Edit tour

Windows Analysis Report
msws.msi

Overview

General Information

Sample name:	msws.msi
Analysis ID:	1513255
MD5:	c13c4c025c5c779d5dc8848ef160d5da
SHA1:	d7671d1f301d74aece0db320701395a5cd8cf29a
SHA256:	ba2e21641a1238a5b30e535bd0940fcd316a6e5242bfdd48a97aaa203d11642b
Tags:	libraofficeonline-commsi
Infos:

Detection

ORPCBackdoor

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected ORPCBackdoor

AI detected suspicious sample

Uses dynamic DNS services

Checks for available system drives (often done to infect USB drives)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Potential key logger detected (key state polling based)

Queries information about the installed CPU (vendor, model number etc)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 2936 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\msws.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6976 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6484 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding B12D13CACE43515F68A41F2B0DDB3F8C MD5: 9D09DC1EDA745A5F87553048E57620CF)

expand.exe (PID: 1372 cmdline: "C:\Windows\System32\expand.exe" -R files.cab -F:* files MD5: 544B0DBFF3F393BCE8BB9D815F532D51)

conhost.exe (PID: 5672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSWordServices.exe (PID: 2788 cmdline: "C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe" MD5: FC860959580C124E7E4781BB08437681)

MSWordServices.exe (PID: 1468 cmdline: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe MD5: FC860959580C124E7E4781BB08437681)

WerFault.exe (PID: 6120 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 1008 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
ORPCBackdoor		No Attribution	https://medium.com/@knownsec404team/apt-k-47-mysterious-elephant-a-new-apt-organization-in-south-asia-5c66f954477 https://medium.com/@knownsec404team/apt-k-47-organization-launches-espionage-attacks-using-a-new-trojan-tool-5e7eccfdce2f https://paper.seebug.org/3117/	https://malpedia.caad.fkie.fraunhofer.de/details/win.orpcbackdoor

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.3381013468.0000000000AFD000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_ORPCBackdoor	Yara detected ORPCBackdoor	Joe Security
Process Memory Space: MSWordServices.exe PID: 2788	JoeSecurity_ORPCBackdoor	Yara detected ORPCBackdoor	Joe Security
Process Memory Space: MSWordServices.exe PID: 1468	JoeSecurity_ORPCBackdoor	Yara detected ORPCBackdoor	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: msws.msi

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\Installer\6ef47a.msi	Avira: detection malicious, Label: TR/Agent.ynmzr
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\2e15b4a5edec4957a683758e4becfe67$dpx$.tmp\840ab06c8b2f5b449385041b6c507ff7.tmp	Avira: detection malicious, Label: TR/Agent.athug

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\2e15b4a5edec4957a683758e4becfe67$dpx$.tmp\840ab06c8b2f5b449385041b6c507ff7.tmp	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\OLMAPI32.dll (copy)	ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: msws.msi

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.3% probability

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source:	Binary string: t:\outlook\x86\ship\0\cnfnot32.pdb\ship\0\cnfnot32.exe\bbtopt\cnfnot32O.pdbO source: expand.exe, 00000004.00000003.2151910277.0000000004C27000.00000004.00000020.00020000.00000000.sdmp, 64537d8fc3380a4bb24ba512ffb97757.tmp.4.dr
Source:	Binary string: t:\outlook\x86\ship\0\cnfnot32.pdb source: MSWordServices.exe, MSWordServices.exe, 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, MSWordServices.exe, 00000007.00000000.2183974221.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, 64537d8fc3380a4bb24ba512ffb97757.tmp.4.dr
Source:	Binary string: \ship\0\cnfnot32.exe\bbtopt\cnfnot32O.pdb source: MSWordServices.exe, MSWordServices.exe, 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, MSWordServices.exe, 00000007.00000000.2183974221.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, 64537d8fc3380a4bb24ba512ffb97757.tmp.4.dr
Source:	Binary string: t:\outlook\x86\ship\0\cnfnot32.pdb\ship\0\cnfnot32.exe\bbtopt\cnfnot32O.pdb source: MSWordServices.exe, 00000006.00000000.2159308758.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, MSWordServices.exe, 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, MSWordServices.exe, 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, MSWordServices.exe, 00000007.00000000.2183974221.000000002DE01000.00000020.00000001.01000000.00000005.sdmp
Source:	Binary string: C:\ss2\Projects\MsiWrapper\MsiCustomActions\Release\MsiCustomActions.pdb source: msws.msi, 6ef47a.msi.1.dr, MSIF9BA.tmp.1.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8FA2F4 FindFirstFileExW,		6_2_6C8FA2F4
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8FA2F4 FindFirstFileExW,		7_2_6C8FA2F4

Networking

Uses dynamic DNS services

Source: unknown

DNS query: name: outlook-web.ddns.net

Source: Joe Sandbox View

ASN Name: EDIS-AS-EUAT EDIS-AS-EUAT

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: outlook-web.ddns.net

Source: unknown	Network traffic detected: HTTP traffic on port 57084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52633 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53844
Source: unknown	Network traffic detected: HTTP traffic on port 50873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53841
Source: unknown	Network traffic detected: HTTP traffic on port 62496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53850
Source: unknown	Network traffic detected: HTTP traffic on port 60675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53855
Source: unknown	Network traffic detected: HTTP traffic on port 62868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53852
Source: unknown	Network traffic detected: HTTP traffic on port 53910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53868
Source: unknown	Network traffic detected: HTTP traffic on port 57011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51209
Source: unknown	Network traffic detected: HTTP traffic on port 58348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53865
Source: unknown	Network traffic detected: HTTP traffic on port 54851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51202
Source: unknown	Network traffic detected: HTTP traffic on port 59228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51218
Source: unknown	Network traffic detected: HTTP traffic on port 53922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53871
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51215
Source: unknown	Network traffic detected: HTTP traffic on port 50897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53874
Source: unknown	Network traffic detected: HTTP traffic on port 52212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53880
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53805
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53800
Source: unknown	Network traffic detected: HTTP traffic on port 54838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55299 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53809
Source: unknown	Network traffic detected: HTTP traffic on port 62893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53812
Source: unknown	Network traffic detected: HTTP traffic on port 61976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53811
Source: unknown	Network traffic detected: HTTP traffic on port 61567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53810
Source: unknown	Network traffic detected: HTTP traffic on port 53501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53824
Source: unknown	Network traffic detected: HTTP traffic on port 59649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53823
Source: unknown	Network traffic detected: HTTP traffic on port 51790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53827
Source: unknown	Network traffic detected: HTTP traffic on port 55287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53820
Source: unknown	Network traffic detected: HTTP traffic on port 58312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53835
Source: unknown	Network traffic detected: HTTP traffic on port 54430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53833
Source: unknown	Network traffic detected: HTTP traffic on port 53513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53832
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53830
Source: unknown	Network traffic detected: HTTP traffic on port 59241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51147
Source: unknown	Network traffic detected: HTTP traffic on port 56623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51150
Source: unknown	Network traffic detected: HTTP traffic on port 53598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51158
Source: unknown	Network traffic detected: HTTP traffic on port 54442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51162
Source: unknown	Network traffic detected: HTTP traffic on port 57456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51161
Source: unknown	Network traffic detected: HTTP traffic on port 50812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51165
Source: unknown	Network traffic detected: HTTP traffic on port 60638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51172
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59625 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51175
Source: unknown	Network traffic detected: HTTP traffic on port 53104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51176
Source: unknown	Network traffic detected: HTTP traffic on port 61195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51179
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51183
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51108
Source: unknown	Network traffic detected: HTTP traffic on port 56576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53769
Source: unknown	Network traffic detected: HTTP traffic on port 59601 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53768
Source: unknown	Network traffic detected: HTTP traffic on port 54395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53761
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53760
Source: unknown	Network traffic detected: HTTP traffic on port 57420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53764
Source: unknown	Network traffic detected: HTTP traffic on port 61988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53770
Source: unknown	Network traffic detected: HTTP traffic on port 50848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51119
Source: unknown	Network traffic detected: HTTP traffic on port 56659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53776
Source: unknown	Network traffic detected: HTTP traffic on port 54466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59613 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51114
Source: unknown	Network traffic detected: HTTP traffic on port 53550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53775
Source: unknown	Network traffic detected: HTTP traffic on port 56564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53780
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53782
Source: unknown	Network traffic detected: HTTP traffic on port 57493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53786
Source: unknown	Network traffic detected: HTTP traffic on port 50836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53791
Source: unknown	Network traffic detected: HTTP traffic on port 57432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53790
Source: unknown	Network traffic detected: HTTP traffic on port 54478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51133
Source: unknown	Network traffic detected: HTTP traffic on port 52694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53796
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53797
Source: unknown	Network traffic detected: HTTP traffic on port 60614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51141
Source: unknown	Network traffic detected: HTTP traffic on port 52682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61531 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51189
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51196
Source: unknown	Network traffic detected: HTTP traffic on port 58385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51194
Source: unknown	Network traffic detected: HTTP traffic on port 51741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51198
Source: unknown	Network traffic detected: HTTP traffic on port 53574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56611 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52657 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53907
Source: unknown	Network traffic detected: HTTP traffic on port 50932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53904
Source: unknown	Network traffic detected: HTTP traffic on port 50968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53908
Source: unknown	Network traffic detected: HTTP traffic on port 59757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53918
Source: unknown	Network traffic detected: HTTP traffic on port 61626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53915
Source: unknown	Network traffic detected: HTTP traffic on port 61099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53910
Source: unknown	Network traffic detected: HTTP traffic on port 55635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53919
Source: unknown	Network traffic detected: HTTP traffic on port 56985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51307

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Code function: 6_2_2DE0BB17 GetParent,GetAsyncKeyState,SendMessageA,

6_2_2DE0BB17

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_2DE12F1C GetKeyState,GetKeyState,GetKeyState,GetKeyState,		6_2_2DE12F1C
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_2DE12F1C GetKeyState,GetKeyState,GetKeyState,GetKeyState,		7_2_2DE12F1C

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6ef47a.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{E22E6085-4A70-49E4-B1C5-4305B74C3132}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF9BA.tmp	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_2DE11D25	6_2_2DE11D25
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_2DE0DC78	6_2_2DE0DC78
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8D80D7	6_2_6C8D80D7
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8F5CB2	6_2_6C8F5CB2
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8EBFDC	6_2_6C8EBFDC
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8F8869	6_2_6C8F8869
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8E2AF0	6_2_6C8E2AF0
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8EE7A0	6_2_6C8EE7A0
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8F203C	6_2_6C8F203C
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8FE384	6_2_6C8FE384
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8EC36A	6_2_6C8EC36A
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_2DE11D25	7_2_2DE11D25
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_2DE0DC78	7_2_2DE0DC78
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8F5CB2	7_2_6C8F5CB2
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8EBFDC	7_2_6C8EBFDC
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8F8869	7_2_6C8F8869
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8E2AF0	7_2_6C8E2AF0
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8EE7A0	7_2_6C8EE7A0
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8D80D7	7_2_6C8D80D7
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8F203C	7_2_6C8F203C
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8FE384	7_2_6C8FE384
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8EC36A	7_2_6C8EC36A

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: String function: 2DE13812 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: String function: 6C8EDDA4 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: String function: 6C8F2C29 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: String function: 6C8D4A5D appears 70 times
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: String function: 6C8E2890 appears 114 times
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: String function: 2DE179AF appears 154 times
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: String function: 2DE1793E appears 38 times
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: String function: 2DE179E2 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: String function: 2DE15923 appears 40 times

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 1008

Source: classification engine

Classification label: mal88.troj.evad.winMSI@11/19@3/1

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Code function: 6_2_6C8D7E9F CreateToolhelp32Snapshot,Process32First,CloseHandle,OpenProcess,Process32Next,CloseHandle,

6_2_6C8D7E9F

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Code function: 6_2_6C8DCB90 CoInitializeEx,CoInitializeSecurity,CoUninitialize,GetModuleFileNameW,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,

6_2_6C8DCB90

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Code function: 6_2_2DE15C05 FindResourceA,

6_2_2DE15C05

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5672:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1468

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF5E036ED87243F5CB.TMP

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\msiwrapper.ini

Jump to behavior

Source: C:\Windows\SysWOW64\expand.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: msws.msi

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\msws.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding B12D13CACE43515F68A41F2B0DDB3F8C
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\System32\expand.exe" -R files.cab -F:* files
Source: C:\Windows\SysWOW64\expand.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe "C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 1008
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding B12D13CACE43515F68A41F2B0DDB3F8C	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\System32\expand.exe" -R files.cab -F:* files	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe "C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe"	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: olmapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: olmapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

File written: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\msiwrapper.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source:	Binary string: t:\outlook\x86\ship\0\cnfnot32.pdb\ship\0\cnfnot32.exe\bbtopt\cnfnot32O.pdbO source: expand.exe, 00000004.00000003.2151910277.0000000004C27000.00000004.00000020.00020000.00000000.sdmp, 64537d8fc3380a4bb24ba512ffb97757.tmp.4.dr
Source:	Binary string: t:\outlook\x86\ship\0\cnfnot32.pdb source: MSWordServices.exe, MSWordServices.exe, 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, MSWordServices.exe, 00000007.00000000.2183974221.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, 64537d8fc3380a4bb24ba512ffb97757.tmp.4.dr
Source:	Binary string: \ship\0\cnfnot32.exe\bbtopt\cnfnot32O.pdb source: MSWordServices.exe, MSWordServices.exe, 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, MSWordServices.exe, 00000007.00000000.2183974221.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, 64537d8fc3380a4bb24ba512ffb97757.tmp.4.dr
Source:	Binary string: t:\outlook\x86\ship\0\cnfnot32.pdb\ship\0\cnfnot32.exe\bbtopt\cnfnot32O.pdb source: MSWordServices.exe, 00000006.00000000.2159308758.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, MSWordServices.exe, 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, MSWordServices.exe, 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, MSWordServices.exe, 00000007.00000000.2183974221.000000002DE01000.00000020.00000001.01000000.00000005.sdmp
Source:	Binary string: C:\ss2\Projects\MsiWrapper\MsiCustomActions\Release\MsiCustomActions.pdb source: msws.msi, 6ef47a.msi.1.dr, MSIF9BA.tmp.1.dr

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Code function: 6_2_2DE183CC GetSystemDirectoryW,LoadLibraryExW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,

6_2_2DE183CC

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_2DE17983 push ecx; ret	6_2_2DE17996
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_2DE17A87 push ecx; ret	6_2_2DE17A9A
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8E251B push ecx; ret	6_2_6C8E252E
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_2DE17983 push ecx; ret	7_2_2DE17996
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_2DE17A87 push ecx; ret	7_2_2DE17A9A
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8E251B push ecx; ret	7_2_6C8E252E

Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\2e15b4a5edec4957a683758e4becfe67$dpx$.tmp\840ab06c8b2f5b449385041b6c507ff7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF9BA.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\2e15b4a5edec4957a683758e4becfe67$dpx$.tmp\64537d8fc3380a4bb24ba512ffb97757.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\OLMAPI32.dll (copy)	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\MSIF9BA.tmp

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8DEA93 GetSystemDirectoryW,GetSystemInfo,GetComputerNameW,RegOpenKeyExW,GetVersionExW,GetModuleHandleA,LoadStringW,wsprintfA,wsprintfA,wsprintfA,RegCloseKey,GetPrivateProfileStringW,GetPrivateProfileStringW,GetModuleHandleA,LoadStringW,GetLocaleInfoW,SHLoadIndirectString,SHLoadIndirectString,GetTimeZoneInformation,RegOpenKeyExW,RegEnumKeyExW,RegCloseKey,GlobalMemoryStatus,NetGetJoinInformation,NetApiBufferFree,		6_2_6C8DEA93
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8DEA93 GetSystemDirectoryW,GetSystemInfo,GetComputerNameW,RegOpenKeyExW,GetVersionExW,GetModuleHandleA,LoadStringW,wsprintfA,wsprintfA,wsprintfA,RegCloseKey,GetPrivateProfileStringW,GetPrivateProfileStringW,GetModuleHandleA,LoadStringW,GetLocaleInfoW,SHLoadIndirectString,SHLoadIndirectString,GetTimeZoneInformation,RegOpenKeyExW,RegEnumKeyExW,RegCloseKey,GlobalMemoryStatus,NetGetJoinInformation,NetApiBufferFree,		7_2_6C8DEA93

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_2DE140C6 IsWindowVisible,IsIconic,ShowWindow,	6_2_2DE140C6
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_2DE07BC9 __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z,__EH_prolog3_catch,IsIconic,SetForegroundWindow,LoadMenuW,MultiByteToWideChar,SetWindowLongA,GetFocus,SetFocus,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SetForegroundWindow,PeekMessageA,PeekMessageA,	6_2_2DE07BC9
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_2DE140C6 IsWindowVisible,IsIconic,ShowWindow,	7_2_2DE140C6
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_2DE07BC9 __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z,__EH_prolog3_catch,IsIconic,SetForegroundWindow,LoadMenuW,MultiByteToWideChar,SetWindowLongA,GetFocus,SetFocus,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SetForegroundWindow,PeekMessageA,PeekMessageA,	7_2_2DE07BC9

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Code function: 6_2_6C8DE49B ?GetFileVersionInfoByHandleEx@@YGHXZ,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_6C8DE49B

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosDate	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS name: BIOSVENDOR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_6-42367

Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\2e15b4a5edec4957a683758e4becfe67$dpx$.tmp\840ab06c8b2f5b449385041b6c507ff7.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF9BA.tmp			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	API coverage: 9.1 %
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	API coverage: 7.4 %

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe TID: 2052	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe TID: 2052	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe TID: 3884	Thread sleep time: -180000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8FA2F4 FindFirstFileExW,		6_2_6C8FA2F4
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8FA2F4 FindFirstFileExW,		7_2_6C8FA2F4

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Code function: 6_2_6C8DEA93 GetSystemDirectoryW,GetSystemInfo,GetComputerNameW,RegOpenKeyExW,GetVersionExW,GetModuleHandleA,LoadStringW,wsprintfA,wsprintfA,wsprintfA,RegCloseKey,GetPrivateProfileStringW,GetPrivateProfileStringW,GetModuleHandleA,LoadStringW,GetLocaleInfoW,SHLoadIndirectString,SHLoadIndirectString,GetTimeZoneInformation,RegOpenKeyExW,RegEnumKeyExW,RegCloseKey,GlobalMemoryStatus,NetGetJoinInformation,NetApiBufferFree,

6_2_6C8DEA93

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Thread delayed: delay time: 180000	Jump to behavior

Source: MSWordServices.exe, 00000006.00000002.3381127862.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWN
Source: MSWordServices.exe, 00000006.00000002.3381127862.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Code function: 6_2_2DE17592 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

6_2_2DE17592

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Code function: 6_2_2DE03E45 OutputDebugStringA,GetLastError,

6_2_2DE03E45

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Code function: 6_2_2DE183CC GetSystemDirectoryW,LoadLibraryExW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,

6_2_2DE183CC

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8E6E04 mov ecx, dword ptr fs:[00000030h]	6_2_6C8E6E04
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8F2767 mov eax, dword ptr fs:[00000030h]	6_2_6C8F2767
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8E6E04 mov ecx, dword ptr fs:[00000030h]	7_2_6C8E6E04
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8F2767 mov eax, dword ptr fs:[00000030h]	7_2_6C8F2767

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Code function: 6_2_2DE174DE GetModuleHandleW,GetProcAddress,GetProcessHeap,GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,VirtualProtect,VirtualProtect,VirtualProtect,

6_2_2DE174DE

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_2DE17592 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	6_2_2DE17592
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_2DE17EC9 SetUnhandledExceptionFilter,	6_2_2DE17EC9
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8E1C41 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_6C8E1C41
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8E270B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_6C8E270B
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8E6733 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_6C8E6733
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_2DE17592 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	7_2_2DE17592
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_2DE17EC9 SetUnhandledExceptionFilter,	7_2_2DE17EC9
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8E1C41 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_6C8E1C41
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8E270B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_6C8E270B
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8E6733 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_6C8E6733

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\System32\expand.exe" -R files.cab -F:* files			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe "C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Code function: 6_2_6C8E28D5 cpuid

6_2_6C8E28D5

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetSystemDirectoryW,GetSystemInfo,GetComputerNameW,RegOpenKeyExW,GetVersionExW,GetModuleHandleA,LoadStringW,wsprintfA,wsprintfA,wsprintfA,RegCloseKey,GetPrivateProfileStringW,GetPrivateProfileStringW,GetModuleHandleA,LoadStringW,GetLocaleInfoW,SHLoadIndirectString,SHLoadIndirectString,GetTimeZoneInformation,RegOpenKeyExW,RegEnumKeyExW,RegCloseKey,GlobalMemoryStatus,NetGetJoinInformation,NetApiBufferFree,	6_2_6C8DEA93
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetLocaleInfoW,	6_2_6C8F2EBB
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	6_2_6C8FCF41
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_6C8FD8A5
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: EnumSystemLocalesW,	6_2_6C8F2995
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetLocaleInfoW,	6_2_6C8FD5A7
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_6C8FD6D0
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetLocaleInfoW,	6_2_6C8FD7D6
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: EnumSystemLocalesW,	6_2_6C8FD1E3
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetLocaleInfoW,	6_2_6C8FD13C
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: EnumSystemLocalesW,	6_2_6C8FD2C9
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: EnumSystemLocalesW,	6_2_6C8FD22E
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_6C8FD354
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetSystemDirectoryW,GetSystemInfo,GetComputerNameW,RegOpenKeyExW,GetVersionExW,GetModuleHandleA,LoadStringW,wsprintfA,wsprintfA,wsprintfA,RegCloseKey,GetPrivateProfileStringW,GetPrivateProfileStringW,GetModuleHandleA,LoadStringW,GetLocaleInfoW,SHLoadIndirectString,SHLoadIndirectString,GetTimeZoneInformation,RegOpenKeyExW,RegEnumKeyExW,RegCloseKey,GlobalMemoryStatus,NetGetJoinInformation,NetApiBufferFree,	7_2_6C8DEA93
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetLocaleInfoW,	7_2_6C8F2EBB
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	7_2_6C8FCF41
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	7_2_6C8FD8A5
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: EnumSystemLocalesW,	7_2_6C8F2995
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetLocaleInfoW,	7_2_6C8FD5A7
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_6C8FD6D0
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetLocaleInfoW,	7_2_6C8FD7D6
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: EnumSystemLocalesW,	7_2_6C8FD1E3
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetLocaleInfoW,	7_2_6C8FD13C
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: EnumSystemLocalesW,	7_2_6C8FD2C9
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: EnumSystemLocalesW,	7_2_6C8FD22E
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	7_2_6C8FD354

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

6_2_2DE174DE

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Code function: 6_2_6C8D4F22 Sleep,GetModuleFileNameA,CreateFileA,CloseHandle,Sleep,CreateFileA,CloseHandle,CloseHandle,GetUserNameA,Sleep,CreateFileA,ReadFile,CloseHandle,Sleep,CreateFileA,RpcStringBindingComposeA,RpcBindingFromStringBindingA,_strcat,CreateFileA,WriteFile,CloseHandle,_strcat,_strcat,_strcat,_strncpy,_strcat,_strcat,_strcat,_strcat,_strcat,PathFileExistsA,DeleteFileA,CreateFileA,WriteFile,CloseHandle,PathFileExistsA,_strcat,WinExec,_strcat,_strcat,WinExec,Sleep,_strcat,_strcat,_strncpy,Sleep,Sleep,RpcStringFreeA,

6_2_6C8D4F22

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

6_2_6C8DEA93

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Code function: 6_2_2DE15E3D GetVersionExA,

6_2_2DE15E3D

Source: C:\Windows\SysWOW64\expand.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected ORPCBackdoor

Source: Yara match	File source: 00000006.00000002.3381013468.0000000000AFD000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSWordServices.exe PID: 2788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSWordServices.exe PID: 1468, type: MEMORYSTR

Remote Access Functionality

Yara detected ORPCBackdoor

Source: Yara match	File source: 00000006.00000002.3381013468.0000000000AFD000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSWordServices.exe PID: 2788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSWordServices.exe PID: 1468, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 6_2_6C8D4F22 Sleep,GetModuleFileNameA,CreateFileA,CloseHandle,Sleep,CreateFileA,CloseHandle,CloseHandle,GetUserNameA,Sleep,CreateFileA,ReadFile,CloseHandle,Sleep,CreateFileA,RpcStringBindingComposeA,RpcBindingFromStringBindingA,_strcat,CreateFileA,WriteFile,CloseHandle,_strcat,_strcat,_strcat,_strncpy,_strcat,_strcat,_strcat,_strcat,_strcat,PathFileExistsA,DeleteFileA,CreateFileA,WriteFile,CloseHandle,PathFileExistsA,_strcat,WinExec,_strcat,_strcat,WinExec,Sleep,_strcat,_strcat,_strncpy,Sleep,Sleep,RpcStringFreeA,		6_2_6C8D4F22
Source: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe	Code function: 7_2_6C8D4F22 Sleep,GetModuleFileNameA,CreateFileA,CloseHandle,Sleep,CreateFileA,CloseHandle,CloseHandle,GetUserNameA,Sleep,CreateFileA,ReadFile,CloseHandle,Sleep,CreateFileA,RpcStringBindingComposeA,RpcBindingFromStringBindingA,_strcat,CreateFileA,WriteFile,CloseHandle,_strcat,_strcat,_strcat,_strncpy,_strcat,_strcat,_strcat,_strcat,_strcat,PathFileExistsA,DeleteFileA,CreateFileA,WriteFile,CloseHandle,PathFileExistsA,_strcat,WinExec,_strcat,_strcat,WinExec,Sleep,_strcat,_strcat,_strncpy,Sleep,Sleep,RpcStringFreeA,		7_2_6C8D4F22

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	2 Masquerading	21 Input Capture	2 System Time Discovery	Remote Services	21 Input Capture	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Scheduled Task/Job	41 Virtualization/Sandbox Evasion	LSASS Memory	151 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 Peripheral Device Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Account Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	3 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	3 File and Directory Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	66 System Information Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
msws.msi	61%	ReversingLabs	Win32.Backdoor.Orpcbackdoor
msws.msi	100%	Avira	TR/Agent.ynmzr

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\Installer\6ef47a.msi	100%	Avira	TR/Agent.ynmzr
C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\2e15b4a5edec4957a683758e4becfe67$dpx$.tmp\840ab06c8b2f5b449385041b6c507ff7.tmp	100%	Avira	TR/Agent.athug
C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\2e15b4a5edec4957a683758e4becfe67$dpx$.tmp\64537d8fc3380a4bb24ba512ffb97757.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\2e15b4a5edec4957a683758e4becfe67$dpx$.tmp\840ab06c8b2f5b449385041b6c507ff7.tmp	75%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\OLMAPI32.dll (copy)	75%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\Installer\MSIF9BA.tmp	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
outlook-web.ddns.net	151.236.9.174	true	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
151.236.9.174	outlook-web.ddns.net	European Union		57169	EDIS-AS-EUAT	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1513255
Start date and time:	2024-09-18 17:22:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	msws.msi
Detection:	MAL
Classification:	mal88.troj.evad.winMSI@11/19@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 93 Number of non-executed functions: 249
Cookbook Comments:	Found application associated with file extension: .msi Close Viewer

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: msws.msi

Simulations

Behavior and APIs

Time	Type	Description
11:23:00	API Interceptor	3x Sleep call for process: MSWordServices.exe modified
11:23:06	API Interceptor	1x Sleep call for process: WerFault.exe modified
17:23:01	Task Scheduler	Run new task: Microsoft Update path: C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EDIS-AS-EUAT	Mcb5K3TOWT.exe	Get hash	malicious	Unknown	Browse	192.36.38.33
	987123.exe	Get hash	malicious	LummaC, Eternity Stealer, LummaC Stealer, SmokeLoader, Stealc, zgRAT	Browse	192.36.38.33
	16GAuqLUFK.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Stealc	Browse	192.36.38.33
	NBHEkIKDCr.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	192.36.38.33
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	192.36.38.33
	XqmbvBWVRN.elf	Get hash	malicious	Mirai	Browse	37.235.56.176
	Q9WWwskOzG.elf	Get hash	malicious	Mirai	Browse	151.236.13.222
	Document_Scan_482.js	Get hash	malicious	IcedID	Browse	151.236.9.176
	qwb3x7yFdW.elf	Get hash	malicious	Mirai	Browse	151.236.13.224

