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: https://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/3rj5qf1ydm25	memstr_47289656-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E39000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 10:29:48 :=>> excp : 7	memstr_99f766f0-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E39000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 10:29:48 :=>> sendhttppost : error sending data: (12007) the server name or address could not be resolved	memstr_283ce86c-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\storage#volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\volume{4b110390-e32a-400c-bf41-7fe93773464a}\	memstr_7d4f9df8-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\	memstr_837c9c45-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\programdata\microsoft\desktop.iniej	memstr_51a05129-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rt menu\desktop.iniwj	memstr_78016414-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\desktop.ini	memstr_b92c4010-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ininj	memstr_887e2af9-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\onedrive\desktop.ini~j	memstr_4901bfa5-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\windows powershell\desktop.ininj	memstr_bc01b899-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\downloads\desktop.inimj	memstr_19c69eff-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @c:\windows\syswow64\windows.ui.immersive.dll,-38304rj	memstr_7caf94bb-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\desktop.ininj	memstr_5702ca7a-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\desktop\desktop.inizj	memstr_67a2df1e-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ininj	memstr_e0ce1f69-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\documents\desktop.ini~j	memstr_a295a2e3-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\administrative tools\desktop.ininj	memstr_2ee646ab-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hc:\users\public\desktop\desktop.inivj	memstr_5098e0cc-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\programdata\microsoft\windows\start menu\programs\desktop.iniwj	memstr_fe37418a-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ininj	memstr_b175c59d-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\pictures\desktop.inikj	memstr_03be16b9-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: esktop.ini$	memstr_8146a0c3-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\programdata\microsoft\windows\start menu\programs\accessibility\desktop.inivj	memstr_014d5ed0-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\local\microsoft\windows\burn\burn\desktop.inisj	memstr_5e9f618f-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pc:\programdata\microsoft\windows\start menu\desktop.iniqj	memstr_30485624-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ~c:\programdata\microsoft\windows\start menu places\desktop.iniuj	memstr_9a4a62d1-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\desktop.iniej	memstr_783396d5-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c:\p1	memstr_4384a35a-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: users	memstr_67bf8f2c-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: users<	memstr_0d644b2c-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .users	memstr_b72cbbc1-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hardz	memstr_8ca1eece-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: user<	memstr_56c1b4fb-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .user	memstr_7cb7bc23-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: documents	memstr_4a6fb640-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: documentsd	memstr_b45bfd52-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .documents	memstr_146c3d2a-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}dj	memstr_6a446fb3-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [.shellclassinfo	memstr_8df4a3fb-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21770	memstr_abbad647-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconresource%systemroot%\system32\imageres.dll,-112	memstr_249a8f81-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconfile%systemroot%\system32\shell32.dll	memstr_063cf9f4-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconindex-235	memstr_6a2b0d0e-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c:\x1	memstr_454d0ef8-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: usersd	memstr_1369f059-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6wzc.	memstr_7c5f3e13-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: users@shell32.dll,-21813	memstr_6d40aa77-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: chardz	memstr_42230666-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appdata	memstr_2573a043-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appdata@	memstr_a18afe36-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6wvc.	memstr_b58e581d-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: roaming	memstr_ba128c87-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: roaming@	memstr_555f0f5f-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6wwc.	memstr_a43bf582-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d1,roaming	memstr_86707ef8-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: micros~1	memstr_6f6bfed1-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: micros~1d	memstr_1b7c3a4f-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft	memstr_02719f03-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: windows	memstr_05bd594a-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: windows@	memstr_46b901e0-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cwindows	memstr_4b51e6ee-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startm~1	memstr_ad6d79ca-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startm~1n	memstr_9534f474-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: start menu@shell32.dll,-21786	memstr_606e4f75-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programs	memstr_fd5f6a1b-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programsj	memstr_03fa2ae5-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programs@shell32.dll,-21782	memstr_e7b8bf1b-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startup	memstr_ad278f05-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startuph	memstr_545d551e-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startup@shell32.dll,-21787	memstr_5dfa5f0d-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ll3rj	memstr_c9da95c0-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21786	memstr_7f76691c-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs1j	memstr_f4c5bce2-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .appdata	memstr_dd6a05e0-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .roaming	memstr_e62851e9-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoftd	memstr_8bbebfa9-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .microsoft	memstr_88188dba-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .windows	memstr_90c7810f-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: libraries	memstr_a25996c2-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: librariesd	memstr_b27880f8-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .libraries	memstr_a37d7afc-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pc:\users\user\appdata\roaming\microsoftgj	memstr_b35111d6-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\volume{b8455d9b-4916-480e-8b44-905b33ca001e}\sj	memstr_08c7a407-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\desktop.iniiniuj	memstr_8c48deae-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{088e3905-0323-4b02-9826-5d99428e115f}lj	memstr_b760413a-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_ipjwnf_sata_cd00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+j	memstr_75223ef5-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\pl%	memstr_744ef3d8-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: music	memstr_d8765f28-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: music<	memstr_49b5e134-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .music	memstr_d7b2d3d8-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{24ad3ad4-a569-4530-98e1-ab02f9417aa8}jj	memstr_684b89d6-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21790	memstr_91904f96-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: infotip@%systemroot%\system32\shell32.dll,-12689	memstr_edcb48e3-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconresource%systemroot%\system32\imageres.dll,-108	memstr_c306e250-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconindex-237	memstr_aa0bbb99-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\windows.storage.dll,-21798d	memstr_c123b1e4-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pce (z'	memstr_345a6927-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%commonprogramfiles%\system\wab32res.dll,-10200@	memstr_c006e849-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\n	memstr_1c9ca366-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%commonprogramfiles%\system\wab32res.dll,-10100\	memstr_dacd797e-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\windows.storage.dll,-21824	memstr_53a8bc7b-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p;"ux	memstr_29d7edc0-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\windows.storage.dll,-21770	memstr_2228eb67-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\windows.storage.dll,-34583	memstr_2f7f4921-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\windows.storage.dll,-21790	memstr_8fc6b8fc-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\windows.storage.dll,-21779(	memstr_93d3894d-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\settingsynccore.dll,-10246	memstr_e16cd30b-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\windows.storage.dll,-21818	memstr_de32eea6-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\windows.storage.dll,-21791ck	memstr_4205bd80-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-12689c	memstr_09b1b227-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-12690o	memstr_fe451bfd-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21801{	memstr_ab26bbfe-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-12688g	memstr_8fab8382-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ::{20d04fe0-3aea-1069-a2d8-08002b30309d}s	memstr_df4b9d11-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21769_	memstr_e70ffea3-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21790	memstr_980078e2-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-1040	memstr_788b1323-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-12689	memstr_0d9471fa-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21791	memstr_0d9f2933-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\windows.storage.dlll	memstr_600a29c4-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21799	memstr_fa4dbed1-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-12688	memstr_e35b4fe7-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21802	memstr_2a220010-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21769	memstr_3cb63dd8-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21770#	memstr_18f105f2-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21779/	memstr_a9d7f27a-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-12690;	memstr_8659a23b-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21798	memstr_de14d4fd-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\windows.storage.dllldj	memstr_240e4e5c-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: desktop	memstr_fd7f13fc-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: desktop@	memstr_87fb1d91-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .desktop	memstr_934fc72f-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\librariesoj	memstr_3c27d29a-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell:::{018d5c66-4533-4307-9b53-224de2ed1fe6}sj	memstr_9ee61f4d-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pc:\users\user\appdata\roaming\microsoftwindows\start menusk`j	memstr_36491c59-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\desktop.inigj	memstr_38b032ac-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21769	memstr_d02e630b-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconresource%systemroot%\system32\imageres.dll,-183	memstr_f0842014-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{d3162b92-9365-467a-956b-92703aca08af}kj	memstr_051c5366-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [localizedfilenames	memstr_f310d4dd-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: onedrive.lnkonedrive	memstr_7cb72438-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21782	memstr_db8cf1da-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t mck	memstr_5913224e-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hj(5w<	memstr_32e531a7-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ncacn_npte aliases	memstr_bac794a3-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: }d"pn	memstr_0dc01f3b-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\videosf	memstr_c376d232-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\onedrive	memstr_2754e2ef-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\pictures	memstr_c4e4577c-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pictures	memstr_7dbd19f6-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: picturesb	memstr_a45aa8d1-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .pictures	memstr_50b5f31b-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}dj	memstr_ad86361b-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21779	memstr_2cd94df4-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: infotip@%systemroot%\system32\shell32.dll,-12688	memstr_cdc86298-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconresource%systemroot%\system32\imageres.dll,-113	memstr_3c6a937e-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconindex-236	memstr_5ffbab53-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: videos	memstr_52cfb0b6-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: videos>	memstr_e69bac12-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .videos	memstr_aca2a235-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p{b4bfcc3a-db2c-424c-b029-7fe99a87c641}twindowsmj	memstr_bf84e802-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\programdata\microsoft\windows\start menu\programsck	memstr_5c8562e8-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: local pictures?	