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\2e15b4a5edec4957a683758e4becfe67$dpx$.tmp\64537d8fc3380a4bb24ba512ffb97757.tmp	msas.msi	Get hash	malicious	ORPCBackdoor	Browse
	MicrosoftEdge.msi	Get hash	malicious	ORPCBackdoor	Browse
	MicrosoftEdge.msi	Get hash	malicious	ORPCBackdoor	Browse
C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe (copy)	msas.msi	Get hash	malicious	ORPCBackdoor	Browse
	MicrosoftEdge.msi	Get hash	malicious	ORPCBackdoor	Browse
	MicrosoftEdge.msi	Get hash	malicious	ORPCBackdoor	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSWordServices.e_1aa99ae589ec8d5fef1ee322d61b9f8c687c47cd_1ac15c9b_0eee42af-d448-4f6b-ba43-425a8d78e38b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.871170992330415
Encrypted:	false
SSDEEP:	96:z1FjzepZ/GFKsD4LzxTMbhdQXIDcQvc6QcEVcw3cE/P+HbHggggS/Yy2rLoDIhLm:5k/GFKnB0BU/IjGT1zuiFJZ24IO8j
MD5:	A1C2B62F3E8E8E0A9D54CB19CC2D85B8
SHA1:	4BB7F8F5D0BC7ED438D8BD209046EF1D9C39450F
SHA-256:	3DF3C25C1F096729013C9E0F352DD1971FFEDF44E4D42FA5ECC2001918E2BA1B
SHA-512:	B2E4C0F09C6B5B5FE3296130B48D56271DB8E346BB54D4B575E4DFF76E50FDB6CCDD0263340D68327EFAF0E9B453D00E4C8D708D97E061A60B0791A8869CC2C9
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.1.4.6.5.8.3.6.6.5.6.7.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.1.4.6.5.8.4.2.1.2.5.6.8.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.e.e.e.4.2.a.f.-.d.4.4.8.-.4.f.6.b.-.b.a.4.3.-.4.2.5.a.8.d.7.8.e.3.8.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.d.d.d.c.e.6.0.-.7.c.2.d.-.4.c.6.2.-.a.e.5.8.-.c.9.c.c.2.a.3.f.1.1.b.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.W.o.r.d.S.e.r.v.i.c.e.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.b.c.-.0.0.0.1.-.0.0.1.5.-.9.3.7.4.-.8.0.a.6.d.e.0.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.f.e.5.6.e.4.c.a.3.1.b.c.f.0.5.3.5.6.0.a.6.c.a.e.1.c.7.8.d.3.0.0.0.0.0.0.0.0.0.!.0.0.0.0.b.5.5.1.d.d.8.8.a.1.d.3.d.5.f.2.7.7.d.c.1.7.4.f.5.d.9.d.1.1.e.e.e.a.0.d.a.f.b.0.!.M.S.W.o.r.d.S.e.r.v.i.c.e.s...e.x.e.....T.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1243.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Sep 18 15:23:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	54108
Entropy (8bit):	2.2079851219657294
Encrypted:	false
SSDEEP:	384:wL87fYpwV5aQMhXto50wrOx1tPr0NztDXrVHsLY+OY6GKlFYt4yoicyVlkcyH1tI:N8p+BJUvBuRg
MD5:	73C9BA6D6276492CA83E4662E36217ED
SHA1:	36EF26E59D27F9E5F64049161383AA1C17E2D604
SHA-256:	1416C548C8466AD7FFC65800AB81045FF4D134D4E232D1750F348DE3E7BD4B3C
SHA-512:	FCBB1E75AAF3D6E73F841ECEEA9FDB81020F3851440C5AF3FE4DB153BBEC7D1F0B5E4922E7446BC58C177AD661EF820BA845E034169E979ECCB4DCFD49167E98
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......W..f........................................p%..........T.......8...........T............'..t...........H...........4...............................................................................eJ..............GenuineIntel............T...........U..f............................. ..9...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1310.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6344
Entropy (8bit):	3.7183161449278255
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetb0n6lU0Y14xYQE/HXY5aM4U589b0JOsfWjapm:R6l7wVeJ0n6lU0Y14q4pr589bwOsfiwm
MD5:	00A3E3DF7A49C8AFF3564966B0C1C824
SHA1:	DD762C9813FD82F4CF419FD836562116671EA73E
SHA-256:	5E7546C586DA112CD3226A74D4B131D8FD51CC35A023E96F49A5D3B66650590B
SHA-512:	E804342433984F7D066A489E78DC555DBA2C0A4C8460D7431D99647B81867C08916FA32654EC3367A41C772E2EFA553650B7B8250C8C8BD21F87F09E244450EF
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.4.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER135F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4633
Entropy (8bit):	4.483739865115084
Encrypted:	false
SSDEEP:	48:cvIwWl8zs2CJg77aI9/0WpW8VYjTYm8M4JnlFID+q8TDwq4lSnd:uIjfRI7Ft7VTJERqGSnd
MD5:	17C1D5F01CC923AB8FAC9ABB7560BAA5
SHA1:	3C0A49DC47E71CA45BC0A1FC55E26F6AA8AACF62
SHA-256:	070F50230F9454F5E8CAA9FFEFE6B3EE18A877DF5522BCF9A825678C1FE2939C
SHA-512:	FE696DB5413E8930E4731C8D40F6109EEEDAE9E9D26BDAA37173D86FF356ADB2E4459BA5E71F2D262BE538DC70CF1849E28FCCB989861A7893F6824C4D997CFD
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="505825" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files.cab

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Microsoft Cabinet archive data, many, 194154 bytes, 2 files, at 0x2c +A "MSWordServices.exe" +A "OLMAPI32.dll", ID 7700, number 1, 14 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	194154
Entropy (8bit):	7.9987179030742475
Encrypted:	true
SSDEEP:	3072:9OT4+QMIx6GSEOOoTItH4chXeKlpV8WhNyfNdulMVpHfIr+ByHoaP:4E+QVAnjOl4ieipV8VTGipHfS+pM
MD5:	FD02CF1E9CDF834EFAA46940C585BE24
SHA1:	6D6EDBD6ACC904A57F19B366554938ECB0081FA0
SHA-256:	5BC187D2BD7F4287D4CA56988E36B4A520A038EC8AC4BD4DC84710535ADC5A5B
SHA-512:	F952B958ECFD220070F000437AD9553F6647EFAA606E3D84DC65DFBDF03F355B27B24A0B4CAA95A9271E02513D84D363253730717249C03BC9ADC4B4DBB2A8C9
Malicious:	false
Preview:	MSCF....j.......,...................l.......`O........v<.. .MSWordServices.exe..\..`O....YW.. .OLMAPI32.dll..S...=..[.....@..."R`4..n....mnuU..t......V=5....j..ykj..4m.u..@..#\|......#F.NkR....a ; .=..\.`\..Fd..........N..!...}^..yD...y.w.L......m.B6d.6-.Fm..>.QO...C6...+6.M......>.......f6)fQ..).P.&)Y[m+s..........3.T4.Ene....9.\|....&.E..N.Mb..@.c.H._..@.~.u.V."...<Wh4.55.AP..n.-R.O...ow.-.....;.=e.6.Ntm..Mn..]...7M..i.).i.e.5....=.]".!........vd2...BE...A....n...g.}.....g...v......[S6.)....M.J.I..8.S:.4E...."j.D..6.r..$.......m B....c9...A...]a..E.r..#......dt5L=...U....A...3.....g..@mq2..EmQ...fTI.G...wv.]....:c..Q.E7.Q....".L..fpi.k2..>.O.i....m...e.q...%}.j;....#...{..H.S...f...Z.5k..e..s....Xc....+.i.Q..... 0..nA....\..[..A.\.,..`......,...`t.........p8.\|.1.....&.\.r....(....+..`..p......d.....i.'..\|..Z.....x.8>.......^(..sOPJ.T....7.W.....&..0v ..K.1..T`Z...x...`.@9 s..K........Q.R.\..8.Y.....%.4.k..@;......W....8./p........U.....A..?.8z.{.Y0.A.A..we

C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\2e15b4a5edec4957a683758e4becfe67$dpx$.tmp\64537d8fc3380a4bb24ba512ffb97757.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	151392
Entropy (8bit):	6.138300167598228
Encrypted:	false
SSDEEP:	3072:OdYA7fiLrQoAurtzKmJCtnsk7IIesI0xv9wsOJ6iiEQd86953:KYK9uJKmJCp8sIc3OJX2v1
MD5:	FC860959580C124E7E4781BB08437681
SHA1:	B551DD88A1D3D5F277DC174F5D9D11EEEA0DAFB0
SHA-256:	ECA127142A480FE51E7748159C8D219313A4730D60DC22C4DBBC1BD4D6A67B66
SHA-512:	ABAB3D964D5E7B1BDF365A429CBC5B48614F4FB64281D5C0A4B0CE0AB3580FA539CA0F33BC4243DBBE5C6649FA0CE1A2A89DE12725A78971001CD768AEB075D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: msas.msi, Detection: malicious, Browse Filename: MicrosoftEdge.msi, Detection: malicious, Browse Filename: MicrosoftEdge.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,V..h7.[h7.[h7.[veV[i7.[...[i7.[...[i7.[O.[f7.[aOA[k7.[h7.[f5.[.xD[i7.[aOG[`7.[aOQ[v7.[aOF[i7.[aOV[.7.[aO@[i7.[aOC[i7.[Richh7.[................PE..L....@.K.....................v.......x.......................................`.......k....@.............................W............0..t............8..`....@..x...8...8............................5..@...................t...`....................text............................... ..`.data....L.......H..................@....rsrc...t....0......................@..@.reloc..x....@......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\2e15b4a5edec4957a683758e4becfe67$dpx$.tmp\840ab06c8b2f5b449385041b6c507ff7.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	285696
Entropy (8bit):	6.56814625756245
Encrypted:	false
SSDEEP:	3072:hbp5Y0UEmuigQJch1NUZIeKFEW/HXGdSz6ednKUp4s9tlZR0ysKNCcSfxaTAhY5u:hbri1yl/H9dnK44s9LZREKzDAOTGl
MD5:	C846EA473366F6022FF676CDFF20A3FB
SHA1:	4D95AA531CC74C0C5B327B0D9BA66BB381409C26
SHA-256:	74BA5883D989566A94E7C6C217B17102F054FFBE98BC9C878A7F700F9809E910
SHA-512:	61DD4C79FFE82A017F328A8410639CF21B4A5A8BB94716815DAAF490DF7B967353D011842B157B24BB5C19A14DA1BA768BFD0D9A96A52A80DF9731F63A6DDE95
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......]"2n.C\=.C\=.C\=.1_<.C\=.1Y<.C\=.1X<.C\=.4X<.C\=.4_<.C\=.1Z<.C\=.4Y<SC\=.1]<.C\=.C]=.C\=.4Y<.C\=.4X<.C\=.4\<.C\=.4.=.C\=.C.=.C\=.4^<.C\=Rich.C\=........................PE..L...eG.b...........!.....(...........!.......@............................................@..........................&.......(...................................!..l...................................@............@...............................text....&.......(.................. ..`.rdata..d....@.......,..............@..@.data........@......."..............@....rsrc................4..............@..@.reloc...!......."...:..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	151392
Entropy (8bit):	6.138300167598228
Encrypted:	false
SSDEEP:	3072:OdYA7fiLrQoAurtzKmJCtnsk7IIesI0xv9wsOJ6iiEQd86953:KYK9uJKmJCp8sIc3OJX2v1
MD5:	FC860959580C124E7E4781BB08437681
SHA1:	B551DD88A1D3D5F277DC174F5D9D11EEEA0DAFB0
SHA-256:	ECA127142A480FE51E7748159C8D219313A4730D60DC22C4DBBC1BD4D6A67B66
SHA-512:	ABAB3D964D5E7B1BDF365A429CBC5B48614F4FB64281D5C0A4B0CE0AB3580FA539CA0F33BC4243DBBE5C6649FA0CE1A2A89DE12725A78971001CD768AEB075D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: msas.msi, Detection: malicious, Browse Filename: MicrosoftEdge.msi, Detection: malicious, Browse Filename: MicrosoftEdge.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,V..h7.[h7.[h7.[veV[i7.[...[i7.[...[i7.[O.[f7.[aOA[k7.[h7.[f5.[.xD[i7.[aOG[`7.[aOQ[v7.[aOF[i7.[aOV[.7.[aO@[i7.[aOC[i7.[Richh7.[................PE..L....@.K.....................v.......x.......................................`.......k....@.............................W............0..t............8..`....@..x...8...8............................5..@...................t...`....................text............................... ..`.data....L.......H..................@....rsrc...t....0......................@..@.reloc..x....@......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\OLMAPI32.dll (copy)

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	285696
Entropy (8bit):	6.56814625756245
Encrypted:	false
SSDEEP:	3072:hbp5Y0UEmuigQJch1NUZIeKFEW/HXGdSz6ednKUp4s9tlZR0ysKNCcSfxaTAhY5u:hbri1yl/H9dnK44s9LZREKzDAOTGl
MD5:	C846EA473366F6022FF676CDFF20A3FB
SHA1:	4D95AA531CC74C0C5B327B0D9BA66BB381409C26
SHA-256:	74BA5883D989566A94E7C6C217B17102F054FFBE98BC9C878A7F700F9809E910
SHA-512:	61DD4C79FFE82A017F328A8410639CF21B4A5A8BB94716815DAAF490DF7B967353D011842B157B24BB5C19A14DA1BA768BFD0D9A96A52A80DF9731F63A6DDE95
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......]"2n.C\=.C\=.C\=.1_<.C\=.1Y<.C\=.1X<.C\=.4X<.C\=.4_<.C\=.1Z<.C\=.4Y<SC\=.1]<.C\=.C]=.C\=.4Y<.C\=.4X<.C\=.4\<.C\=.4.=.C\=.C.=.C\=.4^<.C\=Rich.C\=........................PE..L...eG.b...........!.....(...........!.......@............................................@..........................&.......(...................................!..l...................................@............@...............................text....&.......(.................. ..`.rdata..d....@.......,..............@..@.data........@......."..............@....rsrc................4..............@..@.reloc...!......."...:..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\msiwrapper.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	509
Entropy (8bit):	5.297373338785725
Encrypted:	false
SSDEEP:	12:bsP6MFMws5EMzbaVRm+PO0++6hzaaVRmIJeIh4:gP6Fws5NbaTWbheafeF
MD5:	62B76E0E318FD643411DC36A719C9F1F
SHA1:	B146B70A062CFD55E15E6D2B65CD800853369AF6
SHA-256:	DCAFF080951DFDBDB848CD6CA519977F0E9187E7F7514840FA48F6214BD669DD
SHA-512:	091E347BEC2E3E246FC25FAB5F6ABA2858CE69F640D51DD1DE07DB3E8AD7303FBD24DEF23FCBC85511B305AA72411EC7257695C6C1783D75B558CEFD3DF4C0F3
Malicious:	false
Preview:	[MSI Wrapper]..WrappedApplicationId={90140000-001B-0409-0000-0000000FF1CE}..InstallSuccessCodes=0..ElevationMode=never..SetupFileName=C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe..SetupParameters=..WorkingDir=..CurrentDir=FILESDIR..UILevel=5..Focus=yes..FilesDir=C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\..RunBeforeInstallFile=..RunBeforeInstallParameters=..RunAfterInstallFile=..RunAfterInstallParameters=..

C:\Windows\Installer\6ef47a.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Microsoft Outlook - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com 14.0.4760.1000, Subject: Microsoft Outlook - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com, Author: Microsoft Corporation, Keywords: Installer, Template: Intel;1033, Revision Number: {6FB667ED-1310-4415-BE99-B57534C2CC51}, Create Time/Date: Fri Jan 3 19:06:10 2020, Last Saved Time/Date: Fri Jan 3 19:06:10 2020, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (9.0.34.0), Security: 2
Category:	dropped
Size (bytes):	368640
Entropy (8bit):	7.333172745854614
Encrypted:	false
SSDEEP:	6144:jJdjoxrGSPVWGQw/+QVAnjOl4ieipV8VTGipHfS+p:jvjoxrGS90v48yee8V5HfRp
MD5:	C13C4C025C5C779D5DC8848EF160D5DA
SHA1:	D7671D1F301D74AECE0DB320701395A5CD8CF29A
SHA-256:	BA2E21641A1238A5B30E535BD0940FCD316A6E5242BFDD48A97AAA203D11642B
SHA-512:	A0459C7732733A9D83D6E1B985CB9A913AB5FE9E30114AA1DD5B198002F36CE84A0E0E318FC60E9FDBD22DAB29734AAFDC50322FFFECA50211D64B206D9ADEE3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF9BA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	131584
Entropy (8bit):	6.342148943947129
Encrypted:	false
SSDEEP:	1536:5w0vysoljaMn5znCmFSasPcgsQdYVD9p/KFXS5sqR86P2HJxSz8d3G800kDCfTOC:almeJd9p8txrJES8CV+gYU+pI5jMh
MD5:	CA93487A24A49E7C0242E4C8F4CA01F5
SHA1:	17280B78BFE8C89CB719C2353FADC68D07A2C883
SHA-256:	7D9D48F563BD966C0CF17DD56A92C1C29506F25F10DB655576E2800FB2E7D50D
SHA-512:	D3E3169F212F61B9D2C0ABF608FB1F8E719B4E905DDF4A11AEDC7D98D9F5E1532893859D13F2AF8590A14277760ACD8E81FBB9213DBE84A55E97FCA329B10C7D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q5..5T..5T..5T..<,V..T..<,G.$T..<,Q.JT......:T..5T..T..<,X.6T..<,@.4T..<,C.4T..Rich5T..........................PE..L......^...........!.....f...................................................P............@.........................`...]............ .......................0......p...................................@...............(............................text..."d.......f.................. ..`.rdata...d.......f...j..............@..@.data...<,..........................@....rsrc........ ......................@..@.reloc.......0... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{E22E6085-4A70-49E4-B1C5-4305B74C3132}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7682554531711178
Encrypted:	false
SSDEEP:	12:JSbX72FjdSAGiLIlHVRpzh/7777777777777777777777777vDHFEzVn8p01l0i5:JmQI53Enj8F
MD5:	E27FF2B793750DD7EAF6663FE617DBD4
SHA1:	4CA5CA8890172E589B3D05C67293B2EAD5A351BB
SHA-256:	40EAF38FC0422B95AE421D6213119FA1B58F62FB4818B87751C651D36EC2D494
SHA-512:	07489C27094E502FF57F7DE86AE5367201FD0C90407CAD9FDA2D94BBC23132498FC993EACBF5DC007DA636277BAC52775422A641832AC51FB26F98E7FBA80289
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2340493685039773
Encrypted:	false
SSDEEP:	48:8jquwJveFXJ5T5YXWddSPgrTddSBWrgSrp:Gq+RTuMRqtSrp
MD5:	44DBC0B20A7536C085B5E65EF433C205
SHA1:	21E07DEC9C23304FDD3566A02D2D7E8EE5241B0A
SHA-256:	A2B5583EB6097530F950A56D2A5870047F1DDE4B480DF2A0A854D26E013DF31D
SHA-512:	2C4E8DD73571BE7086BA2B4ECFA946865056A191B2295FB7BD43D3CDD51833034E37C9584FB65A7AEC7082B7276378BE0AFFBBAACE08AF281757E714B55548E9
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Logs\DPX\setupact.log

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	345054
Entropy (8bit):	4.3862240453517165
Encrypted:	false
SSDEEP:	192:0K9KmK9KIK7KIK7KYK7KIK7KYK7KIK7KYK7KIK7KYK7KIK7KYK7KIK7KYK7KIK73:s
MD5:	228DD9E7DF00A991995B2584B3EF2C39
SHA1:	4F0600AA20097AE60582BD7C0D041C8B438EA7F9
SHA-256:	18D9AF985F89D3FCD6E6E510882E52EC7EAFC1CE1E944CFC0933F88CC5B6C502
SHA-512:	DE0F4033C541E9E7FC1572778075A8AE8106D1DC884C5A95DA15C3798C080D54ADC9F070DEB56CBD39F251A6DDAC6CE89777D2B851FF9256A308D965104D15F0
Malicious:	false
Preview:	.2023-10-03 11:48:47, Info DPX Started DPX phase: Resume and Download Job..2023-10-03 11:48:47, Info DPX Started DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX Ended DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX Started DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX Ended DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX CJob::Resume completed with status: 0x0..2023-10-03 11:48:47, Info DPX Ended DPX phase: Resume and Download Job..2023-10-03 11:48:49, Info DPX Started DPX phase: Resume and Download Job..2023-10-03 11:48:49, Info DPX Started DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:49, Info DPX Ended DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:49, Info

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.3630086411334235
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaui:zTtbmkExhMJCIpED
MD5:	9ADAE0FE087B74046768AFD6900C28C7
SHA1:	3F1BC2AFAA59F73D086151CCB301E4FD41477EC3
SHA-256:	8E4AEA7A06F545EED13B6456EE2D367A4E36F7C86AC4A7B43F8809681BD36C8A
SHA-512:	0D56107657DD79453804241AFBDE99EC20C8D13FB0156BFF187B73BC567B49EB83D705C3F95FEF463CA5C5B7EB4A25FBF86E0486BBBE2CA9A3A6D388AFC36B20
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF5E036ED87243F5CB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06871083664025585
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOEzVnhoVky6l0t/:2F0i8n0itFzDHFEzVn101
MD5:	B484D000E7C1C859D685BC39189C185B
SHA1:	AFD67EB5271DB938D04BF2E701941F2646FA60AA
SHA-256:	2CAD4009F267276932965CD57EC99571A99F72B09B5554EAABBDCAAE70EB3E5A
SHA-512:	C1C7382BF1512527353AE65B5493D25ACF25D422C1410D79211AA49411E44E26EB5349C6CA1491F28967FF27BF00C60640226111F919EDA8AD89DF304FDC0D52
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA3A48E71AD02AFAB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	0.11528723868128912
Encrypted:	false
SSDEEP:	24:x0+GNpb/+wY+kJfAebfddipV7kddipVdVgwGPlrkg9SZ+4M:SrpbUrfddSBkddSPgrQX
MD5:	513359C631D886B3C4B210CC1E8A34D0
SHA1:	88BA31B07D8F1D7CECF2DD810DF74346C3C157BF
SHA-256:	FED301153DAB63169E11845DE8E030E39CF62863F9B7DBFB25626037640D9AF3
SHA-512:	1F16D5C05F9A4C76ABC57B7A647A7EFE999E92303ED25BD4A4DABCA32B004CC66BF8BE5440144A4A57AEF74BF310785773DE483A768CE256EC60A5235EAF7D9E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	271
Entropy (8bit):	4.839767001955523
Encrypted:	false
SSDEEP:	6:zx3MmSLQHtBXVNsR0PTXkH3JQHwD0DIZJQiOC0n:zK/0HtBFNE0P7kX5D0DYJQiI
MD5:	F475B90E72335E4500C505952BC0B61F
SHA1:	4D609DB87FEC8C7135E5029FB05891DDA053A5A7
SHA-256:	834A1B6EBA62FD66213D4956483F772221A74CCE84295E770E570741C3E76267
SHA-512:	BA7DA1B6415741E3F9DF36AAC39C4BA8C690FC3CF7FC39E7214188D7F3FFC883944F9C40C478D2092A95BF865027879BF822116CD0CDE13FFE6E3548BFB22240
Malicious:	false
Preview:	Microsoft (R) File Expansion Utility..Copyright (c) Microsoft Corporation. All rights reserved.....Adding files\MSWordServices.exe to Extraction Queue..Adding files\OLMAPI32.dll to Extraction Queue....Expanding Files ........Expanding Files Complete .....2 files total...

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Microsoft Outlook - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com 14.0.4760.1000, Subject: Microsoft Outlook - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com, Author: Microsoft Corporation, Keywords: Installer, Template: Intel;1033, Revision Number: {6FB667ED-1310-4415-BE99-B57534C2CC51}, Create Time/Date: Fri Jan 3 19:06:10 2020, Last Saved Time/Date: Fri Jan 3 19:06:10 2020, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (9.0.34.0), Security: 2
Entropy (8bit):	7.333172745854614
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	msws.msi
File size:	368'640 bytes
MD5:	c13c4c025c5c779d5dc8848ef160d5da
SHA1:	d7671d1f301d74aece0db320701395a5cd8cf29a
SHA256:	ba2e21641a1238a5b30e535bd0940fcd316a6e5242bfdd48a97aaa203d11642b
SHA512:	a0459c7732733a9d83d6e1b985cb9a913ab5fe9e30114aa1dd5b198002f36ce84a0e0e318fc60e9fdbd22dab29734aafdc50322fffeca50211d64b206d9adee3
SSDEEP:	6144:jJdjoxrGSPVWGQw/+QVAnjOl4ieipV8VTGipHfS+p:jvjoxrGS90v48yee8V5HfRp
TLSH:	0E74E0923AD9C036C298193F59BAC7963B3A7D355B30D08B77503A6C6E706D1E93A703
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 18, 2024 17:23:02.094109058 CEST	49711	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.094157934 CEST	443	49711	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.094295025 CEST	49711	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.136614084 CEST	49711	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.136646032 CEST	443	49711	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.136811972 CEST	443	49711	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.137588978 CEST	49712	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.137619019 CEST	443	49712	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.137687922 CEST	49712	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.137799025 CEST	49712	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.137811899 CEST	443	49712	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.137892008 CEST	443	49712	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.138880968 CEST	49713	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.138927937 CEST	443	49713	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.138988018 CEST	49713	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.139081001 CEST	49713	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.139091015 CEST	443	49713	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.139158010 CEST	443	49713	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.139707088 CEST	49714	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.139714956 CEST	443	49714	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.139779091 CEST	49714	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.139842987 CEST	49714	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.139849901 CEST	443	49714	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.139904022 CEST	443	49714	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.140782118 CEST	49715	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.140803099 CEST	443	49715	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.140856981 CEST	49715	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.140949965 CEST	49715	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.140957117 CEST	443	49715	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.141001940 CEST	443	49715	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.141621113 CEST	49716	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.141644001 CEST	443	49716	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.141697884 CEST	49716	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.141768932 CEST	49716	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.141776085 CEST	443	49716	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.141822100 CEST	443	49716	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.142544985 CEST	49717	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.142606974 CEST	443	49717	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.142663956 CEST	49717	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.142755985 CEST	49717	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.142771959 CEST	443	49717	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.142806053 CEST	443	49717	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.143404007 CEST	49718	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.143416882 CEST	443	49718	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.143466949 CEST	49718	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.143575907 CEST	49718	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.143591881 CEST	443	49718	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.143647909 CEST	443	49718	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.144397974 CEST	49719	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.144407988 CEST	443	49719	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.144469023 CEST	49719	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.144567966 CEST	49719	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.144572973 CEST	443	49719	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.144622087 CEST	443	49719	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.145155907 CEST	49720	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.145184994 CEST	443	49720	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.145246029 CEST	49720	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.145317078 CEST	49720	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.145327091 CEST	443	49720	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.145370007 CEST	443	49720	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.146151066 CEST	49721	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.146178961 CEST	443	49721	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.146229029 CEST	49721	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.146389008 CEST	49721	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.146401882 CEST	443	49721	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.146449089 CEST	443	49721	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.146980047 CEST	49722	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.147006035 CEST	443	49722	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.147058010 CEST	49722	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.147144079 CEST	49722	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.147159100 CEST	443	49722	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.147201061 CEST	443	49722	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.148027897 CEST	49723	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.148036957 CEST	443	49723	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.148092031 CEST	49723	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.148185968 CEST	49723	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.148199081 CEST	443	49723	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.148258924 CEST	443	49723	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.148854017 CEST	49724	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.148917913 CEST	443	49724	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.148988008 CEST	49724	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.149091005 CEST	49724	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.149116993 CEST	443	49724	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.149174929 CEST	443	49724	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.149967909 CEST	49725	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.149993896 CEST	443	49725	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.150046110 CEST	49725	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.150150061 CEST	49725	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.150162935 CEST	443	49725	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.150209904 CEST	443	49725	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.150768995 CEST	49726	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.150777102 CEST	443	49726	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.150824070 CEST	49726	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.150887012 CEST	49726	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.150892019 CEST	443	49726	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.150938034 CEST	443	49726	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.151724100 CEST	49727	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.151746988 CEST	443	49727	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.151815891 CEST	49727	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.151910067 CEST	49727	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.151927948 CEST	443	49727	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.151989937 CEST	443	49727	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.152527094 CEST	49728	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.152534962 CEST	443	49728	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.152590036 CEST	49728	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.152698994 CEST	49728	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.152709961 CEST	443	49728	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.152754068 CEST	443	49728	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.153512955 CEST	49729	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.153538942 CEST	443	49729	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.153618097 CEST	49729	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.153673887 CEST	49729	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.153688908 CEST	443	49729	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.153738022 CEST	443	49729	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.154227018 CEST	49730	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.154243946 CEST	443	49730	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.154288054 CEST	49730	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.154370070 CEST	49730	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.154397011 CEST	443	49730	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.154452085 CEST	443	49730	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.155189991 CEST	49731	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.155199051 CEST	443	49731	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.155260086 CEST	49731	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.155347109 CEST	49731	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.155354023 CEST	443	49731	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.155405998 CEST	443	49731	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.156012058 CEST	49732	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.156032085 CEST	443	49732	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.156099081 CEST	49732	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.156161070 CEST	49732	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.156187057 CEST	443	49732	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.156227112 CEST	443	49732	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.156969070 CEST	49733	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.156980038 CEST	443	49733	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.157032013 CEST	49733	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.157090902 CEST	49733	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.157095909 CEST	443	49733	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.157144070 CEST	443	49733	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.157696009 CEST	49734	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.157704115 CEST	443	49734	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.157749891 CEST	49734	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.157816887 CEST	49734	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.157820940 CEST	443	49734	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.157850027 CEST	443	49734	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.158597946 CEST	49735	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.158622980 CEST	443	49735	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.158684969 CEST	49735	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.158807039 CEST	49735	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.158822060 CEST	443	49735	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.158881903 CEST	443	49735	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.159405947 CEST	49736	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.159430027 CEST	443	49736	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.159488916 CEST	49736	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.159568071 CEST	49736	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.159574986 CEST	443	49736	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.159616947 CEST	443	49736	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.160342932 CEST	49737	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.160351992 CEST	443	49737	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.160406113 CEST	49737	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.160474062 CEST	49737	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.160484076 CEST	443	49737	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.160531044 CEST	443	49737	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.161111116 CEST	49738	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.161118031 CEST	443	49738	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.161170959 CEST	49738	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.161232948 CEST	49738	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.161240101 CEST	443	49738	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.161297083 CEST	443	49738	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.162060022 CEST	49739	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.162084103 CEST	443	49739	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.162134886 CEST	49739	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.162190914 CEST	49739	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.162199020 CEST	443	49739	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.162277937 CEST	443	49739	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.162786961 CEST	49740	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.162813902 CEST	443	49740	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.162866116 CEST	49740	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.162935972 CEST	49740	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.162942886 CEST	443	49740	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.162995100 CEST	443	49740	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.163702965 CEST	49741	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.163743973 CEST	443	49741	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.163816929 CEST	49741	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.163911104 CEST	49741	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.163924932 CEST	443	49741	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.163965940 CEST	443	49741	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.164755106 CEST	49742	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.164766073 CEST	443	49742	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.164815903 CEST	49742	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.164978027 CEST	49742	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.164995909 CEST	443	49742	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.165043116 CEST	443	49742	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.166094065 CEST	49743	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.166115046 CEST	443	49743	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.166158915 CEST	49743	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.166394949 CEST	49743	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.166409969 CEST	443	49743	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.166462898 CEST	443	49743	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.167253017 CEST	49744	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.167260885 CEST	443	49744	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.167351007 CEST	49744	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.167504072 CEST	49744	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.167512894 CEST	443	49744	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.167568922 CEST	443	49744	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.168461084 CEST	49745	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.168488026 CEST	443	49745	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.168565035 CEST	49745	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.168793917 CEST	49745	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.168811083 CEST	443	49745	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.168859959 CEST	443	49745	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.169708014 CEST	49746	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.169728994 CEST	443	49746	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.169837952 CEST	49746	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.169914961 CEST	49746	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.169929981 CEST	443	49746	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.169986963 CEST	443	49746	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.171219110 CEST	49747	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.171226978 CEST	443	49747	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.171269894 CEST	49747	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.171343088 CEST	49747	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.171348095 CEST	443	49747	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.171428919 CEST	443	49747	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.172251940 CEST	49748	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.172272921 CEST	443	49748	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.172331095 CEST	49748	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.172452927 CEST	49748	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.172465086 CEST	443	49748	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.172512054 CEST	443	49748	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.173510075 CEST	49749	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.173538923 CEST	443	49749	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.173588037 CEST	49749	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.173820972 CEST	49749	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.173837900 CEST	443	49749	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.173877001 CEST	443	49749	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.174841881 CEST	49750	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.174854994 CEST	443	49750	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.174909115 CEST	49750	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.174968958 CEST	49750	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.174978018 CEST	443	49750	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.175017118 CEST	443	49750	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.176141024 CEST	49751	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.176172018 CEST	443	49751	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.176321030 CEST	49751	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.176321030 CEST	49751	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.176341057 CEST	443	49751	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.176418066 CEST	443	49751	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.177386045 CEST	49752	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.177422047 CEST	443	49752	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.177474976 CEST	49752	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.177767992 CEST	49752	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.177784920 CEST	443	49752	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.177824974 CEST	443	49752	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.179147959 CEST	49753	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.179179907 CEST	443	49753	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.179235935 CEST	49753	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.179335117 CEST	49753	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.179347992 CEST	443	49753	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.179413080 CEST	443	49753	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.180259943 CEST	49754	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.180269957 CEST	443	49754	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.180315971 CEST	49754	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.180383921 CEST	49754	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.180392981 CEST	443	49754	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.180443048 CEST	443	49754	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.181432962 CEST	49755	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.181457996 CEST	443	49755	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.181516886 CEST	49755	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.181701899 CEST	49755	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.181716919 CEST	443	49755	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.181761026 CEST	443	49755	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.189843893 CEST	49756	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.189858913 CEST	443	49756	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.189903975 CEST	49756	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.189999104 CEST	49756	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.190011978 CEST	443	49756	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.190063000 CEST	443	49756	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.190830946 CEST	49757	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.190862894 CEST	443	49757	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.190915108 CEST	49757	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.191014051 CEST	49757	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.191026926 CEST	443	49757	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.191082954 CEST	443	49757	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.191773891 CEST	49758	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.191785097 CEST	443	49758	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.191832066 CEST	49758	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.191916943 CEST	49758	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.191926956 CEST	443	49758	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.191977024 CEST	443	49758	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.192717075 CEST	49759	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.192728996 CEST	443	49759	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.192783117 CEST	49759	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.192868948 CEST	49759	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.192878962 CEST	443	49759	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.192924023 CEST	443	49759	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.193444967 CEST	49760	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.193453074 CEST	443	49760	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.193506002 CEST	49760	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.193614006 CEST	49760	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.193624973 CEST	443	49760	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.193670988 CEST	443	49760	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.194350958 CEST	49761	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.194364071 CEST	443	49761	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.194416046 CEST	49761	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.194468021 CEST	49761	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.194473982 CEST	443	49761	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.194533110 CEST	443	49761	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.195007086 CEST	49762	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.195015907 CEST	443	49762	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.195074081 CEST	49762	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.195132971 CEST	49762	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.195137978 CEST	443	49762	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.195169926 CEST	443	49762	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.196039915 CEST	49763	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.196050882 CEST	443	49763	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.196113110 CEST	49763	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.196168900 CEST	49763	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.196173906 CEST	443	49763	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.196219921 CEST	443	49763	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.196809053 CEST	49764	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.196835995 CEST	443	49764	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.196887016 CEST	49764	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.196959019 CEST	49764	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.196973085 CEST	443	49764	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.197015047 CEST	443	49764	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.197731972 CEST	49765	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.197765112 CEST	443	49765	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.197805882 CEST	49765	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.197875023 CEST	49765	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.197882891 CEST	443	49765	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.197918892 CEST	443	49765	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.198398113 CEST	49766	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.198412895 CEST	443	49766	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.198471069 CEST	49766	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.198589087 CEST	49766	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.198602915 CEST	443	49766	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.198646069 CEST	443	49766	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.199377060 CEST	49767	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.199399948 CEST	443	49767	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.199457884 CEST	49767	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.199534893 CEST	49767	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.199546099 CEST	443	49767	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.199637890 CEST	443	49767	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.200242996 CEST	49768	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.200261116 CEST	443	49768	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.200365067 CEST	49768	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.200365067 CEST	49768	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.200381994 CEST	443	49768	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.200473070 CEST	443	49768	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.201184034 CEST	49769	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.201206923 CEST	443	49769	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.201267004 CEST	49769	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.201319933 CEST	49769	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.201328993 CEST	443	49769	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.201374054 CEST	443	49769	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.201872110 CEST	49770	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.201879978 CEST	443	49770	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.201921940 CEST	49770	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.201987982 CEST	49770	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.201993942 CEST	443	49770	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.202029943 CEST	443	49770	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.202714920 CEST	49771	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.202728987 CEST	443	49771	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.202789068 CEST	49771	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.202886105 CEST	49771	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.202894926 CEST	443	49771	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.202933073 CEST	443	49771	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.203408003 CEST	49772	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.203418970 CEST	443	49772	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.203466892 CEST	49772	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.203535080 CEST	49772	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.203540087 CEST	443	49772	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.203583956 CEST	443	49772	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.204288006 CEST	49773	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.204319954 CEST	443	49773	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.204401970 CEST	49773	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.204469919 CEST	49773	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.204492092 CEST	443	49773	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.204607010 CEST	443	49773	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.205173016 CEST	49774	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.205192089 CEST	443	49774	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.205261946 CEST	49774	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.205360889 CEST	49774	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.205374956 CEST	443	49774	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.205430031 CEST	443	49774	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.206132889 CEST	49775	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.206140995 CEST	443	49775	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.206187963 CEST	49775	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.206267118 CEST	49775	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.206273079 CEST	443	49775	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.206302881 CEST	443	49775	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.206792116 CEST	49776	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.206821918 CEST	443	49776	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.206922054 CEST	49776	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.207009077 CEST	49776	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.207017899 CEST	443	49776	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.207061052 CEST	443	49776	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.207807064 CEST	49777	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.207853079 CEST	443	49777	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.207911015 CEST	49777	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.208046913 CEST	49777	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.208067894 CEST	443	49777	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.208108902 CEST	443	49777	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.208688974 CEST	49778	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.208713055 CEST	443	49778	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.208767891 CEST	49778	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.208837986 CEST	49778	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.208848000 CEST	443	49778	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.208880901 CEST	443	49778	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.209593058 CEST	49779	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.209602118 CEST	443	49779	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.209649086 CEST	49779	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.209743977 CEST	49779	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.209752083 CEST	443	49779	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.209793091 CEST	443	49779	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.210272074 CEST	49780	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.210293055 CEST	443	49780	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.210340977 CEST	49780	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.210431099 CEST	49780	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.210438013 CEST	443	49780	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.210484982 CEST	443	49780	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.211200953 CEST	49781	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.211210012 CEST	443	49781	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.211280107 CEST	49781	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.211424112 CEST	49781	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.211435080 CEST	443	49781	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.211484909 CEST	443	49781	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.212074995 CEST	49782	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.212081909 CEST	443	49782	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.212135077 CEST	49782	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.212199926 CEST	49782	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.212205887 CEST	443	49782	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.212265015 CEST	443	49782	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.213058949 CEST	49783	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.213074923 CEST	443	49783	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.213124037 CEST	49783	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.213190079 CEST	49783	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.213196993 CEST	443	49783	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.213248968 CEST	443	49783	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.213911057 CEST	49784	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.213931084 CEST	443	49784	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.214009047 CEST	49784	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.214112997 CEST	49784	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.214126110 CEST	443	49784	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.214181900 CEST	443	49784	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.214979887 CEST	49785	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.215006113 CEST	443	49785	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.215063095 CEST	49785	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.215172052 CEST	49785	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.215184927 CEST	443	49785	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.215231895 CEST	443	49785	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.215780973 CEST	49786	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.215791941 CEST	443	49786	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.215863943 CEST	49786	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.215950966 CEST	49786	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.215961933 CEST	443	49786	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.216011047 CEST	443	49786	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.216842890 CEST	49787	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.216861963 CEST	443	49787	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.216938019 CEST	49787	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.217020035 CEST	49787	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.217032909 CEST	443	49787	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.217088938 CEST	443	49787	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.217731953 CEST	49788	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.217771053 CEST	443	49788	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.217828035 CEST	49788	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.217900038 CEST	49788	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.217910051 CEST	443	49788	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.217947960 CEST	443	49788	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.218785048 CEST	49789	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.218811035 CEST	443	49789	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.218861103 CEST	49789	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.218939066 CEST	49789	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.218957901 CEST	443	49789	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.219007969 CEST	443	49789	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.219772100 CEST	49790	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.219784975 CEST	443	49790	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.219927073 CEST	49790	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.219994068 CEST	49790	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.220002890 CEST	443	49790	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.220046043 CEST	443	49790	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.220860958 CEST	49791	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.220875978 CEST	443	49791	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.220984936 CEST	49791	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.221028090 CEST	49791	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.221050024 CEST	443	49791	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.221095085 CEST	443	49791	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.221707106 CEST	49792	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.221714973 CEST	443	49792	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.221776962 CEST	49792	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.221858025 CEST	49792	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.221863985 CEST	443	49792	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.221894026 CEST	443	49792	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.222740889 CEST	49793	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.222771883 CEST	443	49793	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.222834110 CEST	49793	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.222958088 CEST	49793	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.222971916 CEST	443	49793	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.223026991 CEST	443	49793	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.223692894 CEST	49794	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.223706007 CEST	443	49794	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.223761082 CEST	49794	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.223829985 CEST	49794	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.223836899 CEST	443	49794	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.223871946 CEST	443	49794	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.224745989 CEST	49795	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.224752903 CEST	443	49795	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.224822044 CEST	49795	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.224906921 CEST	49795	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.224915981 CEST	443	49795	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.224952936 CEST	443	49795	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.225558043 CEST	49796	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.225595951 CEST	443	49796	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.225647926 CEST	49796	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.225725889 CEST	49796	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.225739956 CEST	443	49796	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.225769997 CEST	443	49796	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.226605892 CEST	49797	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.226638079 CEST	443	49797	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.226788044 CEST	49797	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.226811886 CEST	49797	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.226819038 CEST	443	49797	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.226900101 CEST	443	49797	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.227524996 CEST	49798	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.227543116 CEST	443	49798	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.227592945 CEST	49798	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.227689981 CEST	49798	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.227703094 CEST	443	49798	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.227778912 CEST	443	49798	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.228647947 CEST	49799	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.228687048 CEST	443	49799	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.228744984 CEST	49799	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.228813887 CEST	49799	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.228826046 CEST	443	49799	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.228939056 CEST	443	49799	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.229648113 CEST	49800	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.229666948 CEST	443	49800	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.229814053 CEST	49800	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.229814053 CEST	49800	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.229842901 CEST	443	49800	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.229913950 CEST	443	49800	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.230758905 CEST	49801	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.230789900 CEST	443	49801	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.230840921 CEST	49801	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.230910063 CEST	49801	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.230922937 CEST	443	49801	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.230962038 CEST	443	49801	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.231564999 CEST	49802	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.231580019 CEST	443	49802	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.231645107 CEST	49802	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.231731892 CEST	49802	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.231744051 CEST	443	49802	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.231787920 CEST	443	49802	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.232644081 CEST	49803	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.232670069 CEST	443	49803	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.232789040 CEST	49803	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.232891083 CEST	49803	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.232902050 CEST	443	49803	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.232945919 CEST	443	49803	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.233541012 CEST	49804	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.233550072 CEST	443	49804	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.233612061 CEST	49804	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.233684063 CEST	49804	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.233690977 CEST	443	49804	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.233726025 CEST	443	49804	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.234544039 CEST	49805	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.234565020 CEST	443	49805	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.234635115 CEST	49805	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.234724045 CEST	49805	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.234749079 CEST	443	49805	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.234785080 CEST	443	49805	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.235410929 CEST	49806	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.235428095 CEST	443	49806	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.235491037 CEST	49806	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.235563040 CEST	49806	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.235577106 CEST	443	49806	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.235610008 CEST	443	49806	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.236474991 CEST	49807	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.236481905 CEST	443	49807	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.236534119 CEST	49807	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.236599922 CEST	49807	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.236608028 CEST	443	49807	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.236644983 CEST	443	49807	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.237297058 CEST	49808	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.237329960 CEST	443	49808	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.237405062 CEST	49808	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.237452984 CEST	49808	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.237459898 CEST	443	49808	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.237495899 CEST	443	49808	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.238277912 CEST	49809	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.238322973 CEST	443	49809	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.238383055 CEST	49809	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.238460064 CEST	49809	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.238476992 CEST	443	49809	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.238514900 CEST	443	49809	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.239110947 CEST	49810	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.239134073 CEST	443	49810	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.239186049 CEST	49810	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.239281893 CEST	49810	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.239299059 CEST	443	49810	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.239336967 CEST	443	49810	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.240166903 CEST	49811	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.240197897 CEST	443	49811	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.240250111 CEST	49811	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.240319967 CEST	49811	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.240328074 CEST	443	49811	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.240360022 CEST	443	49811	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.240978956 CEST	49812	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.241005898 CEST	443	49812	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.241064072 CEST	49812	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.241148949 CEST	49812	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.241162062 CEST	443	49812	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.241178036 CEST	443	49812	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.242008924 CEST	49813	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.242017031 CEST	443	49813	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.242079020 CEST	49813	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.242151022 CEST	49813	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.242161989 CEST	443	49813	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.242181063 CEST	443	49813	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.243009090 CEST	49814	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.243016005 CEST	443	49814	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.243067026 CEST	49814	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.243180990 CEST	49814	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.243189096 CEST	443	49814	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.243207932 CEST	443	49814	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.244601965 CEST	49815	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.244620085 CEST	443	49815	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.244676113 CEST	49815	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.244765043 CEST	49815	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.244774103 CEST	443	49815	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.244791985 CEST	443	49815	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.245682001 CEST	49816	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.245703936 CEST	443	49816	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.245768070 CEST	49816	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.245933056 CEST	49816	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.245954037 CEST	443	49816	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.245986938 CEST	443	49816	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.247268915 CEST	49817	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.247282982 CEST	443	49817	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.247325897 CEST	49817	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.247509956 CEST	49817	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.247522116 CEST	443	49817	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.247575045 CEST	443	49817	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.248092890 CEST	49818	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.248100996 CEST	443	49818	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.248145103 CEST	49818	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.248275995 CEST	49818	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.248286963 CEST	443	49818	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.248307943 CEST	443	49818	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.249428988 CEST	49819	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.249453068 CEST	443	49819	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.249511003 CEST	49819	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.249582052 CEST	49819	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.249608040 CEST	443	49819	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.249630928 CEST	443	49819	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.250498056 CEST	49820	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.250535965 CEST	443	49820	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.250586987 CEST	49820	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.250703096 CEST	49820	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.250718117 CEST	443	49820	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.250735998 CEST	443	49820	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.251580000 CEST	49821	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.251607895 CEST	443	49821	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.251662970 CEST	49821	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.251852989 CEST	49821	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.251864910 CEST	443	49821	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.251888037 CEST	443	49821	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.252530098 CEST	49822	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.252551079 CEST	443	49822	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.252610922 CEST	49822	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.252688885 CEST	49822	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.252700090 CEST	443	49822	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.252720118 CEST	443	49822	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.253906012 CEST	49823	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.253920078 CEST	443	49823	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.253982067 CEST	49823	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.254111052 CEST	49823	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.254122019 CEST	443	49823	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.254143953 CEST	443	49823	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.254983902 CEST	49824	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.254992008 CEST	443	49824	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.255043030 CEST	49824	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.255145073 CEST	49824	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.255155087 CEST	443	49824	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.255173922 CEST	443	49824	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.256426096 CEST	49825	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.256448984 CEST	443	49825	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.256493092 CEST	49825	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.256593943 CEST	49825	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.256604910 CEST	443	49825	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.256628990 CEST	443	49825	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.257565022 CEST	49826	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.257579088 CEST	443	49826	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.257699013 CEST	49826	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.257757902 CEST	49826	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.257767916 CEST	443	49826	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.257788897 CEST	443	49826	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.259100914 CEST	49827	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.259109974 CEST	443	49827	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.259151936 CEST	49827	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.259357929 CEST	49827	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.259375095 CEST	443	49827	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.259402037 CEST	443	49827	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.260328054 CEST	49828	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.260351896 CEST	443	49828	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.260411978 CEST	49828	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.260492086 CEST	49828	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.260515928 CEST	443	49828	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.260541916 CEST	443	49828	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.261671066 CEST	49829	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.261683941 CEST	443	49829	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.261734009 CEST	49829	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.261801958 CEST	49829	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.261812925 CEST	443	49829	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.261831999 CEST	443	49829	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.262401104 CEST	49830	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.262408972 CEST	443	49830	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.262460947 CEST	49830	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.262542963 CEST	49830	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.262552023 CEST	443	49830	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.262568951 CEST	443	49830	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.263251066 CEST	49831	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.263268948 CEST	443	49831	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.263343096 CEST	49831	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.263436079 CEST	49831	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.263454914 CEST	443	49831	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.263479948 CEST	443	49831	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.263945103 CEST	49832	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.263967991 CEST	443	49832	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.264027119 CEST	49832	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.264103889 CEST	49832	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.264116049 CEST	443	49832	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.264137983 CEST	443	49832	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.264780045 CEST	49833	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.264789104 CEST	443	49833	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.264853001 CEST	49833	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.264931917 CEST	49833	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.264942884 CEST	443	49833	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.264960051 CEST	443	49833	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.265403032 CEST	49834	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.265408993 CEST	443	49834	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.265465021 CEST	49834	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.265542030 CEST	49834	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.265552044 CEST	443	49834	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.265567064 CEST	443	49834	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.266199112 CEST	49835	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.266212940 CEST	443	49835	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.266274929 CEST	49835	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.266354084 CEST	49835	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.266365051 CEST	443	49835	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.266383886 CEST	443	49835	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.266813993 CEST	49836	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.266848087 CEST	443	49836	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.266902924 CEST	49836	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.266977072 CEST	49836	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.266989946 CEST	443	49836	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.267009020 CEST	443	49836	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.267635107 CEST	49837	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.267673969 CEST	443	49837	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.267739058 CEST	49837	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.267893076 CEST	49837	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.267915010 CEST	443	49837	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.267931938 CEST	443	49837	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.268381119 CEST	49838	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.268399954 CEST	443	49838	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.268457890 CEST	49838	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.268533945 CEST	49838	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.268548965 CEST	443	49838	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.268564939 CEST	443	49838	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.269198895 CEST	49839	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.269218922 CEST	443	49839	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.269273996 CEST	49839	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.269360065 CEST	49839	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.269371986 CEST	443	49839	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.269403934 CEST	443	49839	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.269839048 CEST	49840	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.269845963 CEST	443	49840	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.269900084 CEST	49840	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.269992113 CEST	49840	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.270000935 CEST	443	49840	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.270016909 CEST	443	49840	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.270652056 CEST	49841	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.270670891 CEST	443	49841	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.270741940 CEST	49841	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.270817041 CEST	49841	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.270843983 CEST	443	49841	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.270854950 CEST	443	49841	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.271291971 CEST	49842	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.271307945 CEST	443	49842	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.271377087 CEST	49842	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.271454096 CEST	49842	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.271478891 CEST	443	49842	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.271502018 CEST	443	49842	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.272119045 CEST	49843	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.272128105 CEST	443	49843	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.272181988 CEST	49843	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.272260904 CEST	49843	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.272269011 CEST	443	49843	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.272284031 CEST	443	49843	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.272810936 CEST	49844	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.272825003 CEST	443	49844	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.272952080 CEST	49844	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.272952080 CEST	49844	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.272972107 CEST	443	49844	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.272994041 CEST	443	49844	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.273597956 CEST	49845	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.273606062 CEST	443	49845	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.273667097 CEST	49845	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.273755074 CEST	49845	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.273766041 CEST	443	49845	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.273785114 CEST	443	49845	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.274362087 CEST	49846	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.274370909 CEST	443	49846	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.274425030 CEST	49846	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.274641037 CEST	49846	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.274652004 CEST	443	49846	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.274669886 CEST	443	49846	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.275780916 CEST	49847	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.275794983 CEST	443	49847	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.275899887 CEST	49847	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.276046991 CEST	49847	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.276065111 CEST	443	49847	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.276079893 CEST	443	49847	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.276943922 CEST	49848	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.276978016 CEST	443	49848	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.277029037 CEST	49848	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.277230024 CEST	49848	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.277250051 CEST	443	49848	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.277266979 CEST	443	49848	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.278548956 CEST	49849	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.278578043 CEST	443	49849	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.278626919 CEST	49849	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.278826952 CEST	49849	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.278839111 CEST	443	49849	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.278851032 CEST	443	49849	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.279809952 CEST	49850	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.279819965 CEST	443	49850	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.279870033 CEST	49850	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.279951096 CEST	49850	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.279959917 CEST	443	49850	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.279978037 CEST	443	49850	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.281342983 CEST	49851	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.281375885 CEST	443	49851	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.281424999 CEST	49851	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.281559944 CEST	49851	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.281579018 CEST	443	49851	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.281596899 CEST	443	49851	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.282571077 CEST	49852	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.282581091 CEST	443	49852	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.282634974 CEST	49852	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.282917976 CEST	49852	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.282932043 CEST	443	49852	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.282948017 CEST	443	49852	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.284241915 CEST	49853	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.284266949 CEST	443	49853	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.284327030 CEST	49853	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.284446001 CEST	49853	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.284457922 CEST	443	49853	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.284472942 CEST	443	49853	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.285279989 CEST	49854	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.285290956 CEST	443	49854	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.285343885 CEST	49854	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.285526037 CEST	49854	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.285537004 CEST	443	49854	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.285551071 CEST	443	49854	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.286825895 CEST	49855	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.286833048 CEST	443	49855	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.286925077 CEST	49855	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.287034988 CEST	49855	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.287046909 CEST	443	49855	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.287065029 CEST	443	49855	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.287887096 CEST	49856	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.287919998 CEST	443	49856	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.287976027 CEST	49856	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.288248062 CEST	49856	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.288266897 CEST	443	49856	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.288286924 CEST	443	49856	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.289309978 CEST	49857	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.289345026 CEST	443	49857	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.289422989 CEST	49857	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.289540052 CEST	49857	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.289555073 CEST	443	49857	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.289567947 CEST	443	49857	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.290431976 CEST	49858	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.290448904 CEST	443	49858	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.290493011 CEST	49858	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.290628910 CEST	49858	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.290641069 CEST	443	49858	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.290653944 CEST	443	49858	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.291793108 CEST	49859	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.291825056 CEST	443	49859	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.291871071 CEST	49859	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.291971922 CEST	49859	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.291990995 CEST	443	49859	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.292010069 CEST	443	49859	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.292803049 CEST	49860	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.292809963 CEST	443	49860	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.292854071 CEST	49860	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.292943001 CEST	49860	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.292951107 CEST	443	49860	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.292968035 CEST	443	49860	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.294229031 CEST	49861	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.294250965 CEST	443	49861	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.294295073 CEST	49861	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.294517994 CEST	49861	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.294527054 CEST	443	49861	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.294549942 CEST	443	49861	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.295499086 CEST	49862	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.295511961 CEST	443	49862	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.295562029 CEST	49862	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.295639038 CEST	49862	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.295646906 CEST	443	49862	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.295669079 CEST	443	49862	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.296951056 CEST	49863	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.296958923 CEST	443	49863	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.297005892 CEST	49863	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.297116041 CEST	49863	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.297123909 CEST	443	49863	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.297149897 CEST	443	49863	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.298021078 CEST	49864	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.298039913 CEST	443	49864	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.298079967 CEST	49864	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.298147917 CEST	49864	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.298156977 CEST	443	49864	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.298177004 CEST	443	49864	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.299774885 CEST	49865	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.299808025 CEST	443	49865	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.299876928 CEST	49865	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.299947977 CEST	49865	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.299973011 CEST	443	49865	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.300000906 CEST	443	49865	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.300885916 CEST	49866	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.300904989 CEST	443	49866	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.300968885 CEST	49866	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.301137924 CEST	49866	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.301162004 CEST	443	49866	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.301183939 CEST	443	49866	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.302364111 CEST	49867	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.302372932 CEST	443	49867	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.302418947 CEST	49867	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.302475929 CEST	49867	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.302484989 CEST	443	49867	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.302500010 CEST	443	49867	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.303380966 CEST	49868	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.303405046 CEST	443	49868	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.303477049 CEST	49868	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.303716898 CEST	49868	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.303730965 CEST	443	49868	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.303745985 CEST	443	49868	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.305339098 CEST	49869	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.305358887 CEST	443	49869	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.305413961 CEST	49869	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.305495977 CEST	49869	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.305509090 CEST	443	49869	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.305526972 CEST	443	49869	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.306421995 CEST	49870	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.306432009 CEST	443	49870	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.306483030 CEST	49870	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.306647062 CEST	49870	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.306658030 CEST	443	49870	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.306674957 CEST	443	49870	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.307946920 CEST	49871	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.307965040 CEST	443	49871	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.308095932 CEST	49871	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.308166027 CEST	49871	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.308176994 CEST	443	49871	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.308191061 CEST	443	49871	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.309153080 CEST	49872	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.309176922 CEST	443	49872	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.309231997 CEST	49872	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.309494972 CEST	49872	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.309508085 CEST	443	49872	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.309521914 CEST	443	49872	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.311029911 CEST	49873	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.311044931 CEST	443	49873	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.311106920 CEST	49873	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.311177015 CEST	49873	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.311189890 CEST	443	49873	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.311206102 CEST	443	49873	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.312236071 CEST	49874	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.312244892 CEST	443	49874	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.312294960 CEST	49874	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.312364101 CEST	49874	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.312376022 CEST	443	49874	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.312391043 CEST	443	49874	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.313504934 CEST	49875	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.313520908 CEST	443	49875	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.313560009 CEST	49875	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.313659906 CEST	49875	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.313669920 CEST	443	49875	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.313683033 CEST	443	49875	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.314480066 CEST	49876	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.314512968 CEST	443	49876	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.314560890 CEST	49876	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.314666033 CEST	49876	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.314677954 CEST	443	49876	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.314692020 CEST	443	49876	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.315727949 CEST	49877	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.315783024 CEST	443	49877	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.315834999 CEST	49877	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.316004038 CEST	49877	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.316024065 CEST	443	49877	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.316042900 CEST	443	49877	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.316658020 CEST	49878	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.316670895 CEST	443	49878	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.316735029 CEST	49878	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.316894054 CEST	49878	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.316909075 CEST	443	49878	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.316925049 CEST	443	49878	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.318027020 CEST	49879	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.318037987 CEST	443	49879	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.318085909 CEST	49879	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.318202019 CEST	49879	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.318211079 CEST	443	49879	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.318233013 CEST	443	49879	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.319133997 CEST	49880	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.319145918 CEST	443	49880	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.319189072 CEST	49880	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.319271088 CEST	49880	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.319283009 CEST	443	49880	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.319299936 CEST	443	49880	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.320390940 CEST	49881	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.320409060 CEST	443	49881	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.320456982 CEST	49881	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.320590019 CEST	49881	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.320609093 CEST	443	49881	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.320632935 CEST	443	49881	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.325544119 CEST	49882	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.325562000 CEST	443	49882	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.325674057 CEST	49882	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.325864077 CEST	49882	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.325882912 CEST	443	49882	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.325903893 CEST	443	49882	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.327156067 CEST	49883	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.327199936 CEST	443	49883	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.327303886 CEST	49883	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.327330112 CEST	49883	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.327337027 CEST	443	49883	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.327364922 CEST	443	49883	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.328217983 CEST	49884	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.328247070 CEST	443	49884	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.328304052 CEST	49884	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.328444958 CEST	49884	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.328485966 CEST	443	49884	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.328509092 CEST	443	49884	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.329618931 CEST	49885	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.329633951 CEST	443	49885	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.329674959 CEST	49885	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.329874039 CEST	49885	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.329885006 CEST	443	49885	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.329900026 CEST	443	49885	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.330822945 CEST	49886	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.330832005 CEST	443	49886	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.330878973 CEST	49886	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.331166983 CEST	49886	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.331176043 CEST	443	49886	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.331191063 CEST	443	49886	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.332400084 CEST	49887	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.332418919 CEST	443	49887	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.332489967 CEST	49887	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.332660913 CEST	49887	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.332684994 CEST	443	49887	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.332706928 CEST	443	49887	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.333610058 CEST	49888	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.333628893 CEST	443	49888	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.333688021 CEST	49888	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.333831072 CEST	49888	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.333854914 CEST	443	49888	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.333878994 CEST	443	49888	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.335236073 CEST	49889	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.335243940 CEST	443	49889	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.335294008 CEST	49889	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.335375071 CEST	49889	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.335385084 CEST	443	49889	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.335406065 CEST	443	49889	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.336621046 CEST	49890	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.336627960 CEST	443	49890	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.336673021 CEST	49890	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.336844921 CEST	49890	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.336853981 CEST	443	49890	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.336874962 CEST	443	49890	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.338188887 CEST	49891	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.338211060 CEST	443	49891	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.338277102 CEST	49891	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.338445902 CEST	49891	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.338469982 CEST	443	49891	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.338495016 CEST	443	49891	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.339380980 CEST	49892	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.339401007 CEST	443	49892	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.339454889 CEST	49892	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.339634895 CEST	49892	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.339649916 CEST	443	49892	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.339668989 CEST	443	49892	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.340954065 CEST	49893	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.340970039 CEST	443	49893	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.341048956 CEST	49893	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.341331005 CEST	49893	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.341344118 CEST	443	49893	