memstr_ea218f2c-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: local downloads	memstr_1e348e23-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\sers	memstr_0c450e21-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: local documents{	memstr_d52251b0-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appdata\roaming@	memstr_6b050e66-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: local videoso	memstr_f58291a7-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c\users\hdz	memstr_179d58fa-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \pipe\srvsvc$	memstr_24ad53b1-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user	memstr_7c9dec93-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: commonpictures	memstr_72e12963-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: common programs	memstr_e9145660-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: saved pictures	memstr_eb71af70-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: commondownloads	memstr_04114ef3-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: userprofiles	memstr_9b498ae5-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: common desktop	memstr_74328d5c-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users	memstr_ce4c524e-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: common startup	memstr_f7fa5997-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: savedpictures	memstr_47ffcf86-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programfilesx86	memstr_26c5f69c-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\public	memstr_67ad1b88-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: quick launch	memstr_51ad5bc1-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: onedrivemusic	memstr_5a6df246-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows	memstr_20ba4c61-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programfilesrj	memstr_fcca32d0-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rtup\desktop.inizj	memstr_db24c649-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini	memstr_0d1dda0a-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21787	memstr_62e62cbc-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6wwcd	memstr_9002ddb5-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-3o	memstr_8e046d99-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-3z	memstr_e1d04799-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-189p	memstr_fe198b04-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\syswow64\windows.storage.dll[	memstr_727b6d69-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: security=impersonation dynamic false~1	memstr_6184c6d7-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-113	memstr_12e910a0-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-108	memstr_5a6252a8-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\windows.storage.dll	memstr_e98b2a94-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-183	memstr_96709e34-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\pictures\saved pictures	memstr_86ae8b18-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\pictures\camera roll	memstr_f5e71e3e-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: oaming	memstr_71994f15-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\documents\desktop.inioaming	memstr_55b3cca3-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-112	memstr_80b4bd3e-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\syswow64\windows.storage.dll	memstr_80b73eda-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-3	memstr_24ba2709-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-184	memstr_014c2667-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\downloads\desktop.inib5	memstr_ed8423f9-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-112w	memstr_31d33745-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-113b	memstr_ba479d7c-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-189m	memstr_aa80d688-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-3x	memstr_d0bbef90-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-115	memstr_a16ab932-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-186	memstr_b561e3c4-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\program files (x86)\common files	memstr_7106cb31-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .docx	memstr_7ef8bd28-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-18	memstr_324ea128-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\onedrive\documents	memstr_3aae4b1f-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-181	memstr_abd677af-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\windows.storage.dll'	memstr_c422d3df-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\onedrive\pictures2	memstr_fe573836-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\shell32.dll,-2=	memstr_f2662d3c-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\shell32.dll,-6	memstr_2b7a9f84-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-198d	memstr_5aebe6d8-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21791	memstr_127b4cea-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: infotip@%systemroot%\system32\shell32.dll,-12690	memstr_52d17c5d-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconresource%systemroot%\system32\imageres.dll,-189	memstr_a5086e91-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconindex-238	memstr_d8c24734-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: downloads	memstr_cd0e342f-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: downloadsd	memstr_37991c37-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .downloads	memstr_6031faed-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .onedrive	memstr_653d1524-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21798	memstr_d3b317d0-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconresource%systemroot%\system32\imageres.dll,-184	memstr_66ca1ee0-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "c:\program files (x86)\microsoft office\office16\winword.exe" /n "p	memstr_349b6064-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: onedrive	memstr_4c5f15b2-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: onedriveb	memstr_13f5621f-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ::{26ee0668-a00a-44d7-9371-beb064c98683}\0\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}\::{d450a8a1-9568-45c7-9c0e-b4f9fb4537bd}	memstr_14e8ebb1-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ::{26ee0668-a00a-44d7-9371-beb064c98683}\0\::{9c73f5e5-7ae7-4e32-a8e8-8d23b85255bf}\::{f1390a9a-a3f4-4e5d-9c5f-98f3bd8d935c},	memstr_e4c94252-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w@$#f	memstr_f1521f01-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ::{26ee0668-a00a-44d7-9371-beb064c98683}\0\::{9c73f5e5-7ae7-4e32-a8e8-8d23b85255bf}\::{e413d040-6788-4c22-957e-175d1c513a34},	memstr_75519e17-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ::{26ee0668-a00a-44d7-9371-beb064c98683}\0\::{9c73f5e5-7ae7-4e32-a8e8-8d23b85255bf}\::{bc48b32f-5910-47f5-8570-5074a8a5636a},	memstr_09c9d3f1-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e0http://schemas.openxmlformats.org/package/2006/relationships-8d	memstr_6c61a027-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c48b32f-5910-47f5-8570-5074a8a5636a},y	memstr_c693d325-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://schemas.openxmlformats.org/officedocument/2006/extended-properties	memstr_e6527442-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: favorites	memstr_c681b7a3-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: favoritesd	memstr_be655922-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .favorites	memstr_35216fd1-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e0http://schemas.microsoft.com/office/word/2010/wordprocessingcanvasawpc	memstr_51bb9542-c
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9568-45c7-9c0e-b4f9fb4537bd}	memstr_138684da-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://schemas.openxmlformats.org/package/2006/content-types	memstr_72aa42f7-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ritage_-	memstr_a5361c2f-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: and_what	memstr_0be894c2-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: re_docx.	memstr_3f38a75f-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \users\h<	memstr_109da7ce-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \palestid	memstr_527cfe59-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e_-_what	memstr_4103d519-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hat_its_	memstr_75d8c663-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cx.exee	memstr_b98d7a55-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t_it_is_	memstr_4b077309-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\local\microsoft\windows\inetcookies	memstr_3ce1e3fb-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =9ncalrpc:[epmapper,security=impersonation dynamic false]	memstr_f18e36ac-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: desktop-716t771	memstr_50c7e4c3-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 192.168.2.3	memstr_22e02853-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lmemp	memstr_561f55eb-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8lmemph	memstr_b8e9d8c6-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\programdata\microsoft\windows\start menu\programs\startup:	memstr_902e9ed9-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menum	memstr_62c3b743-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\local\microsoft\windows\inetcache	memstr_cb7aa510-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ppdata\r	memstr_b0014fed-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ming\mic	memstr_54679405-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: soft\win	memstr_b7ee70a7-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ws\start	memstr_66e6b622-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: enu\prog	memstr_ba554cdf-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms\start(	memstr_577f5176-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \palesti<	memstr_35de01ec-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: an_herite_-_whathj	memstr_cf8501e0-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nd_what_its_forms_are_docx.lnk$	memstr_c06b3433-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{b4bfcc3a-db2c-424c-b029-7fe99a87c641}uj	memstr_fdeef884-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: clsid\{0e5aae11-a475-4c5b-ab00-c66de400274e}	memstr_35a846e2-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: my videoh	memstr_03ad1c6f-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ncacn_npl	memstr_63df2dee-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: favoritesx	memstr_055ffe24-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: personal\|	memstr_499e9f51-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camera rolld	memstr_8ba49bdf-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: favoritesh	memstr_b2bc5332-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: playlistsl	memstr_df029959-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: commonmusicx	memstr_f95a2f31-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: playlists	memstr_9348fff5-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: commonvideo	memstr_4551e435-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: my music	memstr_c37b0f58-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camera roll	memstr_d16115bf-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: my pictures	memstr_b76797d3-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: systemx86	memstr_ddf902b3-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: contacts	memstr_ab498fc2-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: saved games	memstr_bcc8f3e1-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: savedgames(	memstr_e0bb3e0b-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: contacts,	memstr_7b5603c0-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cuser&j	memstr_89d6cfd1-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 062332-1002bj	memstr_a838e870-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: admin$	memstr_88582a90-7
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: remote admin	memstr_34f54de4-1
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: default share	memstr_1667f7fe-a
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: remote ipc	memstr_87f728bc-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: krewg	memstr_793cc30b-4
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5441eb3d]	memstr_c668915c-2
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: computer\userhj	memstr_6c8b547d-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: admin$remote adminc:\windowsc$default sharec:\ipc$remote ipc*	memstr_fa916af7-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lmem8	memstr_634a224d-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <$)w$	memstr_50f78517-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #\'g7	memstr_cd4abd18-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: software\im providers\teams	memstr_63693c8f-f
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\sfc.dll	memstr_dbaed4fa-d
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\links	memstr_ee21d610-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\3d objects8	memstr_58d62504-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\msi.dll`	memstr_2ee232a3-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nt authority\networkserviceh	memstr_cb687a15-0
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: common start menu placesp	memstr_48e16f97-8
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft\windows\templatesx	memstr_a33067ee-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft\windows\ringtonesx	memstr_3c3cff99-b
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft\windows\history	memstr_3fbb007d-9
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft\windows\templates	memstr_e9074de1-5
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft\windows\burn\burn	memstr_88547bfc-3
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: savedpictures.library-ms	memstr_c491f3c0-6
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft\windows\recent	memstr_62262df2-e
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.359980530.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: common administrative tools	memstr_a7fcbaba-6