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.341360092 CEST	443	49893	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.342308998 CEST	49894	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.342334986 CEST	443	49894	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.342499971 CEST	49894	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.342531919 CEST	49894	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.342539072 CEST	443	49894	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.342557907 CEST	443	49894	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.343425989 CEST	49895	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.343436956 CEST	443	49895	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.343485117 CEST	49895	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.343614101 CEST	49895	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.343626976 CEST	443	49895	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.343646049 CEST	443	49895	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.344568968 CEST	49896	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.344602108 CEST	443	49896	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.344647884 CEST	49896	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.344763994 CEST	49896	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.344774961 CEST	443	49896	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.344791889 CEST	443	49896	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.345890045 CEST	49897	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.345940113 CEST	443	49897	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.346004009 CEST	49897	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.346064091 CEST	49897	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.346081972 CEST	443	49897	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.346101999 CEST	443	49897	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.346611977 CEST	49898	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.346623898 CEST	443	49898	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.346685886 CEST	49898	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.346767902 CEST	49898	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.346781969 CEST	443	49898	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.346801043 CEST	443	49898	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.347429991 CEST	49899	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.347439051 CEST	443	49899	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.347506046 CEST	49899	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.347579002 CEST	49899	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.347588062 CEST	443	49899	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.347604990 CEST	443	49899	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.348052979 CEST	49900	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.348078966 CEST	443	49900	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.348140001 CEST	49900	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.348221064 CEST	49900	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.348232985 CEST	443	49900	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.348249912 CEST	443	49900	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.348906040 CEST	49901	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.348918915 CEST	443	49901	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.348989964 CEST	49901	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.349066019 CEST	49901	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.349078894 CEST	443	49901	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.349098921 CEST	443	49901	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.349540949 CEST	49902	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.349546909 CEST	443	49902	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.349607944 CEST	49902	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.349684000 CEST	49902	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.349695921 CEST	443	49902	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.349715948 CEST	443	49902	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.350336075 CEST	49903	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.350347996 CEST	443	49903	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.350402117 CEST	49903	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.350490093 CEST	49903	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.350500107 CEST	443	49903	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.350517035 CEST	443	49903	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.350941896 CEST	49904	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.350965977 CEST	443	49904	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.351078987 CEST	49904	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.351316929 CEST	49904	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.351327896 CEST	443	49904	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.351346016 CEST	443	49904	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.352034092 CEST	49905	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.352044106 CEST	443	49905	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.352137089 CEST	49905	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.352251053 CEST	49905	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.352262974 CEST	443	49905	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.352282047 CEST	443	49905	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.353365898 CEST	49906	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.353399038 CEST	443	49906	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.353454113 CEST	49906	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.353570938 CEST	49906	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.353585005 CEST	443	49906	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.353604078 CEST	443	49906	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.355102062 CEST	49907	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.355115891 CEST	443	49907	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.355185986 CEST	49907	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.355360985 CEST	49907	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.355381966 CEST	443	49907	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.355406046 CEST	443	49907	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.356322050 CEST	49908	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.356338024 CEST	443	49908	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.356383085 CEST	49908	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.356457949 CEST	49908	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.356470108 CEST	443	49908	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.356486082 CEST	443	49908	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.357657909 CEST	49909	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.357677937 CEST	443	49909	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.357743979 CEST	49909	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.357897043 CEST	49909	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.357919931 CEST	443	49909	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.357945919 CEST	443	49909	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.358903885 CEST	49910	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.358922958 CEST	443	49910	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.358989954 CEST	49910	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.359147072 CEST	49910	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.359169960 CEST	443	49910	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.359200954 CEST	443	49910	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.360136032 CEST	49911	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.360143900 CEST	443	49911	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.360198021 CEST	49911	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.360347986 CEST	49911	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.360357046 CEST	443	49911	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.360374928 CEST	443	49911	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.361172915 CEST	49912	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.361182928 CEST	443	49912	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.361228943 CEST	49912	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.361341953 CEST	49912	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.361352921 CEST	443	49912	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.361372948 CEST	443	49912	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.362749100 CEST	49913	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.362772942 CEST	443	49913	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.362829924 CEST	49913	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.362911940 CEST	49913	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.362924099 CEST	443	49913	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.362941980 CEST	443	49913	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.363850117 CEST	49914	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.363858938 CEST	443	49914	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.363903999 CEST	49914	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.364087105 CEST	49914	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.364095926 CEST	443	49914	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.364114046 CEST	443	49914	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.365391016 CEST	49915	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.365402937 CEST	443	49915	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.365453005 CEST	49915	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.365523100 CEST	49915	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.365534067 CEST	443	49915	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.365559101 CEST	443	49915	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.366527081 CEST	49916	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.366553068 CEST	443	49916	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.366628885 CEST	49916	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.366782904 CEST	49916	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.366800070 CEST	443	49916	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.366822958 CEST	443	49916	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.368257999 CEST	49917	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.368299961 CEST	443	49917	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.368350029 CEST	49917	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.368582964 CEST	49917	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.368597031 CEST	443	49917	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.368617058 CEST	443	49917	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.369565010 CEST	49918	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.369575024 CEST	443	49918	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.369628906 CEST	49918	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.369702101 CEST	49918	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.369710922 CEST	443	49918	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.369728088 CEST	443	49918	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.370910883 CEST	49919	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.370933056 CEST	443	49919	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.370989084 CEST	49919	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.371068001 CEST	49919	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.371083975 CEST	443	49919	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.371104002 CEST	443	49919	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.371834993 CEST	49920	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.371866941 CEST	443	49920	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.371917009 CEST	49920	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.372035027 CEST	49920	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.372049093 CEST	443	49920	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.372066021 CEST	443	49920	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.373461962 CEST	49921	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.373478889 CEST	443	49921	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.373529911 CEST	49921	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.373608112 CEST	49921	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.373620033 CEST	443	49921	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.373641014 CEST	443	49921	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.374737024 CEST	49922	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.374748945 CEST	443	49922	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.374795914 CEST	49922	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.374914885 CEST	49922	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.374929905 CEST	443	49922	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.374952078 CEST	443	49922	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.375965118 CEST	49923	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.375988960 CEST	443	49923	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.376054049 CEST	49923	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.376318932 CEST	49923	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.376331091 CEST	443	49923	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.376348019 CEST	443	49923	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.377060890 CEST	49924	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.377082109 CEST	443	49924	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.377130032 CEST	49924	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.377235889 CEST	49924	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.377247095 CEST	443	49924	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.377265930 CEST	443	49924	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.378428936 CEST	49925	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.378460884 CEST	443	49925	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.378525019 CEST	49925	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.378739119 CEST	49925	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.378756046 CEST	443	49925	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.378777027 CEST	443	49925	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.379642010 CEST	49926	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.379652977 CEST	443	49926	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.379712105 CEST	49926	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.379784107 CEST	49926	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.379796982 CEST	443	49926	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.379817963 CEST	443	49926	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.380961895 CEST	49927	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.380983114 CEST	443	49927	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.381028891 CEST	49927	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.381190062 CEST	49927	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.381200075 CEST	443	49927	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.381226063 CEST	443	49927	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.382181883 CEST	49928	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.382211924 CEST	443	49928	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.382261992 CEST	49928	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.382425070 CEST	49928	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.382438898 CEST	443	49928	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.382467031 CEST	443	49928	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.384052992 CEST	49929	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.384083986 CEST	443	49929	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.384149075 CEST	49929	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.384352922 CEST	49929	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.384366989 CEST	443	49929	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.384387016 CEST	443	49929	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.385271072 CEST	49930	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.385286093 CEST	443	49930	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.385376930 CEST	49930	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.385529995 CEST	49930	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.385540962 CEST	443	49930	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.385557890 CEST	443	49930	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.386962891 CEST	49931	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.386976957 CEST	443	49931	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.387032032 CEST	49931	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.387197018 CEST	49931	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.387208939 CEST	443	49931	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.387231112 CEST	443	49931	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.388118982 CEST	49932	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.388147116 CEST	443	49932	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.388222933 CEST	49932	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.388319016 CEST	49932	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.388344049 CEST	443	49932	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.388369083 CEST	443	49932	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.389620066 CEST	49933	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.389637947 CEST	443	49933	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.389682055 CEST	49933	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.389743090 CEST	49933	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.389753103 CEST	443	49933	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.389772892 CEST	443	49933	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.390706062 CEST	49934	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.390716076 CEST	443	49934	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.390773058 CEST	49934	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.390855074 CEST	49934	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.390863895 CEST	443	49934	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.390882015 CEST	443	49934	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.391876936 CEST	49935	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.391899109 CEST	443	49935	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.391961098 CEST	49935	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.392041922 CEST	49935	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.392066002 CEST	443	49935	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.392090082 CEST	443	49935	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.392677069 CEST	49936	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.392699957 CEST	443	49936	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.392762899 CEST	49936	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.392904043 CEST	49936	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.392918110 CEST	443	49936	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.392937899 CEST	443	49936	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.393986940 CEST	49937	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.394018888 CEST	443	49937	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.394072056 CEST	49937	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.394144058 CEST	49937	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.394155979 CEST	443	49937	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.394171953 CEST	443	49937	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.394782066 CEST	49938	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.394794941 CEST	443	49938	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.394851923 CEST	49938	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.394942999 CEST	49938	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.394954920 CEST	443	49938	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.394969940 CEST	443	49938	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.395867109 CEST	49939	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.395884037 CEST	443	49939	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.395936966 CEST	49939	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.396043062 CEST	49939	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.396059990 CEST	443	49939	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.396078110 CEST	443	49939	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.396712065 CEST	49940	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.396725893 CEST	443	49940	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.396780968 CEST	49940	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.396862984 CEST	49940	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.396874905 CEST	443	49940	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.396895885 CEST	443	49940	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.397799969 CEST	49941	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.397825003 CEST	443	49941	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.397883892 CEST	49941	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.397998095 CEST	49941	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.398010015 CEST	443	49941	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.398026943 CEST	443	49941	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.398683071 CEST	49942	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.398693085 CEST	443	49942	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.398756981 CEST	49942	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.398880959 CEST	49942	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.398889065 CEST	443	49942	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.398910999 CEST	443	49942	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.399677038 CEST	49943	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.399688005 CEST	443	49943	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.399749041 CEST	49943	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.399904013 CEST	49943	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.399912119 CEST	443	49943	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.399945974 CEST	443	49943	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.400588989 CEST	49944	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.400615931 CEST	443	49944	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.400665998 CEST	49944	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.400734901 CEST	49944	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.400747061 CEST	443	49944	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.400770903 CEST	443	49944	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.401678085 CEST	49945	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.401702881 CEST	443	49945	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.401772022 CEST	49945	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.401855946 CEST	49945	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.401880980 CEST	443	49945	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.401907921 CEST	443	49945	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.402502060 CEST	49946	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.402520895 CEST	443	49946	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.402591944 CEST	49946	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.402663946 CEST	49946	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.402688026 CEST	443	49946	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.402710915 CEST	443	49946	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.403511047 CEST	49947	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.403532028 CEST	443	49947	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.403585911 CEST	49947	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.403656006 CEST	49947	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.403666019 CEST	443	49947	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.403702974 CEST	443	49947	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.404417992 CEST	49948	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.404442072 CEST	443	49948	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.404537916 CEST	49948	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.404711962 CEST	49948	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.404726028 CEST	443	49948	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.404747009 CEST	443	49948	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.405642033 CEST	49949	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.405687094 CEST	443	49949	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.405747890 CEST	49949	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.405817032 CEST	49949	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.405833960 CEST	443	49949	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.405854940 CEST	443	49949	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.406428099 CEST	49950	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.406451941 CEST	443	49950	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.406506062 CEST	49950	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.406575918 CEST	49950	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.406594038 CEST	443	49950	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.406610012 CEST	443	49950	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.407527924 CEST	49951	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.407541990 CEST	443	49951	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.407618046 CEST	49951	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.407691002 CEST	49951	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.407705069 CEST	443	49951	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.407841921 CEST	443	49951	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.408443928 CEST	49952	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.408466101 CEST	443	49952	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.408590078 CEST	49952	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.408590078 CEST	49952	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.408607960 CEST	443	49952	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.408651114 CEST	443	49952	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.409544945 CEST	49953	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.409571886 CEST	443	49953	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.409636021 CEST	49953	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.409720898 CEST	49953	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.409739017 CEST	443	49953	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.409765959 CEST	443	49953	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.410331964 CEST	49954	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.410351038 CEST	443	49954	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.410408020 CEST	49954	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.410501957 CEST	49954	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.410515070 CEST	443	49954	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.410535097 CEST	443	49954	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.411436081 CEST	49955	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.411449909 CEST	443	49955	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.411510944 CEST	49955	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.411587954 CEST	49955	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.411598921 CEST	443	49955	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.411616087 CEST	443	49955	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.412671089 CEST	49956	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.412684917 CEST	443	49956	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.412739992 CEST	49956	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.412853003 CEST	49956	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.412863970 CEST	443	49956	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.412918091 CEST	443	49956	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.413892031 CEST	49957	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.413913012 CEST	443	49957	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.413986921 CEST	49957	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.414071083 CEST	49957	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.414094925 CEST	443	49957	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.414122105 CEST	443	49957	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.415157080 CEST	49958	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.415191889 CEST	443	49958	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.415267944 CEST	49958	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.415378094 CEST	49958	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.415416956 CEST	443	49958	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.415445089 CEST	443	49958	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.416443110 CEST	49959	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.416471958 CEST	443	49959	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.416527033 CEST	49959	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.416623116 CEST	49959	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.416639090 CEST	443	49959	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.416656971 CEST	443	49959	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.417440891 CEST	49960	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.417473078 CEST	443	49960	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.417546034 CEST	49960	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.417642117 CEST	49960	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.417658091 CEST	443	49960	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.417699099 CEST	443	49960	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.418694973 CEST	49961	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.418729067 CEST	443	49961	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.418796062 CEST	49961	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.418899059 CEST	49961	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.418912888 CEST	443	49961	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.418931007 CEST	443	49961	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.419604063 CEST	49962	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.419617891 CEST	443	49962	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.419677973 CEST	49962	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.419800043 CEST	49962	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.419811010 CEST	443	49962	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.419830084 CEST	443	49962	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.420665979 CEST	49963	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.420676947 CEST	443	49963	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.420742035 CEST	49963	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.420881033 CEST	49963	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.420895100 CEST	443	49963	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.420917034 CEST	443	49963	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.421510935 CEST	49964	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.421561003 CEST	443	49964	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.421637058 CEST	49964	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.421747923 CEST	49964	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.421770096 CEST	443	49964	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.421791077 CEST	443	49964	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.422708035 CEST	49965	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.422741890 CEST	443	49965	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.422797918 CEST	49965	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.422910929 CEST	49965	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.422924995 CEST	443	49965	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.422941923 CEST	443	49965	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.423625946 CEST	49966	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.423645973 CEST	443	49966	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.423706055 CEST	49966	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.423774958 CEST	49966	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.423787117 CEST	443	49966	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.423803091 CEST	443	49966	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.424773932 CEST	49967	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.424808025 CEST	443	49967	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.424870014 CEST	49967	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.424949884 CEST	49967	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.424969912 CEST	443	49967	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.424990892 CEST	443	49967	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.425631046 CEST	49968	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.425652027 CEST	443	49968	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.425735950 CEST	49968	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.425827980 CEST	49968	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.425853014 CEST	443	49968	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.425875902 CEST	443	49968	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.426745892 CEST	49969	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.426776886 CEST	443	49969	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.426845074 CEST	49969	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.426996946 CEST	49969	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.427011967 CEST	443	49969	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.427030087 CEST	443	49969	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.427596092 CEST	49970	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.427617073 CEST	443	49970	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.427683115 CEST	49970	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.427797079 CEST	49970	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.427809954 CEST	443	49970	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.427828074 CEST	443	49970	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.428695917 CEST	49971	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.428715944 CEST	443	49971	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.428822041 CEST	49971	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.428900003 CEST	49971	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.428920031 CEST	443	49971	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.428939104 CEST	443	49971	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.429574013 CEST	49972	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.429606915 CEST	443	49972	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.429666996 CEST	49972	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.429742098 CEST	49972	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.429758072 CEST	443	49972	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.429773092 CEST	443	49972	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.430732012 CEST	49973	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.430751085 CEST	443	49973	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.430898905 CEST	49973	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.430898905 CEST	49973	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.430921078 CEST	443	49973	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.430941105 CEST	443	49973	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.431628942 CEST	49974	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.431643963 CEST	443	49974	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.431709051 CEST	49974	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.431911945 CEST	49974	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.431926012 CEST	443	49974	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.431942940 CEST	443	49974	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.432769060 CEST	49975	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.432796955 CEST	443	49975	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.432857990 CEST	49975	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.432991982 CEST	49975	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.433010101 CEST	443	49975	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.433032036 CEST	443	49975	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.433638096 CEST	49976	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.433667898 CEST	443	49976	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.433720112 CEST	49976	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.433825970 CEST	49976	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.433835030 CEST	443	49976	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.433856010 CEST	443	49976	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.434750080 CEST	49977	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.434782028 CEST	443	49977	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.434847116 CEST	49977	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.434968948 CEST	49977	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.434983969 CEST	443	49977	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.435007095 CEST	443	49977	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.435666084 CEST	49978	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.435681105 CEST	443	49978	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.435748100 CEST	49978	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.435826063 CEST	49978	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.435839891 CEST	443	49978	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.435857058 CEST	443	49978	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.436885118 CEST	49979	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.436893940 CEST	443	49979	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.436943054 CEST	49979	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.437038898 CEST	49979	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.437045097 CEST	443	49979	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.437057018 CEST	443	49979	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.437781096 CEST	49980	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.437824965 CEST	443	49980	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.437880039 CEST	49980	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.437957048 CEST	49980	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.437968016 CEST	443	49980	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.437980890 CEST	443	49980	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.438900948 CEST	49981	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.438918114 CEST	443	49981	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.438978910 CEST	49981	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.439069033 CEST	49981	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.439081907 CEST	443	49981	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.439099073 CEST	443	49981	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.439778090 CEST	49982	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.439786911 CEST	443	49982	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.439856052 CEST	49982	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.439982891 CEST	49982	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.439996004 CEST	443	49982	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.440017939 CEST	443	49982	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.440969944 CEST	49983	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.440989971 CEST	443	49983	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.441049099 CEST	49983	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.441128969 CEST	49983	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.441140890 CEST	443	49983	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.441155910 CEST	443	49983	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.441711903 CEST	49984	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.441720009 CEST	443	49984	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.441788912 CEST	49984	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.441855907 CEST	49984	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.441864967 CEST	443	49984	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.441881895 CEST	443	49984	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.442869902 CEST	49985	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.442910910 CEST	443	49985	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.442971945 CEST	49985	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.443101883 CEST	49985	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.443125010 CEST	443	49985	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.443147898 CEST	443	49985	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.443779945 CEST	49986	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.443804979 CEST	443	49986	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.443876982 CEST	49986	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.444020987 CEST	49986	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.444036961 CEST	443	49986	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.444053888 CEST	443	49986	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.445131063 CEST	49987	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.445167065 CEST	443	49987	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.445225000 CEST	49987	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.445339918 CEST	49987	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.445348024 CEST	443	49987	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.445369005 CEST	443	49987	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.446752071 CEST	49988	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.446769953 CEST	443	49988	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.446834087 CEST	49988	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.447041988 CEST	49988	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.447051048 CEST	443	49988	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.447069883 CEST	443	49988	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.448807955 CEST	49989	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.448838949 CEST	443	49989	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.448911905 CEST	49989	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.449027061 CEST	49989	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.449038982 CEST	443	49989	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.449059963 CEST	443	49989	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.449846983 CEST	49990	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.449858904 CEST	443	49990	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.449933052 CEST	49990	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.450067997 CEST	49990	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.450077057 CEST	443	49990	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.450093031 CEST	443	49990	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.451252937 CEST	49991	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.451272964 CEST	443	49991	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.451334000 CEST	49991	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.451461077 CEST	49991	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.451469898 CEST	443	49991	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.451483011 CEST	443	49991	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.452176094 CEST	49992	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.452212095 CEST	443	49992	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.452280045 CEST	49992	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.452388048 CEST	49992	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.452400923 CEST	443	49992	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.452420950 CEST	443	49992	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.453511000 CEST	49993	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.453552008 CEST	443	49993	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.453619003 CEST	49993	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.453768969 CEST	49993	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.453783035 CEST	443	49993	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.453802109 CEST	443	49993	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.454710960 CEST	49994	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.454736948 CEST	443	49994	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.454809904 CEST	49994	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.454946041 CEST	49994	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.454960108 CEST	443	49994	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.454973936 CEST	443	49994	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.456038952 CEST	49995	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.456058025 CEST	443	49995	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.456119061 CEST	49995	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.456244946 CEST	49995	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.456254959 CEST	443	49995	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.456270933 CEST	443	49995	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.457130909 CEST	49996	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.457168102 CEST	443	49996	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.457231045 CEST	49996	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.457353115 CEST	49996	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.457365036 CEST	443	49996	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.457381010 CEST	443	49996	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.459423065 CEST	49997	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.459443092 CEST	443	49997	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.459634066 CEST	49997	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.459634066 CEST	49997	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.459651947 CEST	443	49997	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.459685087 CEST	443	49997	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.462002039 CEST	49998	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.462019920 CEST	443	49998	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.462243080 CEST	49998	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.462434053 CEST	49998	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.462444067 CEST	443	49998	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.462460041 CEST	443	49998	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.464745998 CEST	49999	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.464757919 CEST	443	49999	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.464814901 CEST	49999	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.465198994 CEST	49999	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.465208054 CEST	443	49999	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.465229988 CEST	443	49999	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.466752052 CEST	50000	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.466789961 CEST	443	50000	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.466952085 CEST	50000	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.466952085 CEST	50000	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.466976881 CEST	443	50000	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.467010021 CEST	443	50000	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.469177961 CEST	50001	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.469208956 CEST	443	50001	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.469273090 CEST	50001	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.469403028 CEST	50001	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.469413042 CEST	443	50001	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.469430923 CEST	443	50001	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.471035957 CEST	50002	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.471044064 CEST	443	50002	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.471101046 CEST	50002	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.471199989 CEST	50002	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.471206903 CEST	443	50002	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.471221924 CEST	443	50002	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.473114014 CEST	50003	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.473139048 CEST	443	50003	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.473201990 CEST	50003	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.473519087 CEST	50003	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.473531008 CEST	443	50003	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.473551989 CEST	443	50003	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.474822998 CEST	50004	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.474864006 CEST	443	50004	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.474920988 CEST	50004	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.475183010 CEST	50004	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.475199938 CEST	443	50004	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.475224018 CEST	443	50004	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.476752996 CEST	50005	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.476778030 CEST	443	50005	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.476838112 CEST	50005	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.477638006 CEST	50005	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.477647066 CEST	443	50005	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.477665901 CEST	443	50005	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.478974104 CEST	50006	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.478986025 CEST	443	50006	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.479060888 CEST	50006	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.479352951 CEST	50006	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.479360104 CEST	443	50006	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.479374886 CEST	443	50006	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.480854034 CEST	50007	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.480885029 CEST	443	50007	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.480966091 CEST	50007	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.481147051 CEST	50007	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.481163025 CEST	443	50007	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.481184006 CEST	443	50007	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.483405113 CEST	50008	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.483426094 CEST	443	50008	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.483752012 CEST	50008	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.483752012 CEST	50008	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.483772993 CEST	443	50008	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.483809948 CEST	443	50008	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.485795975 CEST	50009	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.485806942 CEST	443	50009	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.485861063 CEST	50009	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.486072063 CEST	50009	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.486082077 CEST	443	50009	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.486100912 CEST	443	50009	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.487413883 CEST	50010	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.487422943 CEST	443	50010	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.487488985 CEST	50010	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.488598108 CEST	50010	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.488609076 CEST	443	50010	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.488627911 CEST	443	50010	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.503421068 CEST	50011	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.503453970 CEST	443	50011	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.503706932 CEST	50011	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.503706932 CEST	50011	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.503731012 CEST	443	50011	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.503789902 CEST	443	50011	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.504734993 CEST	50012	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.504767895 CEST	443	50012	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.504834890 CEST	50012	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.505023956 CEST	50012	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.505038023 CEST	443	50012	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.505053043 CEST	443	50012	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.506179094 CEST	50013	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.506217003 CEST	443	50013	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.506314039 CEST	50013	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.506479979 CEST	50013	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.506491899 CEST	443	50013	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.506508112 CEST	443	50013	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.507356882 CEST	50014	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.507365942 CEST	443	50014	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.507436991 CEST	50014	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.507580042 CEST	50014	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.507589102 CEST	443	50014	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.507603884 CEST	443	50014	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.508980989 CEST	50015	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.509011984 CEST	443	50015	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.509072065 CEST	50015	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.509202957 CEST	50015	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.509229898 CEST	443	50015	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.509244919 CEST	443	50015	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.510031939 CEST	50016	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.510059118 CEST	443	50016	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.510122061 CEST	50016	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.510272980 CEST	50016	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.510286093 CEST	443	50016	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.510299921 CEST	443	50016	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.511464119 CEST	50017	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.511472940 CEST	443	50017	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.511544943 CEST	50017	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.511667013 CEST	50017	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.511676073 CEST	443	50017	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.511693001 CEST	443	50017	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.512645006 CEST	50018	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.512651920 CEST	443	50018	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.512722969 CEST	50018	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.512895107 CEST	50018	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.512903929 CEST	443	50018	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.512919903 CEST	443	50018	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.514174938 CEST	50019	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.514206886 CEST	443	50019	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.514312983 CEST	50019	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.514533997 CEST	50019	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.514548063 CEST	443	50019	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.514563084 CEST	443	50019	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.515398026 CEST	50020	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.515429020 CEST	443	50020	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.515671968 CEST	50020	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.515671968 CEST	50020	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.515692949 CEST	443	50020	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.515719891 CEST	443	50020	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.517003059 CEST	50021	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.517035961 CEST	443	50021	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.517126083 CEST	50021	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.517240047 CEST	50021	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.517251968 CEST	443	50021	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.517268896 CEST	443	50021	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.518105030 CEST	50022	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.518111944 CEST	443	50022	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.518177986 CEST	50022	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.518301964 CEST	50022	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.518311024 CEST	443	50022	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.518331051 CEST	443	50022	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.519999027 CEST	50023	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.520018101 CEST	443	50023	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.520251989 CEST	50023	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.520251989 CEST	50023	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.520268917 CEST	443	50023	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.520292997 CEST	443	50023	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.521188974 CEST	50024	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.521230936 CEST	443	50024	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.521308899 CEST	50024	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.521451950 CEST	50024	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.521469116 CEST	443	50024	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.521486998 CEST	443	50024	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.522706032 CEST	50025	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.522727966 CEST	443	50025	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.522808075 CEST	50025	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.522950888 CEST	50025	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.522958994 CEST	443	50025	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.522974014 CEST	443	50025	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.523973942 CEST	50026	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.523983955 CEST	443	50026	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.524061918 CEST	50026	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.524251938 CEST	50026	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.524257898 CEST	443	50026	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.524271965 CEST	443	50026	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.525470972 CEST	50027	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.525501013 CEST	443	50027	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.525573015 CEST	50027	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.525693893 CEST	50027	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.525708914 CEST	443	50027	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.525727987 CEST	443	50027	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.526554108 CEST	50028	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.526586056 CEST	443	50028	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.526653051 CEST	50028	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.527190924 CEST	50028	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.527204990 CEST	443	50028	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.527223110 CEST	443	50028	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.529737949 CEST	50029	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.529763937 CEST	443	50029	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.529840946 CEST	50029	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.530092955 CEST	50029	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.530103922 CEST	443	50029	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.530118942 CEST	443	50029	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.531925917 CEST	50030	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.531940937 CEST	443	50030	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.532002926 CEST	50030	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.532396078 CEST	50030	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.532403946 CEST	443	50030	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.532417059 CEST	443	50030	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.534897089 CEST	50031	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.534909010 CEST	443	50031	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.534964085 CEST	50031	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.535290003 CEST	50031	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.535300970 CEST	443	50031	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.535317898 CEST	443	50031	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.537106991 CEST	50032	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.537118912 CEST	443	50032	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.537187099 CEST	50032	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.537301064 CEST	50032	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.537309885 CEST	443	50032	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.537328959 CEST	443	50032	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.539699078 CEST	50033	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.539726019 CEST	443	50033	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.539844036 CEST	50033	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.540143967 CEST	50033	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.540165901 CEST	443	50033	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.540179968 CEST	443	50033	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.541717052 CEST	50034	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.541749001 CEST	443	50034	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.541996002 CEST	50034	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.542206049 CEST	50034	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.542218924 CEST	443	50034	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.542234898 CEST	443	50034	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.544245958 CEST	50035	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.544260979 CEST	443	50035	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.544346094 CEST	50035	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.544627905 CEST	50035	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.544637918 CEST	443	50035	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.544653893 CEST	443	50035	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.546238899 CEST	50036	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.546267033 CEST	443	50036	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.546339989 CEST	50036	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.546550035 CEST	50036	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.546559095 CEST	443	50036	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.546575069 CEST	443	50036	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.548819065 CEST	50037	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.548851967 CEST	443	50037	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.548916101 CEST	50037	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.549197912 CEST	50037	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.549210072 CEST	443	50037	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.549226046 CEST	443	50037	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.550637007 CEST	50038	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.550658941 CEST	443	50038	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.550714970 CEST	50038	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.551135063 CEST	50038	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.551150084 CEST	443	50038	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.551166058 CEST	443	50038	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.553711891 CEST	50039	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.553728104 CEST	443	50039	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.553801060 CEST	50039	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.554116011 CEST	50039	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.554126024 CEST	443	50039	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.554143906 CEST	443	50039	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.555660009 CEST	50040	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.555685043 CEST	443	50040	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.555757999 CEST	50040	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.556090117 CEST	50040	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.556099892 CEST	443	50040	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.556113005 CEST	443	50040	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.558522940 CEST	50041	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.558552027 CEST	443	50041	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.558614016 CEST	50041	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.558995008 CEST	50041	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.559012890 CEST	443	50041	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.559030056 CEST	443	50041	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.561002970 CEST	50042	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.561012983 CEST	443	50042	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.561084032 CEST	50042	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.561414003 CEST	50042	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.561422110 CEST	443	50042	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.561436892 CEST	443	50042	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.563394070 CEST	50043	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.563405991 CEST	443	50043	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.563481092 CEST	50043	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.563791037 CEST	50043	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.563797951 CEST	443	50043	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.563811064 CEST	443	50043	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.565488100 CEST	50044	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.565506935 CEST	443	50044	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.565567970 CEST	50044	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.565788031 CEST	50044	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.565795898 CEST	443	50044	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.565810919 CEST	443	50044	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.567972898 CEST	50045	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.568005085 CEST	443	50045	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.568069935 CEST	50045	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.568248987 CEST	50045	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.568260908 CEST	443	50045	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.568276882 CEST	443	50045	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.569886923 CEST	50046	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.569895029 CEST	443	50046	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.569963932 CEST	50046	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.570194006 CEST	50046	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.570204020 CEST	443	50046	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.570224047 CEST	443	50046	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.572024107 CEST	50047	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.572036028 CEST	443	50047	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.572089911 CEST	50047	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.572453976 CEST	50047	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.572462082 CEST	443	50047	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.572474957 CEST	443	50047	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.574112892 CEST	50048	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.574143887 CEST	443	50048	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.574213982 CEST	50048	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.574528933 CEST	50048	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.574543953 CEST	443	50048	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.574559927 CEST	443	50048	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.576761961 CEST	50049	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.576783895 CEST	443	50049	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.576843977 CEST	50049	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.577033043 CEST	50049	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.577043056 CEST	443	50049	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.577059984 CEST	443	50049	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.578680038 CEST	50050	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.578687906 CEST	443	50050	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.578741074 CEST	50050	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.578989029 CEST	50050	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.578998089 CEST	443	50050	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.579015970 CEST	443	50050	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.581237078 CEST	50051	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.581265926 CEST	443	50051	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.581326962 CEST	50051	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.581546068 CEST	50051	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.581557035 CEST	443	50051	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.581572056 CEST	443	50051	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.582932949 CEST	50052	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.582964897 CEST	443	50052	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.583097935 CEST	50052	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.583405972 CEST	50052	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.583416939 CEST	443	50052	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.583432913 CEST	443	50052	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.585527897 CEST	50053	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.585544109 CEST	443	50053	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.585604906 CEST	50053	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.585900068 CEST	50053	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.585908890 CEST	443	50053	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.585927963 CEST	443	50053	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.587481022 CEST	50054	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.587488890 CEST	443	50054	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.587558985 CEST	50054	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.587794065 CEST	50054	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.587802887 CEST	443	50054	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.587819099 CEST	443	50054	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.589770079 CEST	50055	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.589793921 CEST	443	50055	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.589926958 CEST	50055	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.590071917 CEST	50055	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.590081930 CEST	443	50055	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.590109110 CEST	443	50055	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.596664906 CEST	50056	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.596694946 CEST	443	50056	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.596765041 CEST	50056	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.596937895 CEST	50056	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.596949100 CEST	443	50056	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.596970081 CEST	443	50056	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.598118067 CEST	50057	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.598133087 CEST	443	50057	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.598191023 CEST	50057	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.598319054 CEST	50057	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.598328114 CEST	443	50057	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.598360062 CEST	443	50057	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.599145889 CEST	50058	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.599153042 CEST	443	50058	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.599225998 CEST	50058	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.599363089 CEST	50058	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.599369049 CEST	443	50058	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.599381924 CEST	443	50058	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.600538969 CEST	50059	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.600558996 CEST	443	50059	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.600630045 CEST	50059	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.600771904 CEST	50059	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.600783110 CEST	443	50059	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.600800037 CEST	443	50059	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.601720095 CEST	50060	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.601741076 CEST	443	50060	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.601855040 CEST	50060	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.602133989 CEST	50060	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.602144957 CEST	443	50060	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.602161884 CEST	443	50060	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.612253904 CEST	50061	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.612291098 CEST	443	50061	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.612348080 CEST	50061	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.612426043 CEST	50061	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.612433910 CEST	443	50061	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.612493992 CEST	443	50061	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.613307953 CEST	50062	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.613321066 CEST	443	50062	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.613378048 CEST	50062	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.613604069 CEST	50062	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.613615036 CEST	443	50062	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.613632917 CEST	443	50062	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.614845037 CEST	50063	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.614861012 CEST	443	50063	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.614913940 CEST	50063	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.615061998 CEST	50063	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.615075111 CEST	443	50063	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.615099907 CEST	443	50063	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.615911007 CEST	50064	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.615921974 CEST	443	50064	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.615971088 CEST	50064	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.616118908 CEST	50064	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.616132975 CEST	443	50064	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.616156101 CEST	443	50064	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.618587017 CEST	50065	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.618618011 CEST	443	50065	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.618695021 CEST	50065	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.618923903 CEST	50065	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.618947983 CEST	443	50065	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.618966103 CEST	443	50065	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.620187998 CEST	50066	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.620204926 CEST	443	50066	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.620309114 CEST	50066	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.620496035 CEST	50066	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.620507956 CEST	443	50066	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.620527029 CEST	443	50066	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.621927023 CEST	50067	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.621936083 CEST	443	50067	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.622009993 CEST	50067	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.622253895 CEST	50067	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.622267962 CEST	443	50067	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.622287989 CEST	443	50067	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.623239040 CEST	50068	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.623343945 CEST	443	50068	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.623414993 CEST	50068	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.623487949 CEST	50068	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.623521090 CEST	443	50068	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.623552084 CEST	443	50068	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.624726057 CEST	50069	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.624763966 CEST	443	50069	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.624815941 CEST	50069	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.624891996 CEST	50069	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.624906063 CEST	443	50069	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.624923944 CEST	443	50069	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.625740051 CEST	50070	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.625752926 CEST	443	50070	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.625798941 CEST	50070	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.625854015 CEST	50070	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.625864029 CEST	443	50070	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.625894070 CEST	443	50070	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.628160954 CEST	50071	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.628184080 CEST	443	50071	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.628251076 CEST	50071	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.628324032 CEST	50071	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.628350019 CEST	443	50071	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.628376961 CEST	443	50071	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.629249096 CEST	50072	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.629277945 CEST	443	50072	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.629332066 CEST	50072	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.629872084 CEST	50072	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.629884958 CEST	443	50072	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.629903078 CEST	443	50072	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.638020039 CEST	50073	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.638027906 CEST	443	50073	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.638083935 CEST	50073	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.638279915 CEST	50073	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.638290882 CEST	443	50073	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.638314962 CEST	443	50073	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.640526056 CEST	50074	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.640532017 CEST	443	50074	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.640587091 CEST	50074	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.640815020 CEST	50074	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.640825033 CEST	443	50074	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.640846014 CEST	443	50074	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.641868114 CEST	50075	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.641899109 CEST	443	50075	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.641942978 CEST	50075	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.642028093 CEST	50075	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.642039061 CEST	443	50075	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.642055988 CEST	443	50075	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.645010948 CEST	50076	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.645045042 CEST	443	50076	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.645090103 CEST	50076	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.645168066 CEST	50076	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.645178080 CEST	443	50076	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.645195007 CEST	443	50076	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.645885944 CEST	50077	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.645909071 CEST	443	50077	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.645967960 CEST	50077	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.646050930 CEST	50077	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.646064997 CEST	443	50077	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.646083117 CEST	443	50077	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.646528006 CEST	50078	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.646538973 CEST	443	50078	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.646603107 CEST	50078	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.646661997 CEST	50078	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.646675110 CEST	443	50078	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.646692991 CEST	443	50078	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.647349119 CEST	50079	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.647357941 CEST	443	50079	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.647419930 CEST	50079	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.647484064 CEST	50079	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.647492886 CEST	443	50079	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.647507906 CEST	443	50079	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.647967100 CEST	50080	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.647974014 CEST	443	50080	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.648027897 CEST	50080	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.648092031 CEST	50080	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.648099899 CEST	443	50080	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.648114920 CEST	443	50080	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.648865938 CEST	50081	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.648880005 CEST	443	50081	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.648947001 CEST	50081	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.649056911 CEST	50081	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.649070024 CEST	443	50081	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.649091959 CEST	443	50081	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.650286913 CEST	50082	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.650298119 CEST	443	50082	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.650350094 CEST	50082	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.650566101 CEST	50082	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.650578022 CEST	443	50082	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.650599957 CEST	443	50082	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.651851892 CEST	50083	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.651864052 CEST	443	50083	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.651906013 CEST	50083	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.652112007 CEST	50083	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.652121067 CEST	443	50083	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.652137995 CEST	443	50083	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.653072119 CEST	50084	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.653100967 CEST	443	50084	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.653148890 CEST	50084	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.653213978 CEST	50084	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.653225899 CEST	443	50084	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.653242111 CEST	443	50084	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.654472113 CEST	50085	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.654480934 CEST	443	50085	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.654534101 CEST	50085	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.654620886 CEST	50085	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.654632092 CEST	443	50085	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.654652119 CEST	443	50085	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.655797958 CEST	50086	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.655805111 CEST	443	50086	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.655855894 CEST	50086	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.655963898 CEST	50086	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.655977964 CEST	443	50086	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.655997038 CEST	443	50086	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.657953978 CEST	50087	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.657977104 CEST	443	50087	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.658030033 CEST	50087	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.658211946 CEST	50087	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.658224106 CEST	443	50087	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.658238888 CEST	443	50087	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.659351110 CEST	50088	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.659440041 CEST	443	50088	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.659522057 CEST	50088	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.659590006 CEST	50088	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.659622908 CEST	443	50088	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.659651041 CEST	443	50088	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.660945892 CEST	50089	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.660979986 CEST	443	50089	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.661037922 CEST	50089	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.661258936 CEST	50089	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.661276102 CEST	443	50089	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.661292076 CEST	443	50089	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.662281990 CEST	50090	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.662322998 CEST	443	50090	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.662379980 CEST	50090	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.662693977 CEST	50090	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.662712097 CEST	443	50090	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.662729025 CEST	443	50090	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.663877010 CEST	50091	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.663899899 CEST	443	50091	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.663968086 CEST	50091	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.664184093 CEST	50091	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.664210081 CEST	443	50091	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.664236069 CEST	443	50091	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.665395975 CEST	50092	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.665405035 CEST	443	50092	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.665458918 CEST	50092	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.665599108 CEST	50092	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.665611029 CEST	443	50092	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.665632963 CEST	443	50092	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.667212963 CEST	50093	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.667234898 CEST	443	50093	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.667299032 CEST	50093	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.667889118 CEST	50093	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.667907000 CEST	443	50093	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.667923927 CEST	443	50093	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.669037104 CEST	50094	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.669061899 CEST	443	50094	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.669193029 CEST	50094	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.669352055 CEST	50094	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.669363022 CEST	443	50094	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.669378996 CEST	443	50094	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.670171976 CEST	50095	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.670188904 CEST	443	50095	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.670253992 CEST	50095	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.670360088 CEST	50095	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.670372009 CEST	443	50095	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.670392036 CEST	443	50095	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.671348095 CEST	50096	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.671355963 CEST	443	50096	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.671406031 CEST	50096	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.671468019 CEST	50096	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.671479940 CEST	443	50096	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.671499968 CEST	443	50096	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.672708988 CEST	50097	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.672730923 CEST	443	50097	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.672779083 CEST	50097	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.672846079 CEST	50097	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.672857046 CEST	443	50097	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.672873020 CEST	443	50097	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.673762083 CEST	50098	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.673773050 CEST	443	50098	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.673823118 CEST	50098	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.673896074 CEST	50098	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.673902035 CEST	443	50098	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.673918962 CEST	443	50098	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.675244093 CEST	50099	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.675259113 CEST	443	50099	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.675323009 CEST	50099	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.675640106 CEST	50099	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.675648928 CEST	443	50099	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.675668955 CEST	443	50099	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.676892996 CEST	50100	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.676920891 CEST	443	50100	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.676973104 CEST	50100	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.677041054 CEST	50100	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.677052021 CEST	443	50100	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.677067995 CEST	443	50100	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.678119898 CEST	50101	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.678138971 CEST	443	50101	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.678177118 CEST	50101	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.678366899 CEST	50101	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.678375006 CEST	443	50101	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.678385973 CEST	443	50101	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.679295063 CEST	50102	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.679301977 CEST	443	50102	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.679341078 CEST	50102	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.679408073 CEST	50102	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.679414034 CEST	443	50102	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.679426908 CEST	443	50102	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.680555105 CEST	50103	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.680562973 CEST	443	50103	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.680602074 CEST	50103	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.680663109 CEST	50103	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.680670977 CEST	443	50103	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.680686951 CEST	443	50103	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.681608915 CEST	50104	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.681641102 CEST	443	50104	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.681802034 CEST	50104	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.681802034 CEST	50104	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.681818962 CEST	443	50104	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.681843042 CEST	443	50104	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.683020115 CEST	50105	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.683027029 CEST	443	50105	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.683074951 CEST	50105	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.683459997 CEST	50105	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.683469057 CEST	443	50105	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.683487892 CEST	443	50105	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.684401989 CEST	50106	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.684408903 CEST	443	50106	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.684452057 CEST	50106	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.684519053 CEST	50106	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.684526920 CEST	443	50106	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.684540987 CEST	443	50106	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.685971022 CEST	50107	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.686009884 CEST	443	50107	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.686150074 CEST	50107	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.686265945 CEST	50107	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.686275005 CEST	443	50107	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.686286926 CEST	443	50107	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.687076092 CEST	50108	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.687103033 CEST	443	50108	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.687145948 CEST	50108	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.687243938 CEST	50108	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.687254906 CEST	443	50108	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.687271118 CEST	443	50108	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.688467979 CEST	50109	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.688481092 CEST	443	50109	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.688524008 CEST	50109	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.688750029 CEST	50109	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.688760042 CEST	443	50109	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.688775063 CEST	443	50109	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.689518929 CEST	50110	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.689531088 CEST	443	50110	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.689569950 CEST	50110	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.689836025 CEST	50110	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.689845085 CEST	443	50110	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.689863920 CEST	443	50110	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.691134930 CEST	50111	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.691154957 CEST	443	50111	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.691199064 CEST	50111	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.691313982 CEST	50111	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.691323996 CEST	443	50111	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.691339016 CEST	443	50111	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.692056894 CEST	50112	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.692085981 CEST	443	50112	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.692303896 CEST	50112	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.692303896 CEST	50112	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.692322016 CEST	443	50112	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.692342997 CEST	443	50112	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.693607092 CEST	50113	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.693617105 CEST	443	50113	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.693669081 CEST	50113	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.694329023 CEST	50113	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.694340944 CEST	443	50113	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.694356918 CEST	443	50113	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.695337057 CEST	50114	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.695343971 CEST	443	50114	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.695394993 CEST	50114	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.695460081 CEST	50114	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.695467949 CEST	443	50114	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.695481062 CEST	443	50114	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.696734905 CEST	50115	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.696765900 CEST	443	50115	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.696904898 CEST	50115	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.697032928 CEST	50115	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.697042942 CEST	443	50115	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.697057009 CEST	443	50115	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.697866917 CEST	50116	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.697891951 CEST	443	50116	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.697942019 CEST	50116	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.698203087 CEST	50116	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.698220015 CEST	443	50116	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.698234081 CEST	443	50116	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.699480057 CEST	50117	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.699489117 CEST	443	50117	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.699534893 CEST	50117	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.699660063 CEST	50117	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.699670076 CEST	443	50117	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.699685097 CEST	443	50117	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.700494051 CEST	50118	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.700500965 CEST	443	50118	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.700541973 CEST	50118	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.700664043 CEST	50118	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.700671911 CEST	443	50118	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.700686932 CEST	443	50118	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.701867104 CEST	50119	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.701890945 CEST	443	50119	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.701936960 CEST	50119	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.702162027 CEST	50119	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.702172041 CEST	443	50119	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.702187061 CEST	443	50119	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.703128099 CEST	50120	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.703140974 CEST	443	50120	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.703191996 CEST	50120	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.703269958 CEST	50120	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.703278065 CEST	443	50120	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.703294039 CEST	443	50120	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.704375029 CEST	50121	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.704406023 CEST	443	50121	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.704463005 CEST	50121	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.704581976 CEST	50121	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.704592943 CEST	443	50121	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.704606056 CEST	443	50121	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.705210924 CEST	50122	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.705220938 CEST	443	50122	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.705285072 CEST	50122	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.705384016 CEST	50122	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.705390930 CEST	443	50122	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.705409050 CEST	443	50122	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.706218004 CEST	50123	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.706226110 CEST	443	50123	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.706302881 CEST	50123	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.706453085 CEST	50123	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.706461906 CEST	443	50123	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.706478119 CEST	443	50123	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.706948042 CEST	50124	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.706957102 CEST	443	50124	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.707011938 CEST	50124	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.707125902 CEST	50124	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.707137108 CEST	443	50124	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.707153082 CEST	443	50124	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.707870960 CEST	50125	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.707891941 CEST	443	50125	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.707950115 CEST	50125	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.708039045 CEST	50125	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.708046913 CEST	443	50125	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.708060026 CEST	443	50125	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.708539009 CEST	50126	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.708547115 CEST	443	50126	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.708600044 CEST	50126	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.708720922 CEST	50126	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.708726883 CEST	443	50126	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.708738089 CEST	443	50126	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.709502935 CEST	50127	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.709511042 CEST	443	50127	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.709575891 CEST	50127	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.709686041 CEST	50127	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.709696054 CEST	443	50127	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.709711075 CEST	443	50127	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.710199118 CEST	50128	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.710206985 CEST	443	50128	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.710258961 CEST	50128	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.710370064 CEST	50128	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.710378885 CEST	443	50128	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.710393906 CEST	443	50128	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.711185932 CEST	50129	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.711231947 CEST	443	50129	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.711431980 CEST	50129	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.711529970 CEST	50129	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.711543083 CEST	443	50129	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.711559057 CEST	443	50129	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.712738991 CEST	50130	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.712763071 CEST	443	50130	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.712810040 CEST	50130	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.712979078 CEST	50130	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.712990046 CEST	443	50130	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.713005066 CEST	443	50130	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.714410067 CEST	50131	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.714417934 CEST	443	50131	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.714471102 CEST	50131	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.714534998 CEST	50131	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.714544058 CEST	443	50131	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.714557886 CEST	443	50131	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.715432882 CEST	50132	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.715440989 CEST	443	50132	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.715490103 CEST	50132	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.715596914 CEST	50132	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.715605974 CEST	443	50132	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.715620995 CEST	443	50132	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.716464996 CEST	50133	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.716500044 CEST	443	50133	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.716562986 CEST	50133	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.716669083 CEST	50133	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.716685057 CEST	443	50133	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.716696978 CEST	443	50133	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.717194080 CEST	50134	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.717212915 CEST	443	50134	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.717319012 CEST	50134	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.717674971 CEST	50134	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.717684984 CEST	443	50134	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.717698097 CEST	443	50134	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.718485117 CEST	50135	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.718492985 CEST	443	50135	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.718559980 CEST	50135	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.718651056 CEST	50135	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.718660116 CEST	443	50135	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.718673944 CEST	443	50135	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.719120979 CEST	50136	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.719130039 CEST	443	50136	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.719181061 CEST	50136	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.719264984 CEST	50136	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.719270945 CEST	443	50136	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.719281912 CEST	443	50136	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.719971895 CEST	50137	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.719978094 CEST	443	50137	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.720031977 CEST	50137	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.720149994 CEST	50137	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.720160007 CEST	443	50137	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.720174074 CEST	443	50137	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.720628977 CEST	50138	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.720635891 CEST	443	50138	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.720689058 CEST	50138	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.720777035 CEST	50138	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.720787048 CEST	443	50138	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.720799923 CEST	443	50138	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.721482038 CEST	50139	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.721489906 CEST	443	50139	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.721537113 CEST	50139	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.721653938 CEST	50139	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.721658945 CEST	443	50139	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.721669912 CEST	443	50139	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.722107887 CEST	50140	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.722130060 CEST	443	50140	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.722182035 CEST	50140	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.722297907 CEST	50140	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.722306967 CEST	443	50140	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.722318888 CEST	443	50140	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.723007917 CEST	50141	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.723015070 CEST	443	50141	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.723078012 CEST	50141	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.723167896 CEST	50141	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.723176003 CEST	443	50141	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.723189116 CEST	443	50141	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.723609924 CEST	50142	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.723618031 CEST	443	50142	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.723665953 CEST	50142	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.723776102 CEST	50142	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.723787069 CEST	443	50142	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.723800898 CEST	443	50142	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.724519968 CEST	50143	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.724530935 CEST	443	50143	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.724594116 CEST	50143	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.724684000 CEST	50143	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.724690914 CEST	443	50143	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.724703074 CEST	443	50143	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.725157976 CEST	50144	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.725164890 CEST	443	50144	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.725217104 CEST	50144	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.725322008 CEST	50144	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.725327969 CEST	443	50144	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.725338936 CEST	443	50144	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.726006031 CEST	50145	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.726012945 CEST	443	50145	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.726069927 CEST	50145	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.726164103 CEST	50145	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.726171970 CEST	443	50145	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.726185083 CEST	443	50145	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.726610899 CEST	50146	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.726618052 CEST	443	50146	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.726665974 CEST	50146	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.726777077 CEST	50146	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.726785898 CEST	443	50146	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.726799965 CEST	443	50146	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.728260994 CEST	50147	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.728275061 CEST	443	50147	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.728331089 CEST	50147	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.728506088 CEST	50147	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.728513956 CEST	443	50147	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.728530884 CEST	443	50147	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.729325056 CEST	50148	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.729336977 CEST	443	50148	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.729381084 CEST	50148	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.729547024 CEST	50148	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.729552984 CEST	443	50148	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.729566097 CEST	443	50148	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.730700970 CEST	50149	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.730707884 CEST	443	50149	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.730751038 CEST	50149	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.730822086 CEST	50149	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.730830908 CEST	443	50149	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.730845928 CEST	443	50149	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.731869936 CEST	50150	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.731875896 CEST	443	50150	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.731925964 CEST	50150	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.732173920 CEST	50150	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.732182026 CEST	443	50150	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.732197046 CEST	443	50150	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.733387947 CEST	50151	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.733397961 CEST	443	50151	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.733434916 CEST	50151	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.733560085 CEST	50151	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.733566046 CEST	443	50151	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.733577013 CEST	443	50151	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.734417915 CEST	50152	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.734426022 CEST	443	50152	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.734469891 CEST	50152	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.734571934 CEST	50152	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.734580994 CEST	443	50152	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.734595060 CEST	443	50152	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.735968113 CEST	50153	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.736002922 CEST	443	50153	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.736113071 CEST	50153	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.736259937 CEST	50153	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.736269951 CEST	443	50153	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.736283064 CEST	443	50153	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.737108946 CEST	50154	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.737137079 CEST	443	50154	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.737323999 CEST	50154	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.737323999 CEST	50154	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.737344027 CEST	443	50154	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.737365961 CEST	443	50154	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.738327980 CEST	50155	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.738334894 CEST	443	50155	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.738387108 CEST	50155	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.738467932 CEST	50155	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.738476038 CEST	443	50155	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.738490105 CEST	443	50155	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.739403963 CEST	50156	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.739412069 CEST	443	50156	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.739453077 CEST	50156	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.739521027 CEST	50156	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.739531994 CEST	443	50156	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.739547014 CEST	443	50156	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.740668058 CEST	50157	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.740700006 CEST	443	50157	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.740747929 CEST	50157	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.740870953 CEST	50157	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.740881920 CEST	443	50157	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.740895033 CEST	443	50157	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.741812944 CEST	50158	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.741838932 CEST	443	50158	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.741903067 CEST	50158	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.742050886 CEST	50158	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.742064953 CEST	443	50158	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.742079973 CEST	443	50158	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.743330956 CEST	50159	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.743338108 CEST	443	50159	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.743396044 CEST	50159	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.743505955 CEST	50159	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.743515968 CEST	443	50159	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.743621111 CEST	443	50159	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.744472980 CEST	50160	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.744481087 CEST	443	50160	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.744529009 CEST	50160	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.744676113 CEST	50160	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.744688034 CEST	443	50160	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.744736910 CEST	443	50160	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.745718956 CEST	50161	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.745728016 CEST	443	50161	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.745774984 CEST	50161	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.745892048 CEST	50161	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.745903015 CEST	443	50161	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.745949030 CEST	443	50161	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.746687889 CEST	50162	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.746697903 CEST	443	50162	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.746756077 CEST	50162	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.746941090 CEST	50162	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.746948957 CEST	443	50162	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.746988058 CEST	443	50162	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.748245001 CEST	50163	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.748253107 CEST	443	50163	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.748303890 CEST	50163	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.748450994 CEST	50163	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.748461962 CEST	443	50163	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.748503923 CEST	443	50163	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.749258995 CEST	50164	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.749269009 CEST	443	50164	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.749322891 CEST	50164	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.749391079 CEST	50164	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.749402046 CEST	443	50164	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.749445915 CEST	443	50164	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.750525951 CEST	50165	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.750550032 CEST	443	50165	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.750600100 CEST	50165	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.750709057 CEST	50165	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.750720024 CEST	443	50165	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.750761032 CEST	443	50165	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.751327038 CEST	50166	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.751334906 CEST	443	50166	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.751409054 CEST	50166	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.751497030 CEST	50166	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.751507044 CEST	443	50166	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.751545906 CEST	443	50166	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.752281904 CEST	50167	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.752290010 CEST	443	50167	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.752345085 CEST	50167	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.752435923 CEST	50167	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.752446890 CEST	443	50167	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.752486944 CEST	443	50167	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.752949953 CEST	50168	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.752989054 CEST	443	50168	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.753043890 CEST	50168	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.753159046 CEST	50168	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.753175020 CEST	443	50168	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.753211975 CEST	443	50168	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.753923893 CEST	50169	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.753932953 CEST	443	50169	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.753990889 CEST	50169	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.754097939 CEST	50169	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.754110098 CEST	443	50169	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.754154921 CEST	443	50169	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.754600048 CEST	50170	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.754606962 CEST	443	50170	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.754657984 CEST	50170	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.754774094 CEST	50170	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.754785061 CEST	443	50170	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.754827023 CEST	443	50170	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.755537033 CEST	50171	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.755567074 CEST	443	50171	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.755629063 CEST	50171	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.755727053 CEST	50171	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.755739927 CEST	443	50171	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.755791903 CEST	443	50171	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.756241083 CEST	50172	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.756264925 CEST	443	50172	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.756345987 CEST	50172	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.756568909 CEST	50172	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.756577969 CEST	443	50172	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.756620884 CEST	443	50172	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.757318020 CEST	50173	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.757328033 CEST	443	50173	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.757389069 CEST	50173	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.757519960 CEST	50173	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.757529020 CEST	443	50173	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.757591963 CEST	443	50173	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.758057117 CEST	50174	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.758063078 CEST	443	50174	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.758121967 CEST	50174	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.758302927 CEST	50174	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.758311987 CEST	443	50174	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.758753061 CEST	443	50174	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.759589911 CEST	50175	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.759680033 CEST	443	50175	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.759923935 CEST	50175	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.759923935 CEST	50175	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.759948015 CEST	443	50175	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.760284901 CEST	443	50175	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.761219025 CEST	50176	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.761229038 CEST	443	50176	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.761290073 CEST	50176	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.761418104 CEST	50176	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.761425972 CEST	443	50176	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.761465073 CEST	443	50176	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.762465954 CEST	50177	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.762490988 CEST	443	50177	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.762554884 CEST	50177	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.762640953 CEST	50177	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.762650013 CEST	443	50177	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.762664080 CEST	443	50177	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.763519049 CEST	50178	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.763530970 CEST	443	50178	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.763586998 CEST	50178	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.763727903 CEST	50178	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.763735056 CEST	443	50178	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.763747931 CEST	443	50178	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.764880896 CEST	50179	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.764900923 CEST	443	50179	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.764960051 CEST	50179	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.765062094 CEST	50179	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.765072107 CEST	443	50179	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.765089989 CEST	443	50179	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.765933990 CEST	50180	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.765958071 CEST	443	50180	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.766014099 CEST	50180	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.766110897 CEST	50180	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.766122103 CEST	443	50180	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.766139030 CEST	443	50180	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.767055035 CEST	50181	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.767072916 CEST	443	50181	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.767127037 CEST	50181	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.767313004 CEST	50181	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.767321110 CEST	443	50181	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.767334938 CEST	443	50181	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.768028021 CEST	50182	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.768038034 CEST	443	50182	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.768090010 CEST	50182	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.768187046 CEST	50182	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.768193960 CEST	443	50182	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.768208027 CEST	443	50182	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.769268036 CEST	50183	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.769284010 CEST	443	50183	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.769334078 CEST	50183	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.769505024 CEST	50183	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.769515991 CEST	443	50183	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.769530058 CEST	443	50183	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.770389080 CEST	50184	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.770414114 CEST	443	50184	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.770467043 CEST	50184	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.770910025 CEST	50184	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.770920992 CEST	443	50184	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.770936966 CEST	443	50184	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.772037983 CEST	50185	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.772062063 CEST	443	50185	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.772121906 CEST	50185	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.772195101 CEST	50185	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.772207022 CEST	443	50185	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.772222996 CEST	443	50185	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.772936106 CEST	50186	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.772948027 CEST	443	50186	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.772999048 CEST	50186	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.773185968 CEST	50186	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.773195982 CEST	443	50186	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.773211002 CEST	443	50186	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.774189949 CEST	50187	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.774210930 CEST	443	50187	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.774370909 CEST	50187	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.774805069 CEST	50187	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.774813890 CEST	443	50187	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.774827003 CEST	443	50187	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.775402069 CEST	50188	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.775430918 CEST	443	50188	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.775497913 CEST	50188	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.775614977 CEST	50188	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.775629044 CEST	443	50188	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.775641918 CEST	443	50188	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.776525021 CEST	50189	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.776535034 CEST	443	50189	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.776601076 CEST	50189	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.776779890 CEST	50189	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.776788950 CEST	443	50189	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.776807070 CEST	443	50189	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.777412891 CEST	50190	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.777420998 CEST	443	50190	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.777479887 CEST	50190	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.777550936 CEST	50190	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.777560949 CEST	443	50190	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.777575970 CEST	443	50190	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.778532982 CEST	50191	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.778564930 CEST	443	50191	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.778630018 CEST	50191	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.778697014 CEST	50191	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.778709888 CEST	443	50191	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.778723955 CEST	443	50191	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.779398918 CEST	50192	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.779407978 CEST	443	50192	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.779473066 CEST	50192	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.779637098 CEST	50192	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.779643059 CEST	443	50192	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.779654980 CEST	443	50192	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.780509949 CEST	50193	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.780531883 CEST	443	50193	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.780592918 CEST	50193	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.780699015 CEST	50193	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.780710936 CEST	443	50193	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.780725956 CEST	443	50193	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.781289101 CEST	50194	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.781296968 CEST	443	50194	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.781356096 CEST	50194	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.781472921 CEST	50194	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.781481028 CEST	443	50194	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.781493902 CEST	443	50194	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.782257080 CEST	50195	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.782263041 CEST	443	50195	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.782306910 CEST	50195	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.782397032 CEST	50195	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.782402039 CEST	443	50195	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.782413006 CEST	443	50195	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.782953024 CEST	50196	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.782979012 CEST	443	50196	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.783041000 CEST	50196	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.783127069 CEST	50196	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.783138037 CEST	443	50196	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.783150911 CEST	443	50196	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.784024000 CEST	50197	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.784053087 CEST	443	50197	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.784132004 CEST	50197	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.784198999 CEST	50197	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.784208059 CEST	443	50197	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.784224987 CEST	443	50197	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.784813881 CEST	50198	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.784821987 CEST	443	50198	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.784883022 CEST	50198	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.784959078 CEST	50198	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.784967899 CEST	443	50198	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.784984112 CEST	443	50198	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.786041021 CEST	50199	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.786060095 CEST	443	50199	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.786117077 CEST	50199	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.786226988 CEST	50199	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.786236048 CEST	443	50199	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.786248922 CEST	443	50199	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.786950111 CEST	50200	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.786957979 CEST	443	50200	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.787013054 CEST	50200	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.787141085 CEST	50200	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.787148952 CEST	443	50200	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.787163973 CEST	443	50200	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.788096905 CEST	50201	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.788127899 CEST	443	50201	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.788187027 CEST	50201	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.788264990 CEST	50201	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.788275957 CEST	443	50201	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.788289070 CEST	443	50201	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.789060116 CEST	50202	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.789083958 CEST	443	50202	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.789138079 CEST	50202	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.789275885 CEST	50202	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.789288044 CEST	443	50202	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.789300919 CEST	443	50202	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.791090012 CEST	50203	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.791096926 CEST	443	50203	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.791152954 CEST	50203	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.791265011 CEST	50203	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.791275978 CEST	443	50203	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.791290045 CEST	443	50203	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.792102098 CEST	50204	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.792125940 CEST	443	50204	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.792185068 CEST	50204	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.792299032 CEST	50204	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.792309046 CEST	443	50204	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.792323112 CEST	443	50204	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.793720961 CEST	50205	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.793745041 CEST	443	50205	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.793873072 CEST	50205	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.793942928 CEST	50205	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.793952942 CEST	443	50205	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.793967009 CEST	443	50205	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.794676065 CEST	50206	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.794699907 CEST	443	50206	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.794790983 CEST	50206	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.794972897 CEST	50206	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.794981956 CEST	443	50206	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.794996977 CEST	443	50206	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.795918941 CEST	50207	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.795926094 CEST	443	50207	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.795980930 CEST	50207	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.796071053 CEST	50207	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.796080112 CEST	443	50207	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.796096087 CEST	443	50207	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.796672106 CEST	50208	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.796679020 CEST	443	50208	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.796740055 CEST	50208	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.796808958 CEST	50208	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.796817064 CEST	443	50208	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.796830893 CEST	443	50208	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.797693968 CEST	50209	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.797719955 CEST	443	50209	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.797791004 CEST	50209	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.797995090 CEST	50209	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.798002958 CEST	443	50209	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.798017025 CEST	443	50209	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.798671007 CEST	50210	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.798691034 CEST	443	50210	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.798820019 CEST	50210	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.798820019 CEST	50210	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.798836946 CEST	443	50210	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.798860073 CEST	443	50210	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.799747944 CEST	50211	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.799756050 CEST	443	50211	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.799818993 CEST	50211	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.799880028 CEST	50211	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.799889088 CEST	443	50211	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.799906969 CEST	443	50211	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.800606966 CEST	50212	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.800615072 CEST	443	50212	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.800677061 CEST	50212	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.800842047 CEST	50212	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.800851107 CEST	443	50212	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.800872087 CEST	443	50212	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.801750898 CEST	50213	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.801779032 CEST	443	50213	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.801857948 CEST	50213	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.801990032 CEST	50213	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.802002907 CEST	443	50213	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.802018881 CEST	443	50213	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.802597046 CEST	50214	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.802619934 CEST	443	50214	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.802670002 CEST	50214	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.802829027 CEST	50214	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.802840948 CEST	443	50214	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.802864075 CEST	443	50214	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.803703070 CEST	50215	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.803709984 CEST	443	50215	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.803767920 CEST	50215	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.803890944 CEST	50215	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.803900003 CEST	443	50215	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.803914070 CEST	443	50215	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.804660082 CEST	50216	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.804685116 CEST	443	50216	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.804728985 CEST	50216	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.804810047 CEST	50216	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.804820061 CEST	443	50216	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.804831028 CEST	443	50216	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.805689096 CEST	50217	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.805697918 CEST	443	50217	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.805756092 CEST	50217	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.805896044 CEST	50217	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.805903912 CEST	443	50217	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.805917025 CEST	443	50217	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.806550980 CEST	50218	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.806559086 CEST	443	50218	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.806602001 CEST	50218	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.806682110 CEST	50218	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.806690931 CEST	443	50218	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.806704044 CEST	443	50218	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.807709932 CEST	50219	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.807724953 CEST	443	50219	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.807771921 CEST	50219	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.807893038 CEST	50219	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.807900906 CEST	443	50219	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.807912111 CEST	443	50219	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.808533907 CEST	50220	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.808543921 CEST	443	50220	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.808589935 CEST	50220	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.808662891 CEST	50220	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.808667898 CEST	443	50220	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.808679104 CEST	443	50220	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.809564114 CEST	50221	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.809577942 CEST	443	50221	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.809684038 CEST	50221	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.809766054 CEST	50221	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.809773922 CEST	443	50221	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.809788942 CEST	443	50221	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.810462952 CEST	50222	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.810468912 CEST	443	50222	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.810523987 CEST	50222	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.810609102 CEST	50222	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.810617924 CEST	443	50222	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.810631990 CEST	443	50222	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.811528921 CEST	50223	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.811539888 CEST	443	50223	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.811594009 CEST	50223	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.811711073 CEST	50223	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.811717033 CEST	443	50223	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.811728954 CEST	443	50223	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.812400103 CEST	50224	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.812431097 CEST	443	50224	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.812488079 CEST	50224	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.812601089 CEST	50224	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.812614918 CEST	443	50224	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.812628031 CEST	443	50224	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.813667059 CEST	50225	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.813674927 CEST	443	50225	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.813724041 CEST	50225	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.813829899 CEST	50225	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.813839912 CEST	443	50225	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.813853979 CEST	443	50225	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.814610958 CEST	50226	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.814618111 CEST	443	50226	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.814667940 CEST	50226	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.814753056 CEST	50226	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.814762115 CEST	443	50226	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.814774990 CEST	443	50226	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.815733910 CEST	50227	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.815762043 CEST	443	50227	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.815821886 CEST	50227	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.815929890 CEST	50227	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.815942049 CEST	443	50227	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.815956116 CEST	443	50227	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.816597939 CEST	50228	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.816622972 CEST	443	50228	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.816729069 CEST	50228	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.816863060 CEST	50228	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.816870928 CEST	443	50228	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.816884041 CEST	443	50228	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.817936897 CEST	50229	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.817945957 CEST	443	50229	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.818003893 CEST	50229	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.818114042 CEST	50229	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.818123102 CEST	443	50229	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.818136930 CEST	443	50229	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.818823099 CEST	50230	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.818830967 CEST	443	50230	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.818886042 CEST	50230	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.818974972 CEST	50230	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.818983078 CEST	443	50230	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.818996906 CEST	443	50230	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.820004940 CEST	50231	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.820020914 CEST	443	50231	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.820147038 CEST	50231	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.820275068 CEST	50231	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.820285082 CEST	443	50231	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.820300102 CEST	443	50231	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.821425915 CEST	50232	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.821434021 CEST	443	50232	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.821480989 CEST	50232	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.821763992 CEST	50232	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.821774960 CEST	443	50232	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.821789026 CEST	443	50232	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.823901892 CEST	50233	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.823910952 CEST	443	50233	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.823957920 CEST	50233	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.824136019 CEST	50233	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.824142933 CEST	443	50233	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.824157953 CEST	443	50233	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.825205088 CEST	50234	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.825212002 CEST	443	50234	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.825272083 CEST	50234	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.825429916 CEST	50234	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.825438023 CEST	443	50234	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.825452089 CEST	443	50234	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.826698065 CEST	50235	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.826705933 CEST	443	50235	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.826769114 CEST	50235	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.826826096 CEST	50235	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.826834917 CEST	443	50235	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.826850891 CEST	443	50235	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.827672005 CEST	50236	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.827681065 CEST	443	50236	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.827733994 CEST	50236	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.828042030 CEST	50236	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.828052044 CEST	443	50236	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.828068972 CEST	443	50236	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.829929113 CEST	50237	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.829953909 CEST	443	50237	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.830010891 CEST	50237	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.830199957 CEST	50237	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.830210924 CEST	443	50237	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.830224037 CEST	443	50237	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.831350088 CEST	50238	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.831362009 CEST	443	50238	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.831420898 CEST	50238	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.832180023 CEST	50238	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.832191944 CEST	443	50238	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.832209110 CEST	443	50238	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.833919048 CEST	50239	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.833925962 CEST	443	50239	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.833971024 CEST	50239	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.834052086 CEST	50239	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.834059954 CEST	443	50239	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.834075928 CEST	443	50239	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.835319996 CEST	50240	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.835328102 CEST	443	50240	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.835371971 CEST	50240	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.835607052 CEST	50240	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.835619926 CEST	443	50240	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.835644007 CEST	443	50240	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.837465048 CEST	50241	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.837479115 CEST	443	50241	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.837537050 CEST	50241	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.837702036 CEST	50241	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.837711096 CEST	443	50241	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.837728024 CEST	443	50241	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.838555098 CEST	50242	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.838565111 CEST	443	50242	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.838613033 CEST	50242	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.838747025 CEST	50242	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.838754892 CEST	443	50242	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.838769913 CEST	443	50242	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.839921951 CEST	50243	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.839930058 CEST	443	50243	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.839982033 CEST	50243	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.840089083 CEST	50243	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.840101957 CEST	443	50243	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.840120077 CEST	443	50243	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.841073990 CEST	50244	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.841082096 CEST	443	50244	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.841129065 CEST	50244	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.841196060 CEST	50244	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.841207981 CEST	443	50244	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.841226101 CEST	443	50244	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.852413893 CEST	50245	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.852452040 CEST	443	50245	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.852519035 CEST	50245	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.852758884 CEST	50245	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.852772951 CEST	443	50245	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.852819920 CEST	443	50245	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.853513956 CEST	50246	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.853524923 CEST	443	50246	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.853590012 CEST	50246	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.853672981 CEST	50246	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.853681087 CEST	443	50246	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.853698015 CEST	443	50246	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.854857922 CEST	50247	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.854866982 CEST	443	50247	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.854917049 CEST	50247	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.855009079 CEST	50247	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.855020046 CEST	443	50247	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.855038881 CEST	443	50247	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.855799913 CEST	50248	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.855837107 CEST	443	50248	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.855896950 CEST	50248	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.855956078 CEST	50248	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.855973959 CEST	443	50248	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.855988979 CEST	443	50248	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.857141972 CEST	50249	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.857151031 CEST	443	50249	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.857207060 CEST	50249	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.857300997 CEST	50249	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.857311964 CEST	443	50249	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.857332945 CEST	443	50249	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.858290911 CEST	50250	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.858298063 CEST	443	50250	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.858345985 CEST	50250	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.858500004 CEST	50250	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.858510017 CEST	443	50250	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.858530045 CEST	443	50250	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.859755993 CEST	50251	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.859785080 CEST	443	50251	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.859832048 CEST	50251	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.859899044 CEST	50251	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.859913111 CEST	443	50251	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.859927893 CEST	443	50251	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.860887051 CEST	50252	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.860919952 CEST	443	50252	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.860970974 CEST	50252	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.861205101 CEST	50252	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.861223936 CEST	443	50252	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.861239910 CEST	443	50252	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.862188101 CEST	50253	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.862215996 CEST	443	50253	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.862262964 CEST	50253	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.862442017 CEST	50253	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.862457991 CEST	443	50253	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.862478018 CEST	443	50253	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.863533020 CEST	50254	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.863543987 CEST	443	50254	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.863589048 CEST	50254	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.863666058 CEST	50254	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.863677979 CEST	443	50254	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.863719940 CEST	443	50254	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.864927053 CEST	50255	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.864950895 CEST	443	50255	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.865045071 CEST	50255	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.865173101 CEST	50255	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.865185022 CEST	443	50255	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.865223885 CEST	443	50255	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.866641998 CEST	50256	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.866662025 CEST	443	50256	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.866708994 CEST	50256	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.867021084 CEST	50256	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.867033005 CEST	443	50256	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.867072105 CEST	443	50256	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.868880987 CEST	50257	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.868889093 CEST	443	50257	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.868933916 CEST	50257	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.869229078 CEST	50257	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.869240046 CEST	443	50257	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.869282961 CEST	443	50257	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.873794079 CEST	50258	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.873800993 CEST	443	50258	151.236.9.174	192.168.2.6
Sep 18, 2024 17:23:02.873842001 CEST	50258	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.875915051 CEST	50258	443	192.168.2.6	151.236.9.174
Sep 18, 2024 17:23:02.875926971 CEST	443	50258	151.236.9.174	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 18, 2024 17:23:02.080801964 CEST	192.168.2.6	1.1.1.1	0xab6f	Standard query (0)	outlook-web.ddns.net	A (IP address)	IN (0x0001)	false
Sep 18, 2024 17:24:02.327002048 CEST	192.168.2.6	1.1.1.1	0x5035	Standard query (0)	outlook-web.ddns.net	A (IP address)	IN (0x0001)	false
Sep 18, 2024 17:25:02.805036068 CEST	192.168.2.6	1.1.1.1	0xacc2	Standard query (0)	outlook-web.ddns.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 18, 2024 17:23:02.091738939 CEST	1.1.1.1	192.168.2.6	0xab6f	No error (0)	outlook-web.ddns.net	151.236.9.174	A (IP address)	IN (0x0001)	false
Sep 18, 2024 17:24:02.335551023 CEST	1.1.1.1	192.168.2.6	0x5035	No error (0)	outlook-web.ddns.net	151.236.9.174	A (IP address)	IN (0x0001)	false
Sep 18, 2024 17:25:02.813792944 CEST	1.1.1.1	192.168.2.6	0xacc2	No error (0)	outlook-web.ddns.net	151.236.9.174	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:22:55
Start date:	18/09/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\msws.msi"
Imagebase:	0x7ff7d38d0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	11:22:55
Start date:	18/09/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff7d38d0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:22:57
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding B12D13CACE43515F68A41F2B0DDB3F8C
Imagebase:	0x250000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	11:22:58
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\expand.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\expand.exe" -R files.cab -F:* files
Imagebase:	0xc0000
File size:	53'248 bytes
MD5 hash:	544B0DBFF3F393BCE8BB9D815F532D51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:22:58
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:22:59
Start date:	18/09/2024
Path:	C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe"
Imagebase:	0x2de00000
File size:	151'392 bytes
MD5 hash:	FC860959580C124E7E4781BB08437681
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ORPCBackdoor, Description: Yara detected ORPCBackdoor, Source: 00000006.00000002.3381013468.0000000000AFD000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	11:23:01
Start date:	18/09/2024
Path:	C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe
Imagebase:	0x2de00000
File size:	151'392 bytes
MD5 hash:	FC860959580C124E7E4781BB08437681
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:23:03
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 1008
Imagebase:	0x8a0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	2.6%
Signature Coverage:	48.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	22