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Palestinian heritage - what it is and what its forms are.docx" /o "

Jump to behavior

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520379241.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r\MsMpeng.exe
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001317000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: les%\Windows Defender\MsMpeng.exe
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623889122.0000000003E25000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.410224641.0000000003E01000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001317000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623889122.0000000003E71000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001306000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623889122.0000000003E25000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520379241.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Defender\MsMpeng.exe
Source: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520379241.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	31 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Non-Application Layer Protocol	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 DLL Side-Loading	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	16%	ReversingLabs	Win32.Trojan.SpywareX
Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	23%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
porthopeminorhockey.net	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://porthopeminorhockey.net/kv	0%	Avira URL Cloud	safe
https://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/vqgiY2Q88BN8	0%	Avira URL Cloud	safe
http://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/J5t395b89D1a	0%	Avira URL Cloud	safe
https://cdn.entity.	0%	Avira URL Cloud	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	Avira URL Cloud	safe
http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/rK9WneycEM3g	0%	Avira URL Cloud	safe
http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/301WkQP1w201	0%	Avira URL Cloud	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	Virustotal		Browse
https://api.aadrm.com/	0%	Avira URL Cloud	safe
http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/hqtYy32fyqsscn	0%	Avira URL Cloud	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	Avira URL Cloud	safe
https://officeci.azurewebsites.net/api/	0%	Avira URL Cloud	safe
https://api.aadrm.com/	0%	Virustotal		Browse
https://my.microsoftpersonalcontent.com	0%	Avira URL Cloud	safe
https://store.office.cn/addinstemplate	0%	Avira URL Cloud	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	Virustotal		Browse
http://5.181.23.41:80/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/1tjs0cRKqy7RW7g	0%	Avira URL Cloud	safe
https://my.microsoftpersonalcontent.com	0%	Virustotal		Browse
https://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/W26RaOBcdo2D	0%	Avira URL Cloud	safe
https://porthopeminorhockey.net/	0%	Avira URL Cloud	safe
https://officeci.azurewebsites.net/api/	0%	Virustotal		Browse
https://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/K5P1f1QLuM3s	0%	Avira URL Cloud	safe
https://www.odwebp.svc.ms	0%	Avira URL Cloud	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	Avira URL Cloud	safe
https://store.office.cn/addinstemplate	0%	Virustotal		Browse
http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/41xxIG3vApo1	0%	Avira URL Cloud	safe
http://5.181.23.41:80/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/301WkQP1w201/mUmHQ14UO7EV	0%	Avira URL Cloud	safe
https://d.docs.live.net	0%	Avira URL Cloud	safe
https://porthopeminorhockey.net/	2%	Virustotal		Browse
https://ncus.contentsync.	0%	Avira URL Cloud	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	Virustotal		Browse
https://www.odwebp.svc.ms	0%	Virustotal		Browse
https://d.docs.live.net	0%	Virustotal		Browse
https://porthopeminorhockey.net:8888/	0%	Avira URL Cloud	safe
https://wus2.contentsync.	0%	Avira URL Cloud	safe
http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/fuiafC2C7q8F	0%	Avira URL Cloud	safe
http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/9VB3908FyOD2	0%	Avira URL Cloud	safe
http://5.181.23.41:80/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/58qi223ZpSVQ	0%	Avira URL Cloud	safe
http://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/on8wielMn1kc	0%	Avira URL Cloud	safe
http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/hqtYy32fyqss	0%	Avira URL Cloud	safe
https://skyapi.live.net/Activity/	0%	Avira URL Cloud	safe
https://api.cortana.ai	0%	Avira URL Cloud	safe
https://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/3rJ5Qf1yDM255	0%	Avira URL Cloud	safe
https://staging.cortana.ai	0%	Avira URL Cloud	safe
https://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/11zKuDybz072	0%	Avira URL Cloud	safe
http://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/Tm1yTI5qHn9u	0%	Avira URL Cloud	safe
https://api.cortana.ai	0%	Virustotal		Browse
http://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/mUmHQ14UO7EV	0%	Avira URL Cloud	safe
https://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/53k4J88xbr2FU	0%	Avira URL Cloud	safe
https://staging.cortana.ai	0%	Virustotal		Browse
http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/58qi223ZpSVQxow/on8wielMn1kciojusjku/	0%	Avira URL Cloud	safe
https://skyapi.live.net/Activity/	0%	Virustotal		Browse
https://wus2.pagecontentsync.	0%	Avira URL Cloud	safe
https://cortana.ai/api	0%	Avira URL Cloud	safe
http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/58qi223ZpSVQ	0%	Avira URL Cloud	safe
http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/58qi223ZpSVQm)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
porthopeminorhockey.net	unknown	unknown	false	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://shell.suite.office.com:1443	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
http://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/J5t395b89D1a	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.google.com/bot.html)tup1H	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392540997.0000000001094000.00000004.00001000.00020000.00000000.sdmp	false		high
https://autodiscover-s.outlook.com/	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://useraudit.o365auditrealtimeingestion.manage.office.com	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
http://porthopeminorhockey.net/kv	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520379241.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.office365.com/connectors	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/vqgiY2Q88BN8	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E48000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E41000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.entity.	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://rpsticket.partnerservices.getmicrosoftkey.com	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/rK9WneycEM3g	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E19000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.aadrm.com/	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.yammer.com	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://api.microsoftstream.com/api/	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://cr.office.com	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/301WkQP1w201	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E12000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E61000.00000004.00001000.00020000.00000000.sdmp, sys-app.log.0.dr	false	Avira URL Cloud: safe	unknown
http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/hqtYy32fyqsscn	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520373337.0000000003E3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://res.getmicrosoftkey.com/api/redemptionevents	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tasks.office.com	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://officeci.azurewebsites.net/api/	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://my.microsoftpersonalcontent.com	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://store.office.cn/addinstemplate	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.google.com/bot.html)	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe	false		high
https://messaging.engagement.office.com/	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
http://5.181.23.41:80/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/1tjs0cRKqy7RW7g	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520379241.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/W26RaOBcdo2D	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E27000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://porthopeminorhockey.net/	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000002.392775999.0000000000E16000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392640890.0000000000E16000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/K5P1f1QLuM3s	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392640890.0000000000E1D000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392540997.00000000010AB000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000002.392848954.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392515127.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000002.00000003.392540997.0000000001010000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.odwebp.svc.ms	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://web.microsoftstream.com/video/	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://api.addins.store.officeppe.com/addinstemplate	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://5.181.23.41:80/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/301WkQP1w201/mUmHQ14UO7EV	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623889122.0000000003E25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://graph.windows.net	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/41xxIG3vApo1	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E51000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E41000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://consent.config.office.com/consentcheckin/v1.0/consents	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://d.docs.live.net	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ncus.contentsync.	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	Avira URL Cloud: safe	unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
http://weather.service.msn.com/data.aspx	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://porthopeminorhockey.net:8888/	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623889122.0000000003E71000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://pushchannel.1drv.ms	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://wus2.contentsync.	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	Avira URL Cloud: safe	unknown
https://clients.config.office.net/user/v1.0/ios	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://api.addins.omex.office.net/api/addins/search	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://clients.config.office.net/user/v1.0/android/policies	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://entitlement.diagnostics.office.com	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
http://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/on8wielMn1kc	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E19000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.office.com/	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/fuiafC2C7q8F	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://substrate.office.com/search/api/v1/SearchHistory	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://clients.config.office.net/c2r/v1.0/InteractiveInstallation	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/9VB3908FyOD2	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://graph.windows.net/	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://devnull.onenote.com	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://messaging.office.com/	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
http://5.181.23.41:80/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/58qi223ZpSVQ	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623889122.0000000003E25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://porthopeminorhockey.net/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/hqtYy32fyqss	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520373337.0000000003E3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://skyapi.live.net/Activity/	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.cortana.ai	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/3rJ5Qf1yDM255	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://messaging.action.office.com/setcampaignaction	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://visio.uservoice.com/forums/368202-visio-on-devices	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://staging.cortana.ai	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/11zKuDybz072	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/embed?	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://augloop.office.com	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
http://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/Tm1yTI5qHn9u	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000003.520379241.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://porthopeminorhockey.net:8888/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/mUmHQ14UO7EV	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://porthopeminorhockey.net:8000/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/53k4J88xbr2FU	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.diagnosticssdf.office.com/v2/file	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://api.diagnostics.office.com	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/58qi223ZpSVQxow/on8wielMn1kciojusjku/	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E77000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.office.de/addinstemplate	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://wus2.pagecontentsync.	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	Avira URL Cloud: safe	unknown
https://api.powerbi.com/v1.0/myorg/datasets	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://cortana.ai/api	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false	Avira URL Cloud: safe	unknown
http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/58qi223ZpSVQ	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623580038.0000000002E2B000.00000004.00001000.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.0000000001317000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623889122.0000000003E71000.00000004.00000020.00020000.00000000.sdmp, Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.00000000012E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/58qi223ZpSVQm)	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe, 00000000.00000002.623457825.000000000128C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.diagnosticssdf.office.com	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://login.microsoftonline.com/	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.181.23.41	unknown	Russian Federation		3214	XTOMxTomEU	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1312819
Start date and time:	2023-09-22 10:27:07 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe
Detection:	MAL
Classification:	mal52.winEXE@4/10@63/2
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 52.109.8.89, 52.111.229.46, 52.111.236.26
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, prod-w.nexus.live.com.akadns.net, config.officeapps.live.com, prod.configsvc1.live.com.akadns.net, us.configsvc1.live.com.akadns.net, tse1.mm.bing.net, nexus.officeapps.live.com, displaycatalog.mp.microsoft.com, g.bing.com, officeclient.microsoft.com, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:28:00	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.lnk
10:27:53	API Interceptor	7x Sleep call for process: Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe modified

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	159267
Entropy (8bit):	5.347972332113859
Encrypted:	false
SSDEEP:	1536:Q+C7FPgf3B7U9guw1JQ9DQA+zQk5k4F77nXmvidlXRAE6LIj6k:NLQ9DQA+zNXHD
MD5:	232DB322BBC6BB920FD82FCB55E2FDEC
SHA1:	F81CBF27F39FC6F3ED39CAC2206C978BA98D9BDC
SHA-256:	3FD5AB0080B041F973D24DA589FEC5C670647035CA25C70425D7B88537F03A44
SHA-512:	1456EFB9F19488308DCA3ACB5DCE8C09B1B17AD1D8B056E4D7320370B3214AAA5872E4EB097F03D9DC9805DCAD61841E7D78C447D5D6FD3BA05AFD4C917CC6B3
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2023-09-22T08:28:01">.. Build: 16.0.16917.30526-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuthorityU

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{02C8616E-F525-4056-8342-235BE3E52ADB}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{37A4F969-8B61-47FA-A83E-07D71AF8AF19}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	8252
Entropy (8bit):	3.646860271760829
Encrypted:	false
SSDEEP:	192:pnnZduPy/TkhqH6h/nt+wY6At1oyXYmy8S6:RZokjIQTImt
MD5:	5A71D5968FA03AA4E5AE2B5DBD649902
SHA1:	B6842A3C7B7054C3F2A409EC02551B07E5BDCE3E
SHA-256:	E1536E0E8191980A27F80C99FC6CB7740ED219E9AA265BEEAB74AC6ABF5599B4
SHA-512:	C5892D15575660B6E543B1FB1D3A5D6C3FDB730C1E34252128BDF8383ED5BE7C1A1387E6C15D3562581A5E5043737851626DE273A2508805770231AA8238495B
Malicious:	false
Reputation:	low
Preview:	..'.D.*.1.'.+. .'.D.A.D.3.7.J.F.J. .......E.'. .G.H. ......... .H.E.'. .#.4.C.'.D.G.....................................................................................................................................................................................................................................................................................................................................................................................................................................................V...X...< .....................................................................................................................................................................................................................................................................................................................................................................................................................................................$..........d....a$.gdMM@......$..