Executed Functions

Function 6C8D4F22 Relevance: 169.2, APIs: 48, Strings: 47, Instructions: 2972
filesleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8,58160781928836700431202065781531683322301950835055,7B4BA14C,?,?,?,?,?,?,6C8E4DE0,6C9118B0,000000FE,?,6C8D7E9A), ref: 6C8D4F76
GetModuleFileNameA.KERNEL32(00000000,?,?,?), ref: 6C8D4FD2
CreateFileA.KERNELBASE(00000000,00000080,00000000,?,6C90438C,000000FF,?), ref: 6C8D508E
CloseHandle.KERNELBASE(?), ref: 6C8D50B4
Sleep.KERNELBASE(0000EA60), ref: 6C8D50BF

Part of subcall function 6C8DCB90: CoInitializeEx.COMBASE(00000000,00000000,?,74732E646174), ref: 6C8DCBA9

CreateFileA.KERNELBASE(00000000,?,?,?,80000000,00000000,00000000,00000001,00000080,00000000), ref: 6C8D5101
CloseHandle.KERNELBASE(?,?,?,?,80000000,00000000,00000000,00000001,00000080,00000000), ref: 6C8D511E
CloseHandle.KERNEL32(?), ref: 6C8D512C
GetUserNameA.ADVAPI32(?,?), ref: 6C8D515C
Sleep.KERNEL32(00000BB8,?), ref: 6C8D51BB
CreateFileA.KERNELBASE(00000000,00000080,00000000,?,?,?,00000000,?,?,?,?,?,?), ref: 6C8D5328
ReadFile.KERNEL32(?,?,0000000F,?,00000000,?,?,00000000,?,?,?,?,?,?), ref: 6C8D535D
CloseHandle.KERNELBASE(?), ref: 6C8D53B9
Sleep.KERNELBASE(?,?,?,?), ref: 6C8D5467
CreateFileA.KERNELBASE(00000000,00000080,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8D589E
RpcStringBindingComposeA.RPCRT4(00000000,?,?,?,00000000,?), ref: 6C8D5BBF
RpcBindingFromStringBindingA.RPCRT4(?,?), ref: 6C8D5BD8
_strcat.LIBCMT ref: 6C8D5C8F

Strings

4944, xrefs: 6C8D54E5
a, xrefs: 6C8D5A79
|-|, xrefs: 6C8D6872
|, xrefs: 6C8D5D31
52554E, xrefs: 6C8D56F9
5C6E5C6E205B50524F43455353204C4953545D205C6E, xrefs: 6C8D5234
<, xrefs: 6C8D75C2
_, xrefs: 6C8D5AA3
c, xrefs: 6C8D5A72
4552524F52, xrefs: 6C8D5619
4F4B, xrefs: 6C8D5687
----, xrefs: 6C8D7915
443, xrefs: 6C8D5A4B
d, xrefs: 6C8D6221
2463616368652E646174, xrefs: 6C8D53E2
494E46, xrefs: 6C8D551C
4552524F525245504C414345, xrefs: 6C8D56C1
444C59, xrefs: 6C8D5732
74732E646174, xrefs: 6C8D501E
>> , xrefs: 6C8D77B5
---------, xrefs: 6C8D527E
48415348, xrefs: 6C8D55B4
n, xrefs: 6C8D5A87
5645524946494544, xrefs: 6C8D564D
i, xrefs: 6C8D5A95
434D44, xrefs: 6C8D576B
433A5C5C50726F6772616D446174615C5C, xrefs: 6C8D4F7F
58160781928836700431202065781531683322301950835055, xrefs: 6C8D4F61
c, xrefs: 6C8D5AB1
4E4554455252, xrefs: 6C8D55E6
n, xrefs: 6C8D5A6B
d, xrefs: 6C8D7A6C
_, xrefs: 6C8D5A8E
53495A45, xrefs: 6C8D5582
633A5C5C50726F6772616D446174615C5C24746D702E747874, xrefs: 6C8D54AB
24746D702E747874, xrefs: 6C8D52B7
t, xrefs: 6C8D5AAA
p, xrefs: 6C8D5AB8
53595354454D20494E464F524D4154494F4E205C6E, xrefs: 6C8D51D3
636D642E657865202F6320, xrefs: 6C8D57A7
44574E, xrefs: 6C8D554F
p, xrefs: 6C8D5A9C
d, xrefs: 6C8D5CA2
7C2A3F2928257D5E267B, xrefs: 6C8D5470
outlook-web.ddns.net, xrefs: 6C8D5B8A
633A5C55736572735C5075626C69635C63722E646174, xrefs: 6C8D57E4
c, xrefs: 6C8D5A80

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: File$CloseCreateHandleSleep$Binding$NameString$ComposeFromInitializeModuleReadUser_strcat
String ID: ----$---------$2463616368652E646174$24746D702E747874$433A5C5C50726F6772616D446174615C5C$434D44$443$444C59$44574E$4552524F52$4552524F525245504C414345$48415348$4944$494E46$4E4554455252$4F4B$52554E$53495A45$53595354454D20494E464F524D4154494F4E205C6E$5645524946494544$58160781928836700431202065781531683322301950835055$5C6E5C6E205B50524F43455353204C4953545D205C6E$633A5C55736572735C5075626C69635C63722E646174$633A5C5C50726F6772616D446174615C5C24746D702E747874$636D642E657865202F6320$74732E646174$7C2A3F2928257D5E267B$<$>> $_$_$a$c$c$c$d$d$d$i$n$n$outlook-web.ddns.net$p$p$t$|$|-|
API String ID: 163969156-3700135009
Opcode ID: f91815ecfce99f776967d73470293dd5268675f18a1ed48f02e5e34f9808df4e
Instruction ID: 526b2a0a3c68c2dad3853101b2f59770ce03f1411d57ee0b4dcabdc85bdb5089
Opcode Fuzzy Hash: f91815ecfce99f776967d73470293dd5268675f18a1ed48f02e5e34f9808df4e
Instruction Fuzzy Hash: 9D431C72D1022D9ADB35DB64CD91EDEB378AF54208F4109F6A589A2590EFB0A7CCCF50

Function 6C8DEA93 Relevance: 155.5, APIs: 25, Strings: 63, Instructions: 1459
registryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 6C8DEAD0
GetSystemInfo.KERNELBASE(?), ref: 6C8DEB13
GetComputerNameW.KERNEL32(?,00000400), ref: 6C8DEB31
RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000101,?,6C904B84,00000000,?,?,?,?,?,?,?,6C8D51CF,?), ref: 6C8DEC11

Strings

Page File Location(s):, xrefs: 6C8E00FB
Std, xrefs: 6C8DFBE9
SystemPartition, xrefs: 6C8DF824
OS Build Type :, xrefs: 6C8DEE7A
HARDWARE\DESCRIPTION\System\BIOS, xrefs: 6C8DF6DD
Identifier, xrefs: 6C8DF514
Display, xrefs: 6C8DFC2C
BiosVersion:, xrefs: 6C8DF69A
Product ID:, xrefs: 6C8DF066
BIOSVENDOR, xrefs: 6C8DF6D8
MIME\Database\Rfc1766, xrefs: 6C8DF8F2
Manufacturer, xrefs: 6C8DF18F
Error! GetSystemDirectory failed., xrefs: 6C8DEADA
BIOSVENDOR:, xrefs: 6C8DF740
%s\oeminfo.ini, xrefs: 6C8DF163
ProductId, xrefs: 6C8DF000
Processor(s):, xrefs: 6C8DF464
MIME\Database\Rfc1766, xrefs: 6C8DFA4B
SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management, xrefs: 6C8E0020
ProductName, xrefs: 6C8DEC59
SYSTEM\Setup, xrefs: 6C8DF829
Virtual Memory: In Use:, xrefs: 6C8DFFDD
Install Date:, xrefs: 6C8DF11E
OS Version :, xrefs: 6C8DED6B
InstallDate, xrefs: 6C8DF09F
HARDWARE\DESCRIPTION\System, xrefs: 6C8DF783
Error! RegOpenKeyEx failed., xrefs: 6C8DEC1B
System Locale:, xrefs: 6C8DF9AF
[%02u]: , xrefs: 6C8DF4E0
Model, xrefs: 6C8DF23A
VendorIdentifier, xrefs: 6C8DF57F
OS Name:, xrefs: 6C8DECC6
Time zone:, xrefs: 6C8DFC97
System type:, xrefs: 6C8DF375
Error! GetComputerName failed., xrefs: 6C8DEB3B
To Be Filled By O.E.M., xrefs: 6C8DF235
General, xrefs: 6C8DF23F
PagingFiles, xrefs: 6C8E001B
RegisteredOwner, xrefs: 6C8DEEB8
System Manufacturer:, xrefs: 6C8DF1F0
Virtual Memory: Max Size:, xrefs: 6C8DFEA8
HARDWARE\DESCRIPTION\System\CentralProcessor\%u, xrefs: 6C8DF4C4
Keyboard Layout\Preload, xrefs: 6C8DFA08
RegisteredOrganization, xrefs: 6C8DEF5C
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones, xrefs: 6C8DFB6B
SystemBiosVersion, xrefs: 6C8DF632
To Be Filled By O.E.M., xrefs: 6C8DF18A
General, xrefs: 6C8DF194
Input Locale:, xrefs: 6C8DFB08
Boot Device:, xrefs: 6C8DF88C
Host Name:, xrefs: 6C8DEBA8
SystemBiosDate, xrefs: 6C8DF77E
System Model:, xrefs: 6C8DF29B
Registered Owner:, xrefs: 6C8DEF1E
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 6C8DEC07
Virtual Memory: Available:, xrefs: 6C8DFF3F
HARDWARE\DESCRIPTION\System, xrefs: 6C8DF637
RegisteredOrganization:, xrefs: 6C8DEFC2
Total Physical Memory:, xrefs: 6C8DFD7A
CurrentType, xrefs: 6C8DEE14
Domain:, xrefs: 6C8E01C6
Available Physical Memory:, xrefs: 6C8DFE11
BIOS Date:, xrefs: 6C8DF7E6