C:\Users\user\AppData\Local\Temp\Palestinian heritage - what it is and what its forms are.docx

Download File

Process:	C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	14659
Entropy (8bit):	7.332340189709377
Encrypted:	false
SSDEEP:	192:CtNX8/66Pxsc6BijVc2CwcnrGInwltOOxtVAVgj1Qn24/bYIL8ZTFNl2aTabul75:aNXgH6Bim2CG2U8OGpn28LaHBmuFdf
MD5:	8E7140E0A6A3957CA921AF6EE09C8662
SHA1:	DC6832179E8FFD68861CD7D7F42C177DD7ADE58A
SHA-256:	9B2A9769CA0FE7A6D18754FAAAD5C0BB794EF1CEA03887C2EE5F79BA72EE6B07
SHA-512:	A5086065706334000464FA4C9EC6F43C8CBC77FFAB031B602E462B7DADD080C9046FDCC18AB40236469A2F730532E059A6050CF084F3EE798214D2500810B4BE
Malicious:	false
Reputation:	low
Preview:	PK..........!...lZ... .......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n.0.E......Ub...>.-R...{.V.......QU...l"%3..3V...l...w%..=...^i7+...-.d.&.0.A.6.l4...L6.0#...S.O.....X.....V$z.3....3.......%p)O....^......5}nH".d.s.Xg.L.`....\|...\|.P.r.s.....?.PW...t.t4Q+..".wa...\|T\y...,N....U.%...-D/......X...(.....<E....)....;.N..L?.F.........<Fk...h..y........q..i..?..l..i..1...].H.g...m.@.....m........PK..........!.........N......._rels/.rels ...(.......................................

C:\Users\user\AppData\Local\Temp\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.lnk

Download File

Process:	C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Archive, ctime=Thu Aug 10 20:05:43 2023, mtime=Fri Sep 22 07:27:53 2023, atime=Fri Sep 22 07:27:52 2023, length=3386880, window=hide
Category:	dropped
Size (bytes):	866
Entropy (8bit):	4.893373053117872
Encrypted:	false
SSDEEP:	24:8TonGk9S6yyAHiEPJrbUsn6pdl/d//3m:8T4Gk9JyRCEPNx6pdlV/v
MD5:	6CBCA8F7994DA830DBE08C61BCF97752
SHA1:	365A63FD36459EFFEB1107F3CB80C1DCC482D10A
SHA-256:	E0D35617AA40FA9B1DF1EDB7FF3BBC212F3A55516BA873570648B4A218A854AA
SHA-512:	357C20A7EF03E32416D9791F9ACA6C243FA4ED4273C2C3426D81FECBD80EBF1477D1B590A58F28506F3BC689D986806DDD0DFAA87A8B086426BFE5BFC2C7197D
Malicious:	false
Reputation:	low
Preview:	L..................F.... .....#m....M........s........3..................... ....P.O. .:i.....+00.:...:..,.LB.)...A&...&......N....-..od.n.....V..........2...3.6W{C .PALEST~1.EXE..........W..6W{C..........................(..P.a.l.e.s.t.i.n.i.a.n._.h.e.r.i.t.a.g.e._.-._.w.h.a.t._.i.t._.i.s._.a.n.d._.w.h.a.t._.i.t.s._.f.o.r.m.s._.a.r.e._.d.o.c.x...e.x.e.......................-...................={.......C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe....W.i.n.d.o.w.s. .m.o.n.R.....\.....\.....\.D.e.s.k.t.o.p.\.P.a.l.e.s.t.i.n.i.a.n._.h.e.r.i.t.a.g.e._.-._.w.h.a.t._.i.t._.i.s._.a.n.d._.w.h.a.t._.i.t.s._.f.o.r.m.s._.a.r.e._.d.o.c.x...e.x.e...-.S.`.......X.......226533...........!a..%.H.VZAj....T.7........-..!a..%.H.VZAj....T.7........-.E.......9...1SPS..mD..pH.H@..=x.....h....H......K*..@.A..7sFJ............

C:\Users\user\AppData\Local\Temp\~$lestinian heritage - what it is and what its forms are.docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4012421995155564
Encrypted:	false
SSDEEP:	3:Rl/ZdSvJ//wli2U6l4G1DMln:RtZgJADLDMln
MD5:	4D7151D654A2217F6E548642D4639205
SHA1:	5E71D74E0752FC8C0A02F4724A37D707BD9768A3
SHA-256:	9FF46FD0F60D8164F78A7CB86317243ED07A6DDD9D3DF7CED6BEB2724387C0BE
SHA-512:	3C2165A1422945ECF6D812381F31293109B25340AD666991D9DA634F49D5B819FDFAF380BA9F35DF88AF50E750BC09FFDF69CE22BC16EB53AFAA8A189126807E
Malicious:	false
Reputation:	low
Preview:	.pratesh................................................p.r.a.t.e.s.h.........q.tW.4.......v...................xW.5........v...................\|W.6..S.t.a.r.t.i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.3503558408390757
Encrypted:	false
SSDEEP:	3:Rl/ZdSvJ//flY2U6l4G1DMln:RtZgJTLDMln
MD5:	B0F07C1D0C5AA64B3D6FE92BEF830235
SHA1:	A4B179C18C494A8E5E523A874FABB59CE51104AA
SHA-256:	546136EC6E6262A1A0908C740D43C0FE1864EC3A601DB64BADABD564C8BFB548
SHA-512:	0F613497F1D2DAA68BC96552E400510AD56A0E173DE2B98C6DB70F7A2EE4C8CAE39355F6C88DD1E9C4D3B990B72B84A110482B71ECFE9F47CF91E6177F072FE5
Malicious:	false
Reputation:	low
Preview:	.pratesh................................................p.r.a.t.e.s.h.........q.tW.4.......v...................xW.5........v...................\|W.6..S.t.a.r.t.i.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.lnk (copy)

Download File

Process:	C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Archive, ctime=Thu Aug 10 20:05:43 2023, mtime=Fri Sep 22 07:27:53 2023, atime=Fri Sep 22 07:27:52 2023, length=3386880, window=hide
Category:	dropped
Size (bytes):	866
Entropy (8bit):	4.893373053117872
Encrypted:	false
SSDEEP:	24:8TonGk9S6yyAHiEPJrbUsn6pdl/d//3m:8T4Gk9JyRCEPNx6pdlV/v
MD5:	6CBCA8F7994DA830DBE08C61BCF97752
SHA1:	365A63FD36459EFFEB1107F3CB80C1DCC482D10A
SHA-256:	E0D35617AA40FA9B1DF1EDB7FF3BBC212F3A55516BA873570648B4A218A854AA
SHA-512:	357C20A7EF03E32416D9791F9ACA6C243FA4ED4273C2C3426D81FECBD80EBF1477D1B590A58F28506F3BC689D986806DDD0DFAA87A8B086426BFE5BFC2C7197D
Malicious:	false
Reputation:	low
Preview:	L..................F.... .....#m....M........s........3..................... ....P.O. .:i.....+00.:...:..,.LB.)...A&...&......N....-..od.n.....V..........2...3.6W{C .PALEST~1.EXE..........W..6W{C..........................(..P.a.l.e.s.t.i.n.i.a.n._.h.e.r.i.t.a.g.e._.-._.w.h.a.t._.i.t._.i.s._.a.n.d._.w.h.a.t._.i.t.s._.f.o.r.m.s._.a.r.e._.d.o.c.x...e.x.e.......................-...................={.......C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe....W.i.n.d.o.w.s. .m.o.n.R.....\.....\.....\.D.e.s.k.t.o.p.\.P.a.l.e.s.t.i.n.i.a.n._.h.e.r.i.t.a.g.e._.-._.w.h.a.t._.i.t._.i.s._.a.n.d._.w.h.a.t._.i.t.s._.f.o.r.m.s._.a.r.e._.d.o.c.x...e.x.e...-.S.`.......X.......226533...........!a..%.H.VZAj....T.7........-..!a..%.H.VZAj....T.7........-.E.......9...1SPS..mD..pH.H@..=x.....h....H......K*..@.A..7sFJ............

C:\Users\user\AppData\Roaming\sys-app.log

Download File

Process:	C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.220309742323223
Encrypted:	false
SSDEEP:	6:CBVID3IUKKPeGjRhKuMmbZAsCpYA6DpvqF+2VID3D:qiEUdh0myTGDpiXin
MD5:	B5659468B016E49B9C0DEDDA28A41C8B
SHA1:	F6D1C1AEF132D7C83881AABC0831BEF0F1C5E722
SHA-256:	8AC91D3DC23A325EA02B788A74AD1ACA3B78029B73BB79366FA4BB1B4EAB7206
SHA-512:	7AD93CF31502031852F047BAB4FE7659E9E1EE0CB3A6A4AF43252BADA513214FDC6D84C159761D6BE3CEA1FA005137F34FF176D0EADF0B20B5A5EFA180F23DF6
Malicious:	false
Reputation:	low
Preview:	http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/vmsevewxow/301WkQP1w201..10:29:58 :=>> excp : 1..10:29:58 :=>> SendHttpPost : Error sending data: (12029) A connection with the server could not be established..10:29:58 :=>> excp : 1 :: GURI : http://5.181.23.41/ddtkdnjhaqvujgv/cvmfiojusjku/..

C:\Users\user\AppData\Roaming\uydyrek5.tmp

Download File

Process:	C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.75
Encrypted:	false
SSDEEP:	3:0wmn:0V
MD5:	3F7424172312F111CCCD651EAFA812A5
SHA1:	B56854576970F9D29C02197BD8B5E39A7BBCEE05
SHA-256:	01254652CFBBF87598014DCA72086CD1B64E55243AC0D12393A9D7D872D0579E
SHA-512:	119F286F1CF13DBCD65C2C017996050D472BD222FBC95AF5FDC39A0E2397E6BE49E155DAE9EDC9377431300060962DD4F0CEC347145D673517DBEC1D90AE948F
Malicious:	false
Reputation:	low
Preview:	XP54X7wp

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.545974264396815
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe
File size:	3'386'880 bytes
MD5:	fc7bfa776d061fc26712f3e7807132ad
SHA1:	19026b6eb5c1c272d33bda3eab8197bec692abab
SHA256:	fa98139b94cc56890af27e6dd02deb4da64b930e801492a966e0f13103808e2f
SHA512:	3dbf0269c571752ab75ee5ac60514f50dafab73e4fd3c235d7510426e816d63547c1ce809e4f7be67fa5024e8854dbdb02ce6d39a3918787029f674fa531116b
SSDEEP:	49152:UKurZ7+Ftn4ii9I0kD3SLpWKWQ2HKJIxnY4QpHDHlyxJ:UK+ZCTJiWXEBJImDHQJ
TLSH:	A1F53A13B2C8E039D05A1A365827FE349B3B6E70E6169C565AFCF8DC4E35E407F26606
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	cfa58cacac848047

Static PE Info

General

Entrypoint:	0x6a5274
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65095A43 [Tue Sep 19 08:22:27 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	dbd547de2ca861789784bbca2921ca2a

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0069A42Ch
call 00007FDDA1116C01h
mov eax, dword ptr [006AF91Ch]
mov eax, dword ptr [eax]
call 00007FDDA12E320Dh
mov eax, dword ptr [006AF91Ch]
mov eax, dword ptr [eax]
xor edx, edx
call 00007FDDA12E51EFh
mov eax, dword ptr [006AF91Ch]
mov eax, dword ptr [eax]
mov byte ptr [eax+6Fh], 00000000h
mov ecx, dword ptr [006AFB78h]
mov eax, dword ptr [006AF91Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [00694FDCh]
call 00007FDDA12E31F4h
mov eax, dword ptr [006AF91Ch]
mov eax, dword ptr [eax]
call 00007FDDA12E3348h
call 00007FDDA110F40Fh
mov eax, eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2bc000	0x78	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b7000	0x3554	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2f9000	0x4e600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2bf000	0x39a74	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2be000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b7938	0x834	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x2bb000	0xec8	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2a1bc0	0x2a1c00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x2a3000	0x22d4	0x2400	False	0.5340711805555556	data	6.252858683951303	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x2a6000	0x9ca8	0x9e00	False	0.5835888053797469	data	6.221351172384387	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x2b0000	0x6e80	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2b7000	0x3554	0x3600	False	0.3305121527777778	data	5.247706761174397	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x2bb000	0xec8	0x1000	False	0.327392578125	data	4.2531431603287615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x2bc000	0x78	0x200	False	0.193359375	data	1.4620698471748432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x2bd000	0x5c	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2be000	0x5d	0x200	False	0.189453125	data	1.38947006462077	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2bf000	0x39a74	0x39c00	False	0.5813590706168831	data	6.727602143280432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x2f9000	0x4e600	0x4e600	False	0.13220506877990432	data	3.924553122227504	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
DOCX	0x2f9c5c	0x3943	Microsoft Word 2007+	English	United States	0.8169042908793233
RT_CURSOR	0x2fd5a0	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x2fd6d4	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x2fd808	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x2fd93c	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x2fda70	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x2fdba4	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x2fdcd8	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_ICON	0x2fde0c	0x3e668	Device independent bitmap graphic, 256 x 484 x 32, image size 247808	English	United States	0.03937525431155905
RT_STRING	0x33c474	0x100	data			0.65234375
RT_STRING	0x33c574	0x2e4	AmigaOS bitmap font "o", fc_YSize 28928, 18432 elements, 2nd "e", 3rd "y"			0.43783783783783786
RT_STRING	0x33c858	0x35c	data			0.4046511627906977
RT_STRING	0x33cbb4	0x38c	data			0.33370044052863435
RT_STRING	0x33cf40	0x324	data			0.4166666666666667
RT_STRING	0x33d264	0x450	data			0.3125
RT_STRING	0x33d6b4	0x424	data			0.3660377358490566
RT_STRING	0x33dad8	0x460	data			0.35892857142857143
RT_STRING	0x33df38	0x300	data			0.3619791666666667
RT_STRING	0x33e238	0x42c	data			0.4044943820224719
RT_STRING	0x33e664	0xd8	data			0.6666666666666666
RT_STRING	0x33e73c	0xd0	data			0.6634615384615384
RT_STRING	0x33e80c	0x310	data			0.44642857142857145
RT_STRING	0x33eb1c	0x3ac	data			0.3840425531914894
RT_STRING	0x33eec8	0x3e0	data			0.3810483870967742
RT_STRING	0x33f2a8	0x498	data			0.37670068027210885
RT_STRING	0x33f740	0x418	data			0.29961832061068705
RT_STRING	0x33fb58	0x294	data			0.3196969696969697
RT_STRING	0x33fdec	0x42c	data			0.42134831460674155
RT_STRING	0x340218	0x4b0	data			0.3491666666666667
RT_STRING	0x3406c8	0x534	data			0.3656156156156156
RT_STRING	0x340bfc	0x380	data			0.38950892857142855
RT_STRING	0x340f7c	0x414	data			0.3505747126436782
RT_STRING	0x341390	0x414	data			0.3850574712643678
RT_STRING	0x3417a4	0x108	data			0.5113636363636364
RT_STRING	0x3418ac	0xcc	data			0.6029411764705882
RT_STRING	0x341978	0x214	data			0.5281954887218046
RT_STRING	0x341b8c	0x40c	data			0.36003861003861004
RT_STRING	0x341f98	0x384	data			0.3688888888888889
RT_STRING	0x34231c	0x318	data			0.3787878787878788
RT_STRING	0x342634	0x300	data			0.3684895833333333
RT_RCDATA	0x342934	0x10	data			1.5
RT_RCDATA	0x342944	0x148b	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0020916524054002
RT_RCDATA	0x343dd0	0x111e	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0025102692834322
RT_RCDATA	0x344ef0	0xd8c	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0031718569780854
RT_RCDATA	0x345c7c	0x960	data			0.5091666666666667
RT_RCDATA	0x3465dc	0x2	data	English	United States	5.0
RT_RCDATA	0x3465e0	0x484	Delphi compiled form 'TForm1'			0.46280276816608995
RT_GROUP_CURSOR	0x346a64	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x346a78	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x346a8c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x346aa0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x346ab4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x346ac8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x346adc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x346af0	0x14	data	English	United States	1.2
RT_VERSION	0x346b04	0x224	data	English	United States	0.4726277372262774
RT_MANIFEST	0x346d28	0x70b	XML 1.0 document, ASCII text, with CRLF, LF line terminators	English	United States	0.403771491957848