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: System$ComputerDirectoryInfoNameOpen
String ID: %s\oeminfo.ini$Available Physical Memory:$BIOS Date:$BIOSVENDOR$BIOSVENDOR:$BiosVersion:$Boot Device:$CurrentType$Display$Domain:$Error! GetComputerName failed.$Error! GetSystemDirectory failed.$Error! RegOpenKeyEx failed.$General$General$HARDWARE\DESCRIPTION\System$HARDWARE\DESCRIPTION\System$HARDWARE\DESCRIPTION\System\BIOS$HARDWARE\DESCRIPTION\System\CentralProcessor\%u$Host Name:$Identifier$Input Locale:$Install Date:$InstallDate$Keyboard Layout\Preload$MIME\Database\Rfc1766$MIME\Database\Rfc1766$Manufacturer$Model$OS Build Type :$OS Name:$OS Version :$Page File Location(s):$PagingFiles$Processor(s):$Product ID:$ProductId$ProductName$Registered Owner:$RegisteredOrganization$RegisteredOrganization:$RegisteredOwner$SOFTWARE\Microsoft\Windows NT\CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones$SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management$SYSTEM\Setup$Std$System Locale:$System Manufacturer:$System Model:$System type:$SystemBiosDate$SystemBiosVersion$SystemPartition$Time zone:$To Be Filled By O.E.M.$To Be Filled By O.E.M.$Total Physical Memory:$VendorIdentifier$Virtual Memory: Available:$Virtual Memory: In Use:$Virtual Memory: Max Size:$[%02u]:
API String ID: 1805411109-2676738833
Opcode ID: 8207bbe70c777b42c627f071c8324f61cd7c0e2dd274ba62e1336a57466bfe8b
Instruction ID: 629e078bff64b969d28ca8e44f8c79f723c35b7bed688229b81624331e52f29f
Opcode Fuzzy Hash: 8207bbe70c777b42c627f071c8324f61cd7c0e2dd274ba62e1336a57466bfe8b
Instruction Fuzzy Hash: 51D2F9719000699ACB35EB54CE90EDDB379EF65308F4109F9A10AB2960EF31AF99DF50

Function 6C8DCB90 Relevance: 65.6, APIs: 30, Strings: 7, Instructions: 882
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000000,?,74732E646174), ref: 6C8DCBA9
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 6C8DCBD8
CoUninitialize.OLE32 ref: 6C8DCBED

Strings

PT1H, xrefs: 6C8DD679
PT5M, xrefs: 6C8DD241
2018-01-01T00:00:00, xrefs: 6C8DD4A1
74732E646174, xrefs: 6C8DCBA3
Trigger1, xrefs: 6C8DD467
PT24H, xrefs: 6C8DD5DD
MICROSOFT, xrefs: 6C8DCF4A

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Initialize$SecurityUninitialize
String ID: 2018-01-01T00:00:00$74732E646174$MICROSOFT$PT1H$PT24H$PT5M$Trigger1
API String ID: 3757020523-551846892
Opcode ID: 0262020b9f52248821ae6b2630be7cac55ff0ca6aae0c0b62f5f75de1e0314f2
Instruction ID: 34a6222d4b8b2edf84a1b2a2aa446f607ed478a4168510fe704580c5175e6f32
Opcode Fuzzy Hash: 0262020b9f52248821ae6b2630be7cac55ff0ca6aae0c0b62f5f75de1e0314f2
Instruction Fuzzy Hash: 6BA2AF35A05229EFCB61EF68DD8CB8CB7B1AF59315F1145E4E409AB660CB71AE85CF00

Function 6C8DE49B Relevance: 54.3, APIs: 16, Strings: 15, Instructions: 73
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?GetFileVersionInfoByHandleEx@@YGHXZ.OLMAPI32(?,?,6C8E2118,?,00000001,00000000,?,00000001,00000000,?,00000001,00000000,6C911EC0,0000000C,00000007,6C911E98), ref: 6C8DE4B0
GetProcAddress.KERNEL32(GetFileVersionInfoA), ref: 6C8DE4C0
GetProcAddress.KERNEL32(GetFileVersionInfoByHandle), ref: 6C8DE4D6
GetProcAddress.KERNEL32(GetFileVersionInfoExW), ref: 6C8DE4EC
GetProcAddress.KERNEL32(GetFileVersionInfoSizeA), ref: 6C8DE502
GetProcAddress.KERNEL32(GetFileVersionInfoSizeExW), ref: 6C8DE518
GetProcAddress.KERNEL32(GetFileVersionInfoSizeW), ref: 6C8DE52E
GetProcAddress.KERNEL32(GetFileVersionInfoW), ref: 6C8DE544
GetProcAddress.KERNEL32(VerFindFileA), ref: 6C8DE55A
GetProcAddress.KERNEL32(VerFindFileW), ref: 6C8DE570
GetProcAddress.KERNEL32(VerInstallFileA), ref: 6C8DE586
GetProcAddress.KERNEL32(VerInstallFileW), ref: 6C8DE59C
GetProcAddress.KERNEL32(VerLanguageNameA), ref: 6C8DE5B2
GetProcAddress.KERNEL32(VerLanguageNameW), ref: 6C8DE5C8
GetProcAddress.KERNEL32(VerQueryValueA), ref: 6C8DE5DE
GetProcAddress.KERNEL32(VerQueryValueW), ref: 6C8DE5F4

Strings

VerQueryValueW, xrefs: 6C8DE5E9
VerInstallFileW, xrefs: 6C8DE591
VerFindFileW, xrefs: 6C8DE565
VerFindFileA, xrefs: 6C8DE54F
VerQueryValueA, xrefs: 6C8DE5D3
GetFileVersionInfoA, xrefs: 6C8DE4B5
GetFileVersionInfoByHandle, xrefs: 6C8DE4CB
VerInstallFileA, xrefs: 6C8DE57B
GetFileVersionInfoExW, xrefs: 6C8DE4E1
VerLanguageNameA, xrefs: 6C8DE5A7
VerLanguageNameW, xrefs: 6C8DE5BD
GetFileVersionInfoSizeExW, xrefs: 6C8DE50D
GetFileVersionInfoW, xrefs: 6C8DE539
GetFileVersionInfoSizeA, xrefs: 6C8DE4F7
GetFileVersionInfoSizeW, xrefs: 6C8DE523

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: AddressProc$Ex@@FileHandleInfoVersion
String ID: GetFileVersionInfoA$GetFileVersionInfoByHandle$GetFileVersionInfoExW$GetFileVersionInfoSizeA$GetFileVersionInfoSizeExW$GetFileVersionInfoSizeW$GetFileVersionInfoW$VerFindFileA$VerFindFileW$VerInstallFileA$VerInstallFileW$VerLanguageNameA$VerLanguageNameW$VerQueryValueA$VerQueryValueW
API String ID: 3596192317-236624654
Opcode ID: f072896a3b02348bb7a272fdb9553e8c93e0909353785a1f3a2cbfd6befbd3db
Instruction ID: e53535ee521f09cf2b35ecded4f048107fcc1d63a5eaadbc3567a4ebcff32684
Opcode Fuzzy Hash: f072896a3b02348bb7a272fdb9553e8c93e0909353785a1f3a2cbfd6befbd3db
Instruction Fuzzy Hash: 7231207471A924EFDF217FA0CA088263FB5F767742321062DB909A6620E7315A20FF48

Function 2DE174DE Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 61
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,HeapSetInformation), ref: 2DE174F1
GetProcAddress.KERNEL32(00000000), ref: 2DE174F8
GetProcessHeap.KERNEL32(00000001,00000000,00000000), ref: 2DE1750A
GetSystemTimeAsFileTime.KERNEL32(?), ref: 2DE17517
GetCurrentProcessId.KERNEL32 ref: 2DE17523
GetCurrentThreadId.KERNEL32 ref: 2DE1752B
GetTickCount.KERNEL32 ref: 2DE17533
QueryPerformanceCounter.KERNEL32(?), ref: 2DE1753F
VirtualProtect.KERNELBASE(2DE032CC,00000004,00000040,?), ref: 2DE17561
VirtualProtect.KERNELBASE(2DE032CC,00000004,?,?), ref: 2DE17581

Strings

kernel32.dll, xrefs: 2DE174EC
HeapSetInformation, xrefs: 2DE174E7

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CurrentProcessProtectTimeVirtual$AddressCountCounterFileHandleHeapModulePerformanceProcQuerySystemThreadTick
String ID: HeapSetInformation$kernel32.dll
API String ID: 2966426798-3597996958
Opcode ID: 5ac41d8e3d28cc468847c5eea9df34e449443920141bdb95cdfff572bc11dd1b
Instruction ID: abf493660a71ce8ec7c99d90046e81815dfaf38e62c8f3643371ce2a7650bd3f
Opcode Fuzzy Hash: 5ac41d8e3d28cc468847c5eea9df34e449443920141bdb95cdfff572bc11dd1b
Instruction Fuzzy Hash: 261121B7D00214ABC710ABB0CC49B9E77F8AB08B56F420551FA42FB241DA75DA01CBA4

Function 6C8D7E9F Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67
processCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 6C8D7EB6
Process32First.KERNEL32(000000FF,00000128), ref: 6C8D7EF6
CloseHandle.KERNEL32(000000FF,00000002,00000000), ref: 6C8D7F05

Strings

ERROR, xrefs: 6C8D7ECA
ERROR, xrefs: 6C8D7F0B

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID: ERROR$ERROR
API String ID: 1083639309-2579291623
Opcode ID: a95d703a53c0c058863904cc0947bf2bcfc29bfc1955ab9b1c5f65cfe8e3dd9b
Instruction ID: 7697f07892553eb9d7a520f610ebe72598f5d72a68a11f534e12970435c0934a
Opcode Fuzzy Hash: a95d703a53c0c058863904cc0947bf2bcfc29bfc1955ab9b1c5f65cfe8e3dd9b
Instruction Fuzzy Hash: 4F212F30A00218EBCB34DF65DE40BDD7774AF59305F1149B8A519A6AA0DB30AE89CF40

Function 2DE03E45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup), ref: 2DE03E58
GetLastError.KERNEL32 ref: 2DE03E8E

Strings

IsolationAware function called after IsolationAwareCleanup, xrefs: 2DE03E53

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: DebugErrorLastOutputString
String ID: IsolationAware function called after IsolationAwareCleanup
API String ID: 4132100945-2690750368
Opcode ID: 4f7ed09b74f1d6dacb50aa306d3edb595997ddf75352d858c255c980011f5f0d
Instruction ID: 527cd5ec6fc51f33c58d2766b730fd58c3500574e357dd278dc4eea3d0efc616
Opcode Fuzzy Hash: 4f7ed09b74f1d6dacb50aa306d3edb595997ddf75352d858c255c980011f5f0d
Instruction Fuzzy Hash: FFF09032A083248B8715AFA5890077EB6E5D705F977140226F7A6F0600CF75C852DBE5

Function 6C8D80D7 Relevance: 2.7, Strings: 2, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

Strings

outlook-web.ddns.net, xrefs: 6C8D80E7
%02X, xrefs: 6C8D8127

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: AddressCall2ClientHandleModuleProc__fread_nolock
String ID: %02X$outlook-web.ddns.net
API String ID: 3264646418-2483746315
Opcode ID: ee644dc9bb411605fe755cbaef7909965d9cc393d12c73f4292f7587e374d0cf
Instruction ID: ac6d87de7b8aa7645141c6c39d7b2338c5dd52b14bb20461fd29782e9b4f50f7
Opcode Fuzzy Hash: ee644dc9bb411605fe755cbaef7909965d9cc393d12c73f4292f7587e374d0cf
Instruction Fuzzy Hash: 4181E231A08055CFCB19CB69C952BADB7F6FB4E308F15846ED992E7681C734A901CF84

Function 6C8DFB96 Relevance: 30.2, APIs: 5, Strings: 12, Instructions: 457
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumKeyExW.KERNELBASE(?,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 6C8DFBCF
RegCloseKey.ADVAPI32(?), ref: 6C8DFD02
GlobalMemoryStatus.KERNEL32(?), ref: 6C8DFD0F

Part of subcall function 6C8E05F9: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000101,?,?,00000000), ref: 6C8E062C

Part of subcall function 6C8E05F9: RegQueryValueExW.KERNELBASE(?,00000000,00000000,00000000,?,?,?,00000000), ref: 6C8E0650
Part of subcall function 6C8E05F9: RegCloseKey.KERNELBASE(00000006), ref: 6C8E0689

Part of subcall function 6C8E03E4: GetNumberFormatW.KERNEL32(00000800,00000000,?,00000000,?,000003FD), ref: 6C8E0441

NetGetJoinInformation.NETAPI32(00000000,?,?,?,00000000,?,00000000,?), ref: 6C8E0153
NetApiBufferFree.NETAPI32(?,6C905408,?,Domain:,00000000,?,00000000,?,00000000,?), ref: 6C8E0214

Strings

Page File Location(s):, xrefs: 6C8E00FB
Std, xrefs: 6C8DFBE9
Time zone:, xrefs: 6C8DFC97
SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management, xrefs: 6C8E0020
Total Physical Memory:, xrefs: 6C8DFD7A
Virtual Memory: In Use:, xrefs: 6C8DFFDD
Display, xrefs: 6C8DFC2C
PagingFiles, xrefs: 6C8E001B
Virtual Memory: Available:, xrefs: 6C8DFF3F
Virtual Memory: Max Size:, xrefs: 6C8DFEA8
Domain:, xrefs: 6C8E01C6
Available Physical Memory:, xrefs: 6C8DFE11

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Close$BufferEnumFormatFreeGlobalInformationJoinMemoryNumberOpenQueryStatusValue
String ID: Available Physical Memory:$Display$Domain:$Page File Location(s):$PagingFiles$SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management$Std$Time zone:$Total Physical Memory:$Virtual Memory: Available:$Virtual Memory: In Use:$Virtual Memory: Max Size:
API String ID: 369352865-1736252339
Opcode ID: 65c1270ce9cb196cc0c3ce30115308c1f24eb4a254fcbfe976e27f29cf07cebb
Instruction ID: c043fef11c118bd54a1e68b5ad4d18ade83cf3639b0c8c706722672764f93f81
Opcode Fuzzy Hash: 65c1270ce9cb196cc0c3ce30115308c1f24eb4a254fcbfe976e27f29cf07cebb
Instruction Fuzzy Hash: E212FC318110699ACF35EB68CE90DDDB379AF95348F4109F9A10AA2960EF306F9DDF50

Function 2DE03C77 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 111
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 2DE03D39
SetLastError.KERNEL32(0000006F), ref: 2DE03D4F
GetLastError.KERNEL32 ref: 2DE03DA7
LoadLibraryW.KERNELBASE(Comctl32.dll), ref: 2DE03E19

Strings

, xrefs: 2DE03D5A
GetModuleHandleExW, xrefs: 2DE03CF7
@, xrefs: 2DE03DF4
Comctl32.dll, xrefs: 2DE03E05, 2DE03E0A, 2DE03E18
QueryActCtxW, xrefs: 2DE03CB0

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ErrorLast$FileLibraryLoadModuleName
String ID: $@$Comctl32.dll$GetModuleHandleExW$QueryActCtxW
API String ID: 2178654626-2626125606
Opcode ID: 97e74fdcb0b57d66c85690f563f94ca4b38ed0024d4d6e5f46bb0ac998f6ff87
Instruction ID: 4a448aeae9a162b8c916a73a19ce401ab2f0d65dcee8bd01de611009da70ed5a
Opcode Fuzzy Hash: 97e74fdcb0b57d66c85690f563f94ca4b38ed0024d4d6e5f46bb0ac998f6ff87
Instruction Fuzzy Hash: A741C3319093249ADB609B65CC88BED77B4EF94B16F100399E249F6190DF788A81CF55

Function 6C8EDA0B Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 284
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 6C8EDB93
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C8EDBAF
__allrem.LIBCMT ref: 6C8EDBC6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C8EDBE4
__allrem.LIBCMT ref: 6C8EDBFB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C8EDC19

Strings

74732E646174, xrefs: 6C8EDC9F

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID: 74732E646174
API String ID: 1992179935-138923103
Opcode ID: 94d0e94a8f46061bbfe044791ce4e181156ba776a5c7f4a890ea9cae3aa4525e
Instruction ID: 72014c4ff83479da2e2638c78fcae1d52f8342a43993aab490f89b544408e354
Opcode Fuzzy Hash: 94d0e94a8f46061bbfe044791ce4e181156ba776a5c7f4a890ea9cae3aa4525e
Instruction Fuzzy Hash: FE812B716007159BE3309E6CCE40B9A73A9DFCA7A8F148A3FE510D7B80EB70DA098750

Function 6C8E08DC Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 61
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(RPCRT4.dll), ref: 6C8E08F4
GetProcAddress.KERNEL32(000000FF,?), ref: 6C8E0974
NdrClientCall2.RPCRT4(6C9054A8,-6C905435,?), ref: 6C8E09A1

Strings

RPCRT4.dll, xrefs: 6C8E08EF
all2, xrefs: 6C8E091D
lientC, xrefs: 6C8E0942
NdrC, xrefs: 6C8E090D

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: AddressCall2ClientHandleModuleProc
String ID: NdrC$RPCRT4.dll$all2$lientC
API String ID: 614992055-1156160658
Opcode ID: 7e4113a07029494f8ad52ec0521a36e49a0def259925514dd37d70b8cb5c877d
Instruction ID: c91804c25a85e8ea23aa3fc6dc10386cbe4a5fc1bd324d9039a7f068072e85d6
Opcode Fuzzy Hash: 7e4113a07029494f8ad52ec0521a36e49a0def259925514dd37d70b8cb5c877d
Instruction Fuzzy Hash: AE211F75E04258DFDB10DFA4C946BDD7BB8AB4E204F1089AAD51AF6640E7309B48DF21

Function 2DE050C9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32), ref: 2DE050CF
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 2DE050E9
GetProcAddress.KERNEL32(00000000,GetSystemDEPPolicy), ref: 2DE050F3
SetProcessDEPPolicy.KERNEL32(00000001), ref: 2DE05106

Strings

GetSystemDEPPolicy, xrefs: 2DE050EB
KERNEL32, xrefs: 2DE050CA
SetProcessDEPPolicy, xrefs: 2DE050E3

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: GetSystemDEPPolicy$KERNEL32$SetProcessDEPPolicy
API String ID: 3256987805-2000083379
Opcode ID: 65ded2f1829e9e66ef7d8077a9ecd5e414f64ba099834ed8ba9d74fbec52d4cf
Instruction ID: f2df36c6b64b63516e6bc1c9e43c0d7bd62a94cfa4d811259a97d2892a6e7fee
Opcode Fuzzy Hash: 65ded2f1829e9e66ef7d8077a9ecd5e414f64ba099834ed8ba9d74fbec52d4cf
Instruction Fuzzy Hash: 91E08C32605B113AD60062F95CC4FBB6AF89FE99ABB100526FA01F620ACE95D411C5A2

Function 6C8E1FF8 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6C8E203F
___scrt_uninitialize_crt.LIBCMT ref: 6C8E2059

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: d30657f23192f3f9fabb32c9287ee10b359f23dffd83b2fd9d414469b4c6306f
Instruction ID: 7808d35ea3dd8998f4e9cd21bbd1eaa33e8ba8573b4c57d838a6f62d78f2d2d3
Opcode Fuzzy Hash: d30657f23192f3f9fabb32c9287ee10b359f23dffd83b2fd9d414469b4c6306f
Instruction Fuzzy Hash: 7E41EA72D0462AEBDB309F59CE08B9E7B75FB4B768F104D25E81967B40C7389A05CB90

Function 2DE16528 Relevance: 10.6, APIs: 7, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCR90 ref: 2DE1653D

Part of subcall function 2DE171BB: _setmbcp.MSVCR90 ref: 2DE171C3

free.MSVCR90 ref: 2DE165A5
Mailbox.LIBCMT ref: 2DE165B8
Mailbox.LIBCMT ref: 2DE165C9
Mailbox.LIBCMT ref: 2DE165DA
Mailbox.LIBCMT ref: 2DE165EB
Mailbox.LIBCMT ref: 2DE165FC

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Mailbox$?_set_new_handler@@_setmbcpfree
String ID:
API String ID: 2556944153-0
Opcode ID: 6af910436fbf5c720a7919511e3d48fdfbc5420c8bf4f35e033a9d1fa9ecf0ad
Instruction ID: df05ffe40137f81d467fc9d5efd219c420521f51f37c70c22b2472e2ec13b6fc
Opcode Fuzzy Hash: 6af910436fbf5c720a7919511e3d48fdfbc5420c8bf4f35e033a9d1fa9ecf0ad
Instruction Fuzzy Hash: 963135B0300A009BCB259F68C450A6EBBF2FF98710F104A1CE686B7694DF32ED41CB90

Function 6C8D7AE4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000,00000080,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8D589E
_strcat.LIBCMT ref: 6C8D7ABD
_strcat.LIBCMT ref: 6C8D7B2D
_strncpy.LIBCMT ref: 6C8D7B5F
Sleep.KERNEL32(00003A98,?,?,?,?,?,?,6C9042B6,6C9042A7,0000000C,0000000C,?,?,6C934458), ref: 6C8D7C23
Sleep.KERNEL32(?,6C9042B6,6C9042A7,0000000C,0000000C,?,?,6C934458), ref: 6C8D7C31
RpcStringFreeA.RPCRT4(?), ref: 6C8D7CDA

Strings

d, xrefs: 6C8D7A6C

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Sleep_strcat$CreateFileFreeString_strncpy
String ID: d
API String ID: 2099396881-2564639436
Opcode ID: 74a8efbd481e36517c7b804c19a520793e4418e79ea70e317d1c4bc0eb0c5a55
Instruction ID: cab01d362a9e7ce676c5be67d5187cae1e70aca3407062ff9fa2bc38db0af25f
Opcode Fuzzy Hash: 74a8efbd481e36517c7b804c19a520793e4418e79ea70e317d1c4bc0eb0c5a55
Instruction Fuzzy Hash: A3817870924169CADF74DB28CE91EEDB375AFA0208F5209F9918962990DFB067CDDF40

Function 6C8D62A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 176
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000,00000080,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8D589E
_strcat.LIBCMT ref: 6C8D6279
_strcat.LIBCMT ref: 6C8D62E9
_strncpy.LIBCMT ref: 6C8D631B
Sleep.KERNEL32(00003A98,?,?,?,?,?,?,6C9042B6,6C9042A7,0000000C,0000000C,?,?,6C934458), ref: 6C8D7C23
RpcStringFreeA.RPCRT4(?), ref: 6C8D7CDA

Strings

d, xrefs: 6C8D6221

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: _strcat$CreateFileFreeSleepString_strncpy
String ID: d
API String ID: 437704486-2564639436
Opcode ID: 0ddffeb2ce710e8e32f4c3328b5745409d06f914371a12b2d5371e3db3fa5005
Instruction ID: 990b239921dfbda015b4a2bdd6089ebfd2e7150170c786d2a35196f60d720569
Opcode Fuzzy Hash: 0ddffeb2ce710e8e32f4c3328b5745409d06f914371a12b2d5371e3db3fa5005
Instruction Fuzzy Hash: 06719870864159CADF74DB68CE91EEDB375AFA0208F4209E9918A62990DFB037CDDF41

Function 6C8E20A8 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6C8E20E5
dllmain_crt_dispatch.LIBCMT ref: 6C8E20FC
dllmain_raw.LIBCMT ref: 6C8E2144
dllmain_crt_dispatch.LIBCMT ref: 6C8E2157
dllmain_raw.LIBCMT ref: 6C8E216A

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 6f4113a9eb224bba814715fea13bb47d3d544fd429beb550260c0396608c9e7a
Instruction ID: e9de1c48a1f7ea62cf7922c6c43ca56a1492c3293e7a2e5416474546ed31aed8
Opcode Fuzzy Hash: 6f4113a9eb224bba814715fea13bb47d3d544fd429beb550260c0396608c9e7a
Instruction Fuzzy Hash: 17212C71D0161AEBCB314F59CE48AAF3A79FB8B798F004925F91867B50C3389E058BD0

Function 6C8E05F9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000101,?,?,00000000), ref: 6C8E062C
RegQueryValueExW.KERNELBASE(?,00000000,00000000,00000000,?,?,?,00000000), ref: 6C8E0650
RegCloseKey.KERNELBASE(00000006), ref: 6C8E0689

Strings

N/A, xrefs: 6C8E066A

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: N/A
API String ID: 3677997916-2525114547
Opcode ID: 18d8f29ad51da1591e5f4898b785a875fe089768eead5829cca283be17493595
Instruction ID: cb5949d71f6e5449538a8392335ee3c82ea18182f36ce38c71cef2eed1057aa9
Opcode Fuzzy Hash: 18d8f29ad51da1591e5f4898b785a875fe089768eead5829cca283be17493595
Instruction Fuzzy Hash: AB310570A0424EEFDF10DF99D940BAE7BB0BF49304F208829E815A66A0DB74DA54DF60

Function 6C8F711E Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,6C8F7563,00000000,00000000,00000000), ref: 6C8F7422

Strings

Eastern Standard Time, xrefs: 6C8F74BB
Eastern Summer Time, xrefs: 6C8F74CF

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: 644d6d4a9fd46a4723e31224186cbfc9f4810f6b2857f5b7073b0b4c3b3b26c6
Instruction ID: fe7ce845a31338db922db90a63b816319a5cc5d7e36d2ba1631f3d503c815438
Opcode Fuzzy Hash: 644d6d4a9fd46a4723e31224186cbfc9f4810f6b2857f5b7073b0b4c3b3b26c6
Instruction Fuzzy Hash: 2AC18072A00125ABEB30AF68CE01AEE7779EF45798F644935E824D7780E7709E46C790

Function 6C8F73B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C8F26DF: HeapFree.KERNEL32(00000000,00000000,?,6C8FC163,?,00000000,?,?,6C8FC404,?,00000007,?,?,6C8FB896,?,?), ref: 6C8F26F5
Part of subcall function 6C8F26DF: GetLastError.KERNEL32(?,?,6C8FC163,?,00000000,?,?,6C8FC404,?,00000007,?,?,6C8FB896,?,?), ref: 6C8F2700

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,6C8F7563,00000000,00000000,00000000), ref: 6C8F7422

Strings

Eastern Standard Time, xrefs: 6C8F74BB
Eastern Summer Time, xrefs: 6C8F74CF

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3335090040-239921721
Opcode ID: 3ec4e08a8a8fcfafcbb5e9d37910b355c6a8b63227a6db8ecb68052a8f4ca216
Instruction ID: ed72e744227235909ece651e0b04b78dc7b137eced7242f6cf476cd5d8b955b9
Opcode Fuzzy Hash: 3ec4e08a8a8fcfafcbb5e9d37910b355c6a8b63227a6db8ecb68052a8f4ca216
Instruction Fuzzy Hash: 9541D971900525ABDB30AF6DCE059CE7F78EF46798B204A75E428D7A90EB709D06CB90

Function 6C8D7C93 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000,00000080,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8D589E
RpcStringFreeA.RPCRT4(?), ref: 6C8D7CDA

Strings

Runtime reported exception , xrefs: 6C8D7CAD

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: CreateFileFreeString
String ID: Runtime reported exception
API String ID: 201379981-1260309434
Opcode ID: 021a616e3411806567aaf6cadc33d07ad7f6781a8c2646d549db630f9d53c8d7
Instruction ID: 8bfeabe740e8de3a2c5e3fef4bd909eee90ff7ac8682709177c09cf7314fc884
Opcode Fuzzy Hash: 021a616e3411806567aaf6cadc33d07ad7f6781a8c2646d549db630f9d53c8d7
Instruction Fuzzy Hash: 20515730924169CADF74DB28CD91EEDB371AFA4218F5109E9918E62A90DFB076CDDF40

Function 2DE171BB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

_setmbcp.MSVCR90 ref: 2DE171C3

Part of subcall function 2DE15E3D: GetVersionExA.KERNEL32(?), ref: 2DE15E6A

Part of subcall function 2DE11766: __EH_prolog3.LIBCMT ref: 2DE1176D
Part of subcall function 2DE11766: GetClassInfoW.USER32(?,?,?), ref: 2DE1177F

Strings

AfxWndW, xrefs: 2DE17245
AfxWndA, xrefs: 2DE1723E

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ClassH_prolog3InfoVersion_setmbcp
String ID: AfxWndA$AfxWndW
API String ID: 329514372-64854810
Opcode ID: 6a282e33f2a40a4e87bd68a475a5dfcb41cda586579e782e554a13593cf369ce
Instruction ID: 997b85a27c01012eea14ebacc4fe09b4552363ffe2b16b2a11f63688770db368
Opcode Fuzzy Hash: 6a282e33f2a40a4e87bd68a475a5dfcb41cda586579e782e554a13593cf369ce
Instruction Fuzzy Hash: 132128B2A04249DFDB04DFA9C441A9EBBF4FB48750F10812AE515F7340EB35D942CB65

Function 6C8D392D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6C8D3939
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6C8D398C

Part of subcall function 6C8E0EDD: _Yarn.LIBCPMT ref: 6C8E0EFC
Part of subcall function 6C8E0EDD: _Yarn.LIBCPMT ref: 6C8E0F20

Strings

bad locale name, xrefs: 6C8D3995

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 30c26b19ff347429d12275a6599a655557cd0315d15f93469c90574fea308540
Instruction ID: 292a42c840cae3e2c85ca8facab59e5f1637839630a3cb522e38a90d515680ef
Opcode Fuzzy Hash: 30c26b19ff347429d12275a6599a655557cd0315d15f93469c90574fea308540
Instruction Fuzzy Hash: 15F0CD30505149EBDB18DB9CCA65BEC7371AF4520DF250968D1022AB92CF35BF54EB25

Function 6C8D2BC5 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6C8D2BDA

Part of subcall function 6C8D4779: std::_Lockit::_Lockit.LIBCPMT ref: 6C8D4799
Part of subcall function 6C8D4779: std::_Lockit::~_Lockit.LIBCPMT ref: 6C8D47BF

std::_Lockit::~_Lockit.LIBCPMT ref: 6C8D2C86

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 0b559b72ea66ec7200e6b6523bffe058c97ec77511122459b1e829acb8cf5980
Instruction ID: f6f549cf23f7a50ffaf1cbe21d4a1ca206d1bfffdd11214fa36d7c4a937e3f78
Opcode Fuzzy Hash: 0b559b72ea66ec7200e6b6523bffe058c97ec77511122459b1e829acb8cf5980
Instruction Fuzzy Hash: 9D21E674D0021EDFCF14DFA8DA85AEEBBB0BF09304F210929D515A7790EB31AA49DB51