Imports

DLL	Import
winspool.drv	DocumentPropertiesW, ClosePrinter, OpenPrinterW, GetDefaultPrinterW, EnumPrintersW
comctl32.dll	ImageList_GetImageInfo, FlatSB_SetScrollInfo, ImageList_DragMove, ImageList_Destroy, _TrackMouseEvent, ImageList_DragShowNolock, ImageList_Add, FlatSB_SetScrollProp, ImageList_GetDragImage, ImageList_Create, ImageList_EndDrag, ImageList_DrawEx, ImageList_SetImageCount, FlatSB_GetScrollPos, FlatSB_SetScrollPos, InitializeFlatSB, ImageList_Copy, FlatSB_GetScrollInfo, ImageList_Write, ImageList_DrawIndirect, ImageList_SetBkColor, ImageList_GetBkColor, ImageList_BeginDrag, ImageList_GetIcon, ImageList_Replace, ImageList_GetImageCount, ImageList_DragEnter, ImageList_GetIconSize, ImageList_SetIconSize, ImageList_Read, ImageList_DragLeave, ImageList_LoadImageW, ImageList_Draw, ImageList_Remove, ImageList_ReplaceIcon, ImageList_SetOverlayImage
shell32.dll	SHGetSpecialFolderLocation, Shell_NotifyIconW, SHAppBarMessage, ShellExecuteW, SHGetPathFromIDListW
user32.dll	CopyImage, CreateWindowExW, GetMenuItemInfoW, SetMenuItemInfoW, DefFrameProcW, GetDCEx, PeekMessageW, MonitorFromWindow, GetDlgCtrlID, GetUpdateRect, SetTimer, WindowFromPoint, BeginPaint, RegisterClipboardFormatW, FrameRect, MapVirtualKeyW, IsWindowUnicode, RegisterWindowMessageW, FillRect, GetMenuStringW, DispatchMessageW, CreateAcceleratorTableW, SendMessageA, DefMDIChildProcW, EnumWindows, GetClassInfoW, ShowOwnedPopups, GetSystemMenu, GetScrollRange, GetScrollPos, SetScrollPos, GetActiveWindow, SetActiveWindow, DrawEdge, GetKeyboardLayoutList, LoadBitmapW, DrawFocusRect, EnumChildWindows, GetScrollBarInfo, ReleaseCapture, UnhookWindowsHookEx, LoadCursorW, GetCapture, SetCapture, CreatePopupMenu, ScrollWindow, ShowCaret, GetMenuItemID, GetLastActivePopup, CharLowerBuffW, GetSystemMetrics, SetWindowLongW, PostMessageW, DrawMenuBar, SetParent, IsZoomed, CharUpperBuffW, GetClientRect, IsChild, ClientToScreen, GetClipboardData, SetClipboardData, SetWindowPlacement, IsIconic, CallNextHookEx, GetMonitorInfoW, ShowWindow, CheckMenuItem, CharUpperW, DefWindowProcW, GetForegroundWindow, SetForegroundWindow, GetWindowTextW, EnableWindow, DestroyWindow, IsDialogMessageW, EndMenu, RegisterClassW, CharNextW, GetWindowThreadProcessId, RedrawWindow, GetDC, GetFocus, SetFocus, EndPaint, ReleaseDC, MsgWaitForMultipleObjectsEx, LoadKeyboardLayoutW, GetClassLongW, ActivateKeyboardLayout, GetParent, DrawTextW, SetScrollRange, MonitorFromRect, InsertMenuItemW, PeekMessageA, GetPropW, SetClassLongW, MessageBoxW, MessageBeep, SetPropW, RemovePropW, UpdateWindow, GetSubMenu, MsgWaitForMultipleObjects, DestroyMenu, DestroyIcon, SetWindowsHookExW, EmptyClipboard, IsWindowVisible, DispatchMessageA, UnregisterClassW, GetTopWindow, SendMessageW, AdjustWindowRectEx, DrawIcon, IsWindow, EnumThreadWindows, InvalidateRect, GetKeyboardState, DrawFrameControl, ScreenToClient, SetCursor, CreateIcon, CreateMenu, LoadStringW, CharLowerW, SetWindowPos, SetWindowRgn, GetMenuItemCount, RemoveMenu, GetSysColorBrush, GetKeyboardLayoutNameW, GetWindowDC, TranslateMessage, OpenClipboard, DrawTextExW, MapWindowPoints, EnumDisplayMonitors, CallWindowProcW, CloseClipboard, DestroyCursor, GetScrollInfo, SetWindowTextW, GetMessageExtraInfo, EnableScrollBar, GetSysColor, TrackPopupMenu, CopyIcon, DrawIconEx, PostQuitMessage, GetClassNameW, ShowScrollBar, EnableMenuItem, GetIconInfo, GetMessagePos, SetScrollInfo, GetKeyNameTextW, GetDesktopWindow, GetCursorPos, SetCursorPos, HideCaret, GetMenu, GetMenuState, SetMenu, SetRect, GetKeyState, FindWindowExW, MonitorFromPoint, ValidateRect, SystemParametersInfoW, LoadIconW, GetCursor, GetWindow, GetWindowLongW, GetWindowRect, InsertMenuW, KillTimer, WaitMessage, IsWindowEnabled, IsDialogMessageA, TranslateMDISysAccel, GetWindowPlacement, CreateIconIndirect, FindWindowW, DeleteMenu, GetKeyboardLayout
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
oleaut32.dll	GetErrorInfo, SysFreeString, VariantClear, VariantInit, SysReAllocStringLen, SafeArrayCreate, SafeArrayGetElement, SysAllocStringLen, SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, VariantCopy, VariantChangeType
advapi32.dll	RegSetValueExW, RegConnectRegistryW, RegEnumKeyExW, RegLoadKeyW, RegDeleteKeyW, RegOpenKeyExW, RegQueryInfoKeyW, RegUnLoadKeyW, RegSaveKeyW, RegDeleteValueW, RegReplaceKeyW, RegFlushKey, RegQueryValueExW, RegEnumValueW, RegCloseKey, RegCreateKeyExW, RegRestoreKeyW
msvcrt.dll	memcpy, memset
winhttp.dll	WinHttpGetIEProxyConfigForCurrentUser, WinHttpSetTimeouts, WinHttpSetStatusCallback, WinHttpConnect, WinHttpReceiveResponse, WinHttpQueryAuthSchemes, WinHttpGetProxyForUrl, WinHttpReadData, WinHttpCloseHandle, WinHttpQueryHeaders, WinHttpOpenRequest, WinHttpAddRequestHeaders, WinHttpOpen, WinHttpWriteData, WinHttpSetCredentials, WinHttpQueryDataAvailable, WinHttpSetOption, WinHttpSendRequest, WinHttpQueryOption
kernel32.dll	GetACP, CloseHandle, LocalFree, GetCurrentProcessId, SizeofResource, TerminateThread, QueryPerformanceFrequency, IsDebuggerPresent, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, EnumSystemLocalesW, GetStdHandle, GetTimeZoneInformation, GetModuleHandleW, FreeLibrary, TryEnterCriticalSection, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, GlobalAlloc, GlobalUnlock, FindResourceW, CreateThread, CompareStringW, CreateMutexW, LoadLibraryA, ResetEvent, MulDiv, FreeResource, GetVersion, RaiseException, MoveFileW, GlobalAddAtomW, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, FileTimeToSystemTime, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, GlobalFindAtomW, VirtualQueryEx, GlobalFree, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GlobalDeleteAtom, GetFileAttributesW, InitializeCriticalSection, GetThreadPriority, GetCurrentProcess, SetThreadPriority, GlobalLock, VirtualAlloc, GetCommandLineW, GetSystemInfo, GetTempPathW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, LCMapStringW, GetDiskFreeSpaceW, VerSetConditionMask, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, EnumResourceNamesW, DeleteFileW, GetEnvironmentVariableW, GetLocalTime, WaitForSingleObject, WriteFile, ExitThread, CreatePipe, DeleteCriticalSection, GetDateFormatW, TlsGetValue, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, RemoveDirectoryW, CreateEventW, WaitForMultipleObjectsEx, SetThreadLocale, GetThreadLocale
ole32.dll	IsEqualGUID, OleInitialize, CreateBindCtx, OleUninitialize, MkParseDisplayName, CoInitialize, CoCreateInstance, CoUninitialize, CoTaskMemFree, CoTaskMemAlloc, StringFromCLSID
gdi32.dll	Pie, SetBkMode, CreateCompatibleBitmap, GetEnhMetaFileHeader, RectVisible, AngleArc, SetAbortProc, SetTextColor, StretchBlt, RoundRect, RestoreDC, SetRectRgn, GetTextMetricsW, GetWindowOrgEx, CreatePalette, PolyBezierTo, CreateICW, CreateDCW, GetStockObject, CreateSolidBrush, Polygon, MoveToEx, PlayEnhMetaFile, Ellipse, StartPage, GetBitmapBits, StartDocW, GetSystemPaletteEntries, GetEnhMetaFileBits, AbortDoc, GetEnhMetaFilePaletteEntries, CreatePenIndirect, CreateFontIndirectW, PolyBezier, EndDoc, GetObjectW, GetWinMetaFileBits, SetROP2, GetEnhMetaFileDescriptionW, ArcTo, Arc, SelectPalette, ExcludeClipRect, MaskBlt, SetWindowOrgEx, EndPage, DeleteEnhMetaFile, Chord, SetDIBits, SetViewportOrgEx, CreateRectRgn, RealizePalette, SetDIBColorTable, GetDIBColorTable, CreateBrushIndirect, PatBlt, SetEnhMetaFileBits, Rectangle, SaveDC, DeleteDC, FrameRgn, BitBlt, GetDeviceCaps, GetTextExtentPoint32W, GetClipBox, IntersectClipRect, Polyline, CreateBitmap, SetWinMetaFileBits, GetStretchBltMode, CreateDIBitmap, SetStretchBltMode, GetDIBits, CreateDIBSection, LineTo, GetRgnBox, EnumFontsW, CreateHalftonePalette, SelectObject, DeleteObject, ExtFloodFill, UnrealizeObject, CopyEnhMetaFileW, SetBkColor, CreateCompatibleDC, GetBrushOrgEx, GetCurrentPositionEx, GetTextExtentPointW, ExtTextOutW, SetBrushOrgEx, GetPixel, GdiFlush, SetPixel, EnumFontFamiliesExW, StretchDIBits, GetPaletteEntries

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x411814
dbkFCallWrapperAddr	1	0x6b3648

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 22, 2023 10:28:00.955481052 CEST	49713	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:01.271430969 CEST	80	49713	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:01.782876968 CEST	49713	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:02.098948956 CEST	80	49713	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:02.611056089 CEST	49713	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:02.927247047 CEST	80	49713	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:02.996390104 CEST	49714	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:03.314438105 CEST	80	49714	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:03.829490900 CEST	49714	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:04.147458076 CEST	80	49714	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:04.657633066 CEST	49714	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:04.975347996 CEST	80	49714	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:05.004091024 CEST	49715	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:05.325956106 CEST	80	49715	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:05.829579115 CEST	49715	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:06.150996923 CEST	80	49715	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:06.657630920 CEST	49715	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:06.979011059 CEST	80	49715	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:06.995033026 CEST	49716	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:07.311507940 CEST	80	49716	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:07.813997030 CEST	49716	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:08.130445957 CEST	80	49716	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:08.642338991 CEST	49716	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:08.958640099 CEST	80	49716	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:08.969575882 CEST	49717	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:09.288085938 CEST	80	49717	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:09.798249006 CEST	49717	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:10.117413998 CEST	80	49717	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:10.626354933 CEST	49717	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:10.945322990 CEST	80	49717	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:12.126554012 CEST	49718	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:12.443851948 CEST	80	49718	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:12.954725981 CEST	49718	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:13.272377014 CEST	80	49718	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:13.782825947 CEST	49718	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:14.100358009 CEST	80	49718	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:14.112404108 CEST	49719	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:14.434108973 CEST	80	49719	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:14.938990116 CEST	49719	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:15.261044979 CEST	80	49719	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:15.767091036 CEST	49719	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:16.088815928 CEST	80	49719	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:16.100759029 CEST	49720	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:16.416583061 CEST	80	49720	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:16.923213005 CEST	49720	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:17.238571882 CEST	80	49720	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:17.751466036 CEST	49720	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:18.067284107 CEST	80	49720	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:18.083340883 CEST	49726	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:18.411741018 CEST	80	49726	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:18.923180103 CEST	49726	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:19.251504898 CEST	80	49726	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:19.766933918 CEST	49726	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:20.095484018 CEST	80	49726	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:20.161246061 CEST	49729	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:20.477139950 CEST	80	49729	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:20.985687971 CEST	49729	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:21.301219940 CEST	80	49729	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:21.813941956 CEST	49729	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:22.129601002 CEST	80	49729	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:23.349634886 CEST	49735	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:23.669229984 CEST	80	49735	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:24.173404932 CEST	49735	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:24.492443085 CEST	80	49735	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:25.001307964 CEST	49735	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:25.320554972 CEST	80	49735	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:25.333332062 CEST	49740	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:25.651995897 CEST	80	49740	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:26.157563925 CEST	49740	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:26.476466894 CEST	80	49740	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:26.985646963 CEST	49740	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:27.304788113 CEST	80	49740	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:29.668523073 CEST	49744	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:29.985243082 CEST	80	49744	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:30.579438925 CEST	49744	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:30.896177053 CEST	80	49744	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:31.407624960 CEST	49744	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:31.724025965 CEST	80	49744	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:31.736933947 CEST	49748	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:32.052644014 CEST	80	49748	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:32.563858032 CEST	49748	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:32.879914999 CEST	80	49748	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:33.391885042 CEST	49748	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:33.707948923 CEST	80	49748	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:33.718972921 CEST	49751	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:34.043637037 CEST	80	49751	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:34.548237085 CEST	49751	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:34.873264074 CEST	80	49751	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:35.376550913 CEST	49751	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:35.701212883 CEST	80	49751	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:36.904798985 CEST	49755	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:37.222039938 CEST	80	49755	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:37.735867977 CEST	49755	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:38.053153992 CEST	80	49755	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:38.563977003 CEST	49755	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:38.881342888 CEST	80	49755	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:38.899813890 CEST	49757	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:39.217768908 CEST	80	49757	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:39.720108986 CEST	49757	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:40.038630009 CEST	80	49757	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:40.548261881 CEST	49757	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:40.866322994 CEST	80	49757	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:40.879796028 CEST	49758	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:41.197264910 CEST	80	49758	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:41.704339027 CEST	49758	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:42.021958113 CEST	80	49758	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:42.532455921 CEST	49758	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:42.850212097 CEST	80	49758	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:42.862763882 CEST	49759	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:43.187479973 CEST	80	49759	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:43.688954115 CEST	49759	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:44.014705896 CEST	80	49759	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:44.516926050 CEST	49759	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:44.841536999 CEST	80	49759	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:44.866944075 CEST	49760	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:45.183753967 CEST	80	49760	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:45.688705921 CEST	49760	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:46.005321026 CEST	80	49760	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:46.516861916 CEST	49760	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:46.833571911 CEST	80	49760	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:49.746318102 CEST	49761	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:50.063241959 CEST	80	49761	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:50.563678026 CEST	49761	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:50.880922079 CEST	80	49761	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:51.392143965 CEST	49761	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:51.709450960 CEST	80	49761	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:51.721574068 CEST	49762	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:52.038439035 CEST	80	49762	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:52.548300982 CEST	49762	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:52.865319967 CEST	80	49762	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:53.376213074 CEST	49762	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:53.693172932 CEST	80	49762	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:53.705538034 CEST	49763	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:54.022463083 CEST	80	49763	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:54.532505989 CEST	49763	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:54.848936081 CEST	80	49763	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:55.360634089 CEST	49763	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:55.677373886 CEST	80	49763	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:55.693197012 CEST	49768	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:56.010152102 CEST	80	49768	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:56.516896009 CEST	49768	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:56.833646059 CEST	80	49768	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:57.345019102 CEST	49768	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:57.662995100 CEST	80	49768	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:57.676582098 CEST	49776	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:58.007263899 CEST	80	49776	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:58.516801119 CEST	49776	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:58.832334042 CEST	80	49776	5.181.23.41	192.168.2.3
Sep 22, 2023 10:28:59.344904900 CEST	49776	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:28:59.660274029 CEST	80	49776	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:00.847197056 CEST	49781	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:01.166481972 CEST	80	49781	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:01.673137903 CEST	49781	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:01.992275953 CEST	80	49781	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:02.501199961 CEST	49781	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:02.819593906 CEST	80	49781	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:02.833295107 CEST	49785	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:03.160708904 CEST	80	49785	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:03.673126936 CEST	49785	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:04.000469923 CEST	80	49785	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:04.501256943 CEST	49785	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:04.828645945 CEST	80	49785	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:07.561238050 CEST	49787	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:07.880043983 CEST	80	49787	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:08.423079014 CEST	49787	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:08.742096901 CEST	80	49787	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:09.251240969 CEST	49787	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:09.569719076 CEST	80	49787	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:09.581167936 CEST	49790	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:09.900284052 CEST	80	49790	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:10.407633066 CEST	49790	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:10.726547003 CEST	80	49790	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:11.235671997 CEST	49790	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:11.554713011 CEST	80	49790	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:11.567120075 CEST	49793	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:11.883949041 CEST	80	49793	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:12.392064095 CEST	49793	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:12.709713936 CEST	80	49793	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:13.219947100 CEST	49793	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:13.537015915 CEST	80	49793	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:14.748981953 CEST	49795	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:15.068901062 CEST	80	49795	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:15.579416037 CEST	49795	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:15.899499893 CEST	80	49795	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:16.407625914 CEST	49795	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:16.727907896 CEST	80	49795	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:16.742146969 CEST	49796	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:17.060353994 CEST	80	49796	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:17.563745975 CEST	49796	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:17.882472992 CEST	80	49796	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:18.392002106 CEST	49796	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:18.710073948 CEST	80	49796	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:18.722480059 CEST	49797	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:19.039995909 CEST	80	49797	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:19.548048973 CEST	49797	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:19.865647078 CEST	80	49797	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:20.376167059 CEST	49797	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:20.693768024 CEST	80	49797	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:20.705717087 CEST	49798	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:21.023650885 CEST	80	49798	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:21.532568932 CEST	49798	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:21.851047993 CEST	80	49798	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:22.360588074 CEST	49798	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:22.678467035 CEST	80	49798	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:22.703422070 CEST	49799	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:23.023730993 CEST	80	49799	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:23.532407999 CEST	49799	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:23.854590893 CEST	80	49799	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:24.360589981 CEST	49799	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:24.681027889 CEST	80	49799	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:25.879996061 CEST	49800	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:26.198914051 CEST	80	49800	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:26.707686901 CEST	49800	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:27.026974916 CEST	80	49800	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:27.528008938 CEST	49800	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:27.846713066 CEST	80	49800	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:27.859400034 CEST	49801	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:28.186588049 CEST	80	49801	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:28.692473888 CEST	49801	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:29.014127016 CEST	80	49801	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:29.525911093 CEST	49801	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:29.847621918 CEST	80	49801	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:29.862757921 CEST	49804	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:30.183535099 CEST	80	49804	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:30.698321104 CEST	49804	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:31.018898964 CEST	80	49804	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:31.531864882 CEST	49804	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:31.852211952 CEST	80	49804	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:31.868477106 CEST	49806	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:32.184348106 CEST	80	49806	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:32.698700905 CEST	49806	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:33.014791965 CEST	80	49806	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:33.526695967 CEST	49806	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:33.842539072 CEST	80	49806	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:33.862257004 CEST	49807	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:34.182821989 CEST	80	49807	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:34.682785988 CEST	49807	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:35.003284931 CEST	80	49807	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:35.511171103 CEST	49807	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:35.832526922 CEST	80	49807	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:37.016486883 CEST	49808	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:37.333885908 CEST	80	49808	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:37.839133024 CEST	49808	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:38.157215118 CEST	80	49808	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:38.667354107 CEST	49808	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:38.984874964 CEST	80	49808	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:41.193826914 CEST	49809	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:41.512011051 CEST	80	49809	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:42.026700974 CEST	49809	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:42.344438076 CEST	80	49809	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:42.854860067 CEST	49809	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:43.172624111 CEST	80	49809	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:43.184789896 CEST	49810	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:43.509406090 CEST	80	49810	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:44.011168003 CEST	49810	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:44.336455107 CEST	80	49810	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:44.839106083 CEST	49810	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:45.163836956 CEST	80	49810	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:45.176939964 CEST	49811	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:45.501743078 CEST	80	49811	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:46.010869980 CEST	49811	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:46.335771084 CEST	80	49811	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:46.839118958 CEST	49811	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:47.164280891 CEST	80	49811	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:47.178805113 CEST	49812	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:47.495964050 CEST	80	49812	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:48.011157990 CEST	49812	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:48.328378916 CEST	80	49812	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:48.839348078 CEST	49812	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:49.156968117 CEST	80	49812	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:50.374114037 CEST	49813	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:50.693058968 CEST	80	49813	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:51.198331118 CEST	49813	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:51.517674923 CEST	80	49813	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:52.026556969 CEST	49813	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:52.345423937 CEST	80	49813	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:52.357544899 CEST	49814	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:52.686073065 CEST	80	49814	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:53.198476076 CEST	49814	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:53.527215004 CEST	80	49814	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:54.042155027 CEST	49814	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:54.370795965 CEST	80	49814	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:54.382066011 CEST	49815	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:54.698267937 CEST	80	49815	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:55.214041948 CEST	49815	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:55.530508041 CEST	80	49815	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:56.042304039 CEST	49815	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:56.358823061 CEST	80	49815	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:56.369760036 CEST	49816	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:56.687645912 CEST	80	49816	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:57.198416948 CEST	49816	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:57.516684055 CEST	80	49816	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:58.026504040 CEST	49816	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:29:58.344688892 CEST	80	49816	5.181.23.41	192.168.2.3
Sep 22, 2023 10:29:59.903189898 CEST	49817	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:30:00.218683958 CEST	80	49817	5.181.23.41	192.168.2.3
Sep 22, 2023 10:30:00.745188951 CEST	49817	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:30:01.059878111 CEST	80	49817	5.181.23.41	192.168.2.3
Sep 22, 2023 10:30:01.573355913 CEST	49817	80	192.168.2.3	5.181.23.41
Sep 22, 2023 10:30:01.888638020 CEST	80	49817	5.181.23.41	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 22, 2023 10:27:59.234483004 CEST	54203	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:27:59.417529106 CEST	53	54203	8.8.8.8	192.168.2.3
Sep 22, 2023 10:27:59.439469099 CEST	50842	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:27:59.623533010 CEST	53	50842	8.8.8.8	192.168.2.3
Sep 22, 2023 10:27:59.639481068 CEST	53210	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:27:59.820930958 CEST	53	53210	8.8.8.8	192.168.2.3
Sep 22, 2023 10:27:59.870263100 CEST	63481	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:00.053227901 CEST	53	63481	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:00.077264071 CEST	51674	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:00.257520914 CEST	53	51674	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:00.274419069 CEST	56452	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:00.454147100 CEST	53	56452	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:00.472389936 CEST	59489	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:00.656805038 CEST	53	59489	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:00.723141909 CEST	51739	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:00.906810999 CEST	53	51739	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:10.958262920 CEST	60000	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:11.139395952 CEST	53	60000	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:11.151423931 CEST	54193	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:11.329277039 CEST	53	54193	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:11.341944933 CEST	62054	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:11.521840096 CEST	53	62054	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:11.537306070 CEST	64088	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:11.718297958 CEST	53	64088	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:11.734111071 CEST	61636	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:11.915086985 CEST	53	61636	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:11.931696892 CEST	59697	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:12.112449884 CEST	53	59697	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:13.910310030 CEST	57045	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:14.090512037 CEST	53	57045	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:22.153441906 CEST	52097	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:22.333997011 CEST	53	52097	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:22.386177063 CEST	61769	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:22.559344053 CEST	53	61769	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:22.580957890 CEST	56944	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:22.761921883 CEST	53	56944	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:22.775247097 CEST	55108	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:22.956250906 CEST	53	55108	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:22.970652103 CEST	62364	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:23.143007040 CEST	53	62364	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:23.156255007 CEST	49809	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:23.337536097 CEST	53	49809	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:35.723706961 CEST	50791	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:35.904490948 CEST	53	50791	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:35.919599056 CEST	54156	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:36.099381924 CEST	53	54156	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:36.114754915 CEST	50959	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:36.295512915 CEST	53	50959	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:36.313400984 CEST	50193	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:36.485990047 CEST	53	50193	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:36.501107931 CEST	60880	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:36.682050943 CEST	53	60880	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:36.708318949 CEST	65220	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:36.888612986 CEST	53	65220	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:48.593972921 CEST	57453	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:48.773909092 CEST	53	57453	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:48.785666943 CEST	65154	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:48.965106964 CEST	53	65154	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:48.979526043 CEST	58750	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:49.157747030 CEST	53	58750	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:49.177599907 CEST	60541	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:49.355212927 CEST	53	60541	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:49.367571115 CEST	61871	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:49.548135996 CEST	53	61871	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:49.560668945 CEST	50546	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:49.733655930 CEST	53	50546	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:59.676429033 CEST	49561	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:28:59.856326103 CEST	53	49561	8.8.8.8	192.168.2.3
Sep 22, 2023 10:28:59.871243000 CEST	64019	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:00.044105053 CEST	53	64019	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:00.056097984 CEST	50442	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:00.235887051 CEST	53	50442	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:00.251476049 CEST	61166	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:00.429507971 CEST	53	61166	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:00.444329977 CEST	61026	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:00.628247976 CEST	53	61026	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:00.641105890 CEST	59084	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:00.821994066 CEST	53	59084	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:13.562383890 CEST	61327	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:13.742130041 CEST	53	61327	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:13.771058083 CEST	55848	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:13.951669931 CEST	53	55848	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:13.965780020 CEST	60456	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:14.144117117 CEST	53	60456	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:14.157965899 CEST	60499	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:14.338748932 CEST	53	60499	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:14.351145983 CEST	62200	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:14.531850100 CEST	53	62200	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:14.548202038 CEST	59789	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:14.728593111 CEST	53	59789	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:24.696610928 CEST	50056	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:24.877944946 CEST	53	50056	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:24.896413088 CEST	57757	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:25.076529980 CEST	53	57757	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:25.109081030 CEST	63462	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:25.281280041 CEST	53	63462	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:25.293530941 CEST	56948	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:25.473171949 CEST	53	56948	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:25.487778902 CEST	57788	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:25.667614937 CEST	53	57788	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:25.684511900 CEST	62086	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:25.864619970 CEST	53	62086	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:35.853425026 CEST	59071	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:36.033894062 CEST	53	59071	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:36.048079014 CEST	59542	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:36.229345083 CEST	53	59542	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:36.243221998 CEST	60898	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:36.423826933 CEST	53	60898	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:36.440380096 CEST	50995	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:36.620393991 CEST	53	50995	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:36.632518053 CEST	59869	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:36.812150002 CEST	53	59869	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:36.825002909 CEST	58723	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:37.004551888 CEST	53	58723	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:49.177848101 CEST	53073	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:49.358016014 CEST	53	53073	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:49.379719019 CEST	51904	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:49.560049057 CEST	53	51904	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:49.580123901 CEST	51580	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:49.761442900 CEST	53	51580	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:49.779927969 CEST	51352	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:49.961309910 CEST	53	51352	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:49.981265068 CEST	63412	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:50.161854029 CEST	53	63412	8.8.8.8	192.168.2.3
Sep 22, 2023 10:29:50.180197001 CEST	50321	53	192.168.2.3	8.8.8.8
Sep 22, 2023 10:29:50.360215902 CEST	53	50321	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 22, 2023 10:27:59.234483004 CEST	192.168.2.3	8.8.8.8	0x95e5	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:27:59.439469099 CEST	192.168.2.3	8.8.8.8	0x9eb5	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:27:59.639481068 CEST	192.168.2.3	8.8.8.8	0x4e7e	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:27:59.870263100 CEST	192.168.2.3	8.8.8.8	0xa7e6	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:00.077264071 CEST	192.168.2.3	8.8.8.8	0xec36	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:00.274419069 CEST	192.168.2.3	8.8.8.8	0x59ee	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:00.472389936 CEST	192.168.2.3	8.8.8.8	0xf9ae	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:00.723141909 CEST	192.168.2.3	8.8.8.8	0xe83b	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:10.958262920 CEST	192.168.2.3	8.8.8.8	0xfa06	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:11.151423931 CEST	192.168.2.3	8.8.8.8	0xb2aa	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:11.341944933 CEST	192.168.2.3	8.8.8.8	0x32c6	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:11.537306070 CEST	192.168.2.3	8.8.8.8	0xe8dd	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:11.734111071 CEST	192.168.2.3	8.8.8.8	0x2dfe	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:11.931696892 CEST	192.168.2.3	8.8.8.8	0xbbb5	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:13.910310030 CEST	192.168.2.3	8.8.8.8	0x4448	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:22.153441906 CEST	192.168.2.3	8.8.8.8	0x76d8	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:22.386177063 CEST	192.168.2.3	8.8.8.8	0x6e90	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:22.580957890 CEST	192.168.2.3	8.8.8.8	0xe830	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:22.775247097 CEST	192.168.2.3	8.8.8.8	0xdded	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:22.970652103 CEST	192.168.2.3	8.8.8.8	0xe5b5	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:23.156255007 CEST	192.168.2.3	8.8.8.8	0x55b0	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:35.723706961 CEST	192.168.2.3	8.8.8.8	0x7bc4	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:35.919599056 CEST	192.168.2.3	8.8.8.8	0x212b	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:36.114754915 CEST	192.168.2.3	8.8.8.8	0x8a4b	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:36.313400984 CEST	192.168.2.3	8.8.8.8	0x5073	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:36.501107931 CEST	192.168.2.3	8.8.8.8	0x5ad9	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:36.708318949 CEST	192.168.2.3	8.8.8.8	0x4f08	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:48.593972921 CEST	192.168.2.3	8.8.8.8	0xe803	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:48.785666943 CEST	192.168.2.3	8.8.8.8	0x890a	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:48.979526043 CEST	192.168.2.3	8.8.8.8	0x8d19	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:49.177599907 CEST	192.168.2.3	8.8.8.8	0x6252	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:49.367571115 CEST	192.168.2.3	8.8.8.8	0xe689	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:49.560668945 CEST	192.168.2.3	8.8.8.8	0xeed0	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:59.676429033 CEST	192.168.2.3	8.8.8.8	0x3a09	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:28:59.871243000 CEST	192.168.2.3	8.8.8.8	0x4eea	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:00.056097984 CEST	192.168.2.3	8.8.8.8	0x4713	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:00.251476049 CEST	192.168.2.3	8.8.8.8	0x7772	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:00.444329977 CEST	192.168.2.3	8.8.8.8	0xafce	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:00.641105890 CEST	192.168.2.3	8.8.8.8	0x5b29	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:13.562383890 CEST	192.168.2.3	8.8.8.8	0xc3c5	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:13.771058083 CEST	192.168.2.3	8.8.8.8	0x824	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:13.965780020 CEST	192.168.2.3	8.8.8.8	0x3a63	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:14.157965899 CEST	192.168.2.3	8.8.8.8	0xe89f	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:14.351145983 CEST	192.168.2.3	8.8.8.8	0x1f8c	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:14.548202038 CEST	192.168.2.3	8.8.8.8	0x7f5b	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:24.696610928 CEST	192.168.2.3	8.8.8.8	0xc120	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:24.896413088 CEST	192.168.2.3	8.8.8.8	0x3ff4	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:25.109081030 CEST	192.168.2.3	8.8.8.8	0xd1f2	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:25.293530941 CEST	192.168.2.3	8.8.8.8	0x7ba0	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:25.487778902 CEST	192.168.2.3	8.8.8.8	0x1d65	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:25.684511900 CEST	192.168.2.3	8.8.8.8	0x4bb7	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:35.853425026 CEST	192.168.2.3	8.8.8.8	0xc4fc	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:36.048079014 CEST	192.168.2.3	8.8.8.8	0x6370	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:36.243221998 CEST	192.168.2.3	8.8.8.8	0xf006	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:36.440380096 CEST	192.168.2.3	8.8.8.8	0xfd94	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:36.632518053 CEST	192.168.2.3	8.8.8.8	0x7de2	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:36.825002909 CEST	192.168.2.3	8.8.8.8	0xe732	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:49.177848101 CEST	192.168.2.3	8.8.8.8	0x43a1	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:49.379719019 CEST	192.168.2.3	8.8.8.8	0x7862	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:49.580123901 CEST	192.168.2.3	8.8.8.8	0x13f3	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:49.779927969 CEST	192.168.2.3	8.8.8.8	0x4569	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:49.981265068 CEST	192.168.2.3	8.8.8.8	0x5cf1	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false
Sep 22, 2023 10:29:50.180197001 CEST	192.168.2.3	8.8.8.8	0x64a4	Standard query (0)	porthopeminorhockey.net	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	10:27:53
Start date:	22/09/2023
Path:	C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe
Imagebase:	0x8e0000
File size:	3'386'880 bytes
MD5 hash:	FC7BFA776D061FC26712F3E7807132AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	10:27:57
Start date:	22/09/2023
Path:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Palestinian heritage - what it is and what its forms are.docx" /o "
Imagebase:	0xe0000
File size:	1'937'688 bytes
MD5 hash:	0B9AB9B9C4DE429473D6450D4297A123
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:28:08
Start date:	22/09/2023
Path:	C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe" -S
Imagebase:	0x8e0000
File size:	3'386'880 bytes
MD5 hash:	FC7BFA776D061FC26712F3E7807132AD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\9CD20AF9-4CB1-4570-BFA5-6295ADC6C6DC

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{02C8616E-F525-4056-8342-235BE3E52ADB}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{37A4F969-8B61-47FA-A83E-07D71AF8AF19}.tmp

C:\Users\user\AppData\Local\Temp\Palestinian heritage - what it is and what its forms are.docx

C:\Users\user\AppData\Local\Temp\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.lnk

C:\Users\user\AppData\Local\Temp\~$lestinian heritage - what it is and what its forms are.docx

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.lnk (copy)

C:\Users\user\AppData\Roaming\sys-app.log

C:\Users\user\AppData\Roaming\uydyrek5.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Windows Analysis Report
Palestinian_heritage_-_what_it_is_and_what_its_forms_are_docx.exe