Function 6C8E056B Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000004,00000000,00000000,00000101,00000004), ref: 6C8E05A0
RegQueryValueExW.KERNELBASE(00000004,00000001,00000000,00000000,00000004,00000004), ref: 6C8E05C1
RegCloseKey.ADVAPI32(00000004), ref: 6C8E05E4

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 8550ecd9173f44a70354ad687c1c09e1f6efc0b83701180902316e09f9642a2e
Instruction ID: e52b0e7b2ba543c2c155afb70677102ffb8a741499f1d7e15b490fa2f582bcac
Opcode Fuzzy Hash: 8550ecd9173f44a70354ad687c1c09e1f6efc0b83701180902316e09f9642a2e
Instruction Fuzzy Hash: 3F11237060420DEFEF11CF60C905BEE7BB4BB0A309F208829E915AA190DBB4DA94DF10

Function 6C8F5B29 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(6C8E8FE3,?,6C8E8FE3,?,?,?,2463616368652E646174), ref: 6C8F5B31
GetLastError.KERNEL32(?,6C8E8FE3,?,?,?,2463616368652E646174), ref: 6C8F5B3B
__dosmaperr.LIBCMT ref: 6C8F5B42

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: 582112237b673bd98227b13081c0256f4944977c3062010f2a47ba6ada68cae6
Instruction ID: b31711ba2f4e51905ac3e6c338d0632aab457fb7ec8f4fc8db7370024f6e0b18
Opcode Fuzzy Hash: 582112237b673bd98227b13081c0256f4944977c3062010f2a47ba6ada68cae6
Instruction Fuzzy Hash: CDD0123230C20CBB9F503FF6EC0884A7B7E9BA23787294A29F52CC5590EF31C4959951

Function 2DE19C6E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 4COMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(AfxOldWndProc), ref: 2DE19C73

Strings

AfxOldWndProc, xrefs: 2DE19C6E

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AtomGlobal
String ID: AfxOldWndProc
API String ID: 2189174293-2134796454
Opcode ID: d4217dee72e4177300e25165df6d35abc6edc369c666346bf9ee81b424c5cd5f
Instruction ID: 8490e39fbf53fde2146f8bf48e1fdd2717d6ea3805bb5707b58b8df0217edc5d
Opcode Fuzzy Hash: d4217dee72e4177300e25165df6d35abc6edc369c666346bf9ee81b424c5cd5f
Instruction Fuzzy Hash: 1CA022AB0020008383008FF0C0C8BE032F0AF80A03B2200C38033F03388E280080C38F

Function 6C8E0479 Relevance: 3.1, APIs: 2, Instructions: 78timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetDateFormatW.KERNELBASE(00000800,00000000,?,00000000,6C8DF0CA,000003FE,?,?,?,6C8DF0CA,?,00000000,?,00000000,?,00000000), ref: 6C8E0501
GetTimeFormatW.KERNEL32(00000800,00000000,?,00000000,00000000,00000000), ref: 6C8E0559

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Format$DateTime
String ID:
API String ID: 2545834208-0
Opcode ID: f790838552091bdce9506e4161047a615fa6f0e2860cf53d55d2d95df32ece6e
Instruction ID: 8ce486bdf476db4b2df769246b6438726bb0476480b6d625f5d9c18658a18c9e
Opcode Fuzzy Hash: f790838552091bdce9506e4161047a615fa6f0e2860cf53d55d2d95df32ece6e
Instruction Fuzzy Hash: 1A31A478E0024A9FDB00DFA8C981BAEB7B4EF18704F10445AE915EB750E734AA45CBA5

Function 6C8E1EF1 Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6C8E1F3E

Part of subcall function 6C8E26CA: InitializeSListHead.KERNEL32(6C93C7C8,6C8E1F48,6C911E78,00000010,6C8E1ED9,?,?,?,6C8E2101,?,00000001,?,?,00000001,?,6C911EC0), ref: 6C8E26CF

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6C8E1FA8

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: d09f819fd2e8ce4d01ffaec8d9ccee110deeaa19cd7c92f1af2e7403999df0e3
Instruction ID: 6c2309637420b3c3383d4fa2420fd8a7ae56ef17ea8051a1b33c6a9a864679e4
Opcode Fuzzy Hash: d09f819fd2e8ce4d01ffaec8d9ccee110deeaa19cd7c92f1af2e7403999df0e3
Instruction Fuzzy Hash: 8621C63574D2166ADB306BBCD609BDC37619F5F36CF200D29D45527F82CB65C108C6A6

Function 2DE116D6 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE116DD
GetClassInfoA.USER32(?,?,?), ref: 2DE116EF

Part of subcall function 2DE10D75: RegisterClassA.USER32(?), ref: 2DE10DA4

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Class$H_prolog3InfoRegister
String ID:
API String ID: 1538853570-0
Opcode ID: c7c22eb8f7b14e36dca255616a0ec666563476ed3652da8b2b9a615a1859b1bc
Instruction ID: 41f7c54c93f7348133383d2809edf97374919f27fa2577515922fd41d20de380
Opcode Fuzzy Hash: c7c22eb8f7b14e36dca255616a0ec666563476ed3652da8b2b9a615a1859b1bc
Instruction Fuzzy Hash: 5A01B171704254BACB026A608C81F9F7BADEF26745F118514F659B6190CE34DE0187B6

Function 2DE05027 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?), ref: 2DE05032

Strings

0-, xrefs: 2DE05052

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: lstrcmpi
String ID: 0-
API String ID: 1586166983-1114002220
Opcode ID: a787ed22da077df86fa8b5d37a2b146f29c00f357b760bf3763710e4c0c6d434
Instruction ID: 8a9d2ef84c5730c7ed6c033890644b0a333031032d0f9abf4a54e8a4bddb1987
Opcode Fuzzy Hash: a787ed22da077df86fa8b5d37a2b146f29c00f357b760bf3763710e4c0c6d434
Instruction Fuzzy Hash: D2E0ED31214115AFD7529E65CC40A667BE8FF45B95340C82AF859F6114EE72D910DBE0

Function 2DE15FCC Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000002), ref: 2DE15FDE
GetSystemMetrics.USER32(00000003), ref: 2DE15FE8

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: 9e4da9da6fd3846626be3a876d2cad014e43beda641b95538cee8958df5b12cc
Instruction ID: 9044a5b9f88155e5f7a41718bf5436ce1e8e80d6e2b5ab320940da893f2200bf
Opcode Fuzzy Hash: 9e4da9da6fd3846626be3a876d2cad014e43beda641b95538cee8958df5b12cc
Instruction Fuzzy Hash: 58D05E338092208ED70C9B9498087A837F4F308B10F04400BF246A6380C7BC8841CB98

Function 6C8F2682 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,6C8D1ED7,00000000,?,6C8F047A,00000001,00000364,00000000,00000008,000000FF,?,?,6C8E6BB3,6C8F275C), ref: 6C8F26C3

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c4b29cacc68bd4ac52584ee5513026aa25eafd12497d27415cc636606917d61a
Instruction ID: e045d2554d7916cc06c40e94e664d4a996d1170ab05e596c3d7b9b48aac31a47
Opcode Fuzzy Hash: c4b29cacc68bd4ac52584ee5513026aa25eafd12497d27415cc636606917d61a
Instruction Fuzzy Hash: A4F0E03124556867DB316E268F08B4F3758EF827E4B104922A834DA995CB2CDC0347A0

Function 6C8F2719 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,?,?,6C8E1C0F,00000000,?,6C8D447E,00000000,?,6C8D179D,00000000,?,6C8DA4C6,00000000,?), ref: 6C8F274B

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 497472592a46656b4dd3b86fa06673237a1eb467f7419ac2c1bf5eb72847fdc5
Instruction ID: 7c3010103d445a209ef135f61c1330da23ee34cc41fada962f478cad73faaa93
Opcode Fuzzy Hash: 497472592a46656b4dd3b86fa06673237a1eb467f7419ac2c1bf5eb72847fdc5
Instruction Fuzzy Hash: B5E02B312052656BEB312A6E8F0978B7A5C9F537E4F110931DD34D2DC0DB18D41342E1

Function 2DE10D75 Relevance: 1.5, APIs: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegisterClassA.USER32(?), ref: 2DE10DA4

Part of subcall function 2DE03E45: OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup), ref: 2DE03E58

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ClassDebugOutputRegisterString
String ID:
API String ID: 3599523695-0
Opcode ID: f7ecc1f92a0668298174b18dbe70631bd3bfc5fdc31549c9e8484fc3f079f4da
Instruction ID: 777efd4dfe5afe9d8f14c631cd8cb51412d98a8228a122e5ade9ae0b62ae19ab
Opcode Fuzzy Hash: f7ecc1f92a0668298174b18dbe70631bd3bfc5fdc31549c9e8484fc3f079f4da
Instruction Fuzzy Hash: 4BF03071D05209DACB40EFA589006FDBAF5FF54700F614116E565F6190CF34CA42DB24

Function 2DE181E3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 3c9221a8330db71b842a43b363df4827e11af7726f289f1a230b4738da640df6
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 3c9221a8330db71b842a43b363df4827e11af7726f289f1a230b4738da640df6
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE181F0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 374f67c20174960b52ec27608b5ab030bc443be68ee213b82e3feaf5970ff3fc
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 374f67c20174960b52ec27608b5ab030bc443be68ee213b82e3feaf5970ff3fc
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE181FD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: fd43a3fdb2278bbe56b9ac39c2a82664b83aad6ef90ab75cbd57617ea47e249d
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: fd43a3fdb2278bbe56b9ac39c2a82664b83aad6ef90ab75cbd57617ea47e249d
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE181C9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 46b048f0821808117381df587b5b8618c0fad5ea4ea476e1da7cef26fa50cee7
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 46b048f0821808117381df587b5b8618c0fad5ea4ea476e1da7cef26fa50cee7
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE181D6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 5bc63d5c6e5a8a3ef60220b49febf800ab0fc058a1edb16725ab86c0f77e6273
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 5bc63d5c6e5a8a3ef60220b49febf800ab0fc058a1edb16725ab86c0f77e6273
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE181BC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 063e76ee425b43f93cf38798988bf6c04c12ff4ad0aec89d06dcffa3ae7c9730
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 063e76ee425b43f93cf38798988bf6c04c12ff4ad0aec89d06dcffa3ae7c9730
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE1819E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 8a923b9224360a3a599a032f7f8a87c35929414743092b0e913b1d5e3866dd41
Instruction ID: cebcb2f984bb943f2752833b3bbbad2641584a406617695772ac7b2ee9e42ff2
Opcode Fuzzy Hash: 8a923b9224360a3a599a032f7f8a87c35929414743092b0e913b1d5e3866dd41
Instruction Fuzzy Hash: E8A011A23A8002BC300A8208AC88CBA830CC2C0A20320C30AF020F0000AC00EC080030

Function 2DE18244 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 684399203c9170340643cc195a1b5a13f624fcf938c97921d1119d1a4a7f695a
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 684399203c9170340643cc195a1b5a13f624fcf938c97921d1119d1a4a7f695a
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE18254 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: f482adabd21e7af47428a80a1bf8fbbba5d94189440d9136d560cb4316e510b9
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: f482adabd21e7af47428a80a1bf8fbbba5d94189440d9136d560cb4316e510b9
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE18224 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 0e10e93c898f85eb97ec8577bce6e67cc111cf1ce03047cd5587b9a48a1f9c0b
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 0e10e93c898f85eb97ec8577bce6e67cc111cf1ce03047cd5587b9a48a1f9c0b
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE18234 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 91ea8d7b3527954384456e8f02118ab07569016c625addee9a318f1b907ff370
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 91ea8d7b3527954384456e8f02118ab07569016c625addee9a318f1b907ff370
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE1820A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 80fe5ea136582966b2d23c62aa090d18069f494a45ee588e0e9344bac8a7ba4b
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 80fe5ea136582966b2d23c62aa090d18069f494a45ee588e0e9344bac8a7ba4b
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE18217 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 5981c30ec32350a43957859c9a7d0fd5bab64f05ceb70fa934ec85ea2d86ad43
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 5981c30ec32350a43957859c9a7d0fd5bab64f05ceb70fa934ec85ea2d86ad43
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE178B5 Relevance: 1.5, APIs: 1, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CurrentProcessProtectTimeVirtual$AddressCountCounterFileHandleHeapModulePerformanceProcQuerySystemThreadTick
String ID:
API String ID: 2966426798-0
Opcode ID: b1d9e3360e75d73aef1975e7a51aa155834824d47b87844c87d294b04e291f44
Instruction ID: e78b5431c3df2289def5fc0514eb564146f851374970ea3c46f2ab85c2feb5c9
Opcode Fuzzy Hash: b1d9e3360e75d73aef1975e7a51aa155834824d47b87844c87d294b04e291f44
Instruction Fuzzy Hash:

Non-executed Functions

Function 2DE07BC9 Relevance: 21.3, APIs: 14, Instructions: 274windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE07BD0
IsIconic.USER32(00000001), ref: 2DE07C45
SetForegroundWindow.USER32(00000001), ref: 2DE07C69
LoadMenuW.USER32(?,00000048), ref: 2DE07CA7
MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000001), ref: 2DE07CDB
SetWindowLongA.USER32(00000003,000000F4,0000E900), ref: 2DE07D64
GetFocus.USER32 ref: 2DE07D6A
SetFocus.USER32(00000003,00000000,?,?,00000000,?,?,00CF0000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 2DE07D83

Part of subcall function 2DE12F6C: GetMessageA.USER32(2DE1E9A0,00000000,00000000,00000000), ref: 2DE12F79
Part of subcall function 2DE12F6C: TranslateMessage.USER32(2DE1E9A0), ref: 2DE12F99
Part of subcall function 2DE12F6C: DispatchMessageA.USER32(2DE1E9A0), ref: 2DE12FA0

GetSystemMetrics.USER32(00000000), ref: 2DE07DAF
GetSystemMetrics.USER32(00000001), ref: 2DE07DDF
GetSystemMetrics.USER32(00000001), ref: 2DE07E15
SetForegroundWindow.USER32(00000003), ref: 2DE07E48
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 2DE07E7E
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 2DE07ECD

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Message$MetricsSystemWindow$FocusForegroundPeek$ByteCharDispatchH_prolog3_catchIconicLoadLongMenuMultiTranslateWide
String ID:
API String ID: 2541888167-0
Opcode ID: 290a08594d3c1373832ecd646cb7b35f3fae9b5f89bf84448277df58dea2848e
Instruction ID: 62f3655488501c880ed43d426ecc0c1284c9343c02d18e12cd801800864164f7
Opcode Fuzzy Hash: 290a08594d3c1373832ecd646cb7b35f3fae9b5f89bf84448277df58dea2848e
Instruction Fuzzy Hash: 34A19E71A01119EBCF05EFA4C885AAE7BB5EF48756F118019F90ABB245CF74DE41CBA0

Function 2DE183CC Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 116libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 2DE183F5
LoadLibraryExW.KERNEL32(?,00000000,00000008,msi.dll,?,00000106), ref: 2DE1844A
LoadLibraryW.KERNEL32(msi.dll), ref: 2DE18457
GetProcAddress.KERNEL32(00000000,MsiGetProductCodeW), ref: 2DE18473
GetProcAddress.KERNEL32(00000000,MsiProvideQualifiedComponentExW), ref: 2DE18481

Strings

msi.dll, xrefs: 2DE18435, 2DE1843A, 2DE18456
{1E77DE88-BCAB-4C37-B9E5-073AF52DFD7A}, xrefs: 2DE18496, 2DE184D5, 2DE18504
MsiProvideQualifiedComponentExW, xrefs: 2DE18475
mso14.dll, xrefs: 2DE18491, 2DE184D4, 2DE18503
MsiGetProductCodeW, xrefs: 2DE1846D

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressLibraryLoadProc$DirectorySystem
String ID: MsiGetProductCodeW$MsiProvideQualifiedComponentExW$msi.dll$mso14.dll${1E77DE88-BCAB-4C37-B9E5-073AF52DFD7A}
API String ID: 2381529825-3601640118
Opcode ID: a561deea7513b478ab3a10dadaa1a62ff6dfc47870307986edab1943f2b586c8
Instruction ID: a91da5b507411d3708a7b20a1b27f830a33c0404a843497ae4905b4efc26384c
Opcode Fuzzy Hash: a561deea7513b478ab3a10dadaa1a62ff6dfc47870307986edab1943f2b586c8
Instruction Fuzzy Hash: F94163B2904118ABDB109BA4CCC8ABE77BCEB48745F5044AAE246F7140EF358E84CF25

Function 2DE0DC78 Relevance: 12.5, APIs: 8, Instructions: 540COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 2DE0DC82
malloc.MSVCR90 ref: 2DE0DCED
free.MSVCR90 ref: 2DE0DD11
free.MSVCR90 ref: 2DE0DD19
malloc.MSVCR90 ref: 2DE0DE67

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: freemalloc$H_prolog3_catch_
String ID:
API String ID: 2471221492-0
Opcode ID: 90649fad3fe493cab59900a817efdc0f5823288cf6ab36aa88d0c896f370b14e
Instruction ID: 464abe342d10f794a3dfe470a0fd4c12dafe5c88ac6945ca468c1e5a965cb4cd
Opcode Fuzzy Hash: 90649fad3fe493cab59900a817efdc0f5823288cf6ab36aa88d0c896f370b14e
Instruction Fuzzy Hash: 10228970900218DFDB22DFA4C884BADBBB5FF48706F2185A9EA48BB255DF319941CF50

Function 6C8FCF41 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C8F02DC: GetLastError.KERNEL32(?,00000008,6C8F9E39,00000000,6C8E68B0), ref: 6C8F02E0
Part of subcall function 6C8F02DC: SetLastError.KERNEL32(00000000,00000008,000000FF), ref: 6C8F0382

GetACP.KERNEL32(?,?,?,?,?,?,6C8F0D22,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 6C8FD002
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,6C8F0D22,?,?,?,00000055,?,-00000050,?,?), ref: 6C8FD02D
_wcschr.LIBVCRUNTIME ref: 6C8FD0C1
_wcschr.LIBVCRUNTIME ref: 6C8FD0CF
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 6C8FD190

Strings

utf8, xrefs: 6C8FD0FF

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: f25d2644a2116f46da9e3f5c971fe230a5ac3fb505c60491beee5c9367101c9e
Instruction ID: 2b38e6b40aa3979c9678efbce03e91a5ae66100e7df6e7bca8fca3736114b0ad
Opcode Fuzzy Hash: f25d2644a2116f46da9e3f5c971fe230a5ac3fb505c60491beee5c9367101c9e
Instruction Fuzzy Hash: E7712F71604206AAE734AF39CE41BE6B3A8EF45388F104C3AE625D7A81F774D547C760

Function 2DE17592 Relevance: 10.6, APIs: 7, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 2DE17E3C
_crt_debugger_hook.MSVCR90(00000001), ref: 2DE17E49
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 2DE17E51
UnhandledExceptionFilter.KERNEL32(2DE03308), ref: 2DE17E5C
_crt_debugger_hook.MSVCR90(00000001), ref: 2DE17E6D
GetCurrentProcess.KERNEL32(C0000409), ref: 2DE17E78
TerminateProcess.KERNEL32(00000000), ref: 2DE17E7F

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled_crt_debugger_hook$CurrentDebuggerPresentTerminate
String ID:
API String ID: 3369434319-0
Opcode ID: 57dc467342b30da1e5f46a0a0a29976b29a7f0103eb706373591e4cd37f5fbd6
Instruction ID: 0ed8bb1e5ad0440355285c97adff1f601f88bbca9fa52522f07f9a61804034bf
Opcode Fuzzy Hash: 57dc467342b30da1e5f46a0a0a29976b29a7f0103eb706373591e4cd37f5fbd6
Instruction Fuzzy Hash: D421DFB7902744AFC321DFA4D4897583BF4BB08B11F50901AE40AA7B50EB789981CF0D

Function 6C8FE384 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6C8FE568

Strings

1#INF, xrefs: 6C8FE4BA
1#SNAN, xrefs: 6C8FE490
1#QNAN, xrefs: 6C8FE497
1#IND, xrefs: 6C8FE489

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 28313c10c82e48ee097e2ae2bea66776f8f1dbd972ce9877d52229ef2c970272
Instruction ID: a9e0f35ede59435df3840b531e9562ea12aa0792fa89b3f02b4acbdbb254ca5d
Opcode Fuzzy Hash: 28313c10c82e48ee097e2ae2bea66776f8f1dbd972ce9877d52229ef2c970272
Instruction Fuzzy Hash: D0D24871E092288BDB35CE28CE407DAB7B5EB59344F1449EAD45DE3640E734AE86CF81

Function 6C8FD6D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,6C8FD9EE,00000002,00000000,?,?,?,6C8FD9EE,?,00000000), ref: 6C8FD769
GetLocaleInfoW.KERNEL32(?,20001004,6C8FD9EE,00000002,00000000,?,?,?,6C8FD9EE,?,00000000), ref: 6C8FD792
GetACP.KERNEL32(?,?,6C8FD9EE,?,00000000), ref: 6C8FD7A7

Strings

ACP, xrefs: 6C8FD6EE
OCP, xrefs: 6C8FD724

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8427f81026d0536a92782b880799bef533a4b414c83e27bfb0f1c5ded288f7bf
Instruction ID: b4b84f9f22adb7cf97d06a1a91b9e5ace976bdf5778f696542764f6845f173e4
Opcode Fuzzy Hash: 8427f81026d0536a92782b880799bef533a4b414c83e27bfb0f1c5ded288f7bf
Instruction Fuzzy Hash: 1721A722709104D6D7349F15CB01B8772B6EB43BD8B668E2AEA29DF900F731DD42C750

Function 6C8FD8A5 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C8F02DC: GetLastError.KERNEL32(?,00000008,6C8F9E39,00000000,6C8E68B0), ref: 6C8F02E0
Part of subcall function 6C8F02DC: SetLastError.KERNEL32(00000000,00000008,000000FF), ref: 6C8F0382

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 6C8FD9B1
IsValidCodePage.KERNEL32(00000000), ref: 6C8FD9FA
IsValidLocale.KERNEL32(?,00000001), ref: 6C8FDA09
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 6C8FDA51
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 6C8FDA70

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 708086c4e929f383090b5a1528856f07b7b57a0338e027e95d1c5452b1a648d9
Instruction ID: c6f67a2f4b8f4d88825ebd16f7911bd8815e6fb4e1cda28e5e091fb8be41164e
Opcode Fuzzy Hash: 708086c4e929f383090b5a1528856f07b7b57a0338e027e95d1c5452b1a648d9
Instruction Fuzzy Hash: FC516571B012059FEF20DFA9CD40BAE77F8AF45744F21482AAA34E7640D770E9468B61

Function 6C8F5CB2 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6C8F5D3F

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 5a2df6829468a3d1ba630fb8cbc36a6c6803c4e92b5340e5fff4db1baf62b945
Instruction ID: 64f91ab19adffea2910eab6a9a835cc02ef0ef7f7d0e31aa798ed129f3759cb2
Opcode Fuzzy Hash: 5a2df6829468a3d1ba630fb8cbc36a6c6803c4e92b5340e5fff4db1baf62b945
Instruction Fuzzy Hash: 68B16C31A053459FEB218F68C990BEEBBB5EF55384F14C5AAD424ABB41D334D907CBA0

Function 6C8E270B Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6C8E2717
IsDebuggerPresent.KERNEL32 ref: 6C8E27E3
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6C8E2803
UnhandledExceptionFilter.KERNEL32(?), ref: 6C8E280D

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 638b0b6778bf47af338e41ad40fcffda6bb9859e1233b36c375a9042896f14e5
Instruction ID: a478b33246b67ff7313430a183f11d77b5e313af9914d6309095d93a5fe49f09
Opcode Fuzzy Hash: 638b0b6778bf47af338e41ad40fcffda6bb9859e1233b36c375a9042896f14e5
Instruction Fuzzy Hash: 59314A75D0522D9BDF21DFA5DA897CCBBB8BF19304F1045AAE40CAB240EB749B849F44

Function 6C8FD354 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 6C8F02DC: GetLastError.KERNEL32(?,00000008,6C8F9E39,00000000,6C8E68B0), ref: 6C8F02E0
Part of subcall function 6C8F02DC: SetLastError.KERNEL32(00000000,00000008,000000FF), ref: 6C8F0382

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6C8FD3A8
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6C8FD3F2
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6C8FD4B8

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 882d4a297947ca032bf7a50008ba8d29ccb6d75dd943e1185a32d7f7de9f6ee3
Instruction ID: 38cf02e2449645ef146fd3350ff27a669e0e8645ffc62a98809ea35f1648fe0b
Opcode Fuzzy Hash: 882d4a297947ca032bf7a50008ba8d29ccb6d75dd943e1185a32d7f7de9f6ee3
Instruction Fuzzy Hash: 0861DB715441079FEB25CF29CE81BAA77B8FF09388F20857ADE25C6984E734E546CB50

Function 6C8E6733 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6C8E682B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6C8E6835
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6C8E6842

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 4bfd285a7ed312a3c780cfa6f13b6caff3193da7c7991051c43b72afd6a2c87b
Instruction ID: b4efb5a51c4ba6fee6a330e120ae21fb042834f41d7976593a5a87b6ee5f780b
Opcode Fuzzy Hash: 4bfd285a7ed312a3c780cfa6f13b6caff3193da7c7991051c43b72afd6a2c87b
Instruction Fuzzy Hash: 3C31D27490122C9BCB21DF69D9887CCBBB8BF19314F6046EAE51CA7250EB709F858F44

Function 2DE140C6 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 2DE140D8
IsIconic.USER32(?), ref: 2DE140EA
ShowWindow.USER32(?,?), ref: 2DE14108

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$IconicShowVisible
String ID:
API String ID: 500985287-0
Opcode ID: f7515618d5f482fb2e7f8d45be699baa96eba90e93a85ea171be8b5b3228c2ff
Instruction ID: 0fadd7cbe0ab05801cdd4b24b197df19e6a37fde3af66671a11039e4f1021fed
Opcode Fuzzy Hash: f7515618d5f482fb2e7f8d45be699baa96eba90e93a85ea171be8b5b3228c2ff
Instruction Fuzzy Hash: 51F0B4333005015BC621072BCC08B6BBAADEFD1EB1B014139E666F23E0DE25CC11C552

Function 2DE0BB17 Relevance: 4.5, APIs: 3, Instructions: 35keyboardwindowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 2DE0BB31
GetAsyncKeyState.USER32(00000010), ref: 2DE0BB54
SendMessageA.USER32(?,00000028,00000000,00000000), ref: 2DE0BB6D

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AsyncMessageParentSendState
String ID:
API String ID: 2531950252-0
Opcode ID: 5c64213d33c752abad6be088229819c37616a04441b67572ed77f7afcae26d45
Instruction ID: a5f8a39b526c03462d6aa817e3f5d8304c484d58e2a06fbf57b3a9af76b73579
Opcode Fuzzy Hash: 5c64213d33c752abad6be088229819c37616a04441b67572ed77f7afcae26d45
Instruction Fuzzy Hash: DEF05431985715E7DA121B508809FAB36E8FB10BCFF108025F705795B8EE79C941DE9A

Function 2DE12F1C Relevance: 4.5, APIs: 3, Instructions: 28keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 2DE12F3F
GetKeyState.USER32(00000011), ref: 2DE12F48
GetKeyState.USER32(00000012), ref: 2DE12F51

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 2c93d07cdf5a394ea4bef57f06a4e82a564376b5dce813df163559a857914e96
Instruction ID: 0040a4f18f48a28636f300728a559d53dd8f25d0910e6446cba368ebd671409f
Opcode Fuzzy Hash: 2c93d07cdf5a394ea4bef57f06a4e82a564376b5dce813df163559a857914e96
Instruction Fuzzy Hash: D2E01275646255C9EA4067706D02FE41650AB07794F05C0A5AB5CBB0D5DEA0CE439E60

Function 2DE11D25 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 346COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE11D2C

Strings

, xrefs: 2DE11DC9

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-3916222277
Opcode ID: 104d98a35611c6089d2a584c1f24d86f2022fd74a73d3009f181e9437cd13918
Instruction ID: 87ea93f56deee7a6e7b9c4fcd99d49a769331324ebcd59148695c624f05dc6b2
Opcode Fuzzy Hash: 104d98a35611c6089d2a584c1f24d86f2022fd74a73d3009f181e9437cd13918
Instruction Fuzzy Hash: 15B15170708108EFDB169F64CC80EAE3BA9FF48691F118119FA15BA291DF35DE11CBA5

Function 6C8EE7A0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1abc4516867f9721299842ef38f97ff36ff93041716b9c1f66a367978e5b0d3
Instruction ID: 40c11e69c72b5cb32a26097522c6d786403543efd1a95ef0e17919f5c0b72a0c
Opcode Fuzzy Hash: f1abc4516867f9721299842ef38f97ff36ff93041716b9c1f66a367978e5b0d3
Instruction Fuzzy Hash: E5F18071E016199FDB24CFA8C98069EBBF1FF89314F15866DE819AB790D730A945CF80

Function 6C8F203C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6C8F2037,?,?,00000008,?,?,6C901147,00000000), ref: 6C8F2269

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 48b4bbbc5a8713ce10610504141b5472cfceedb195e262e4b2390023599a84ec
Instruction ID: 780672862f9620313d79650574be1895a50f5f6ab88c994c597d896da780fc23
Opcode Fuzzy Hash: 48b4bbbc5a8713ce10610504141b5472cfceedb195e262e4b2390023599a84ec
Instruction Fuzzy Hash: CEB17131610649CFD714CF28C58AB557BE0FF453A8F258A5CE9A9CF6A1C339E982CB40

Function 6C8E28D5 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6C8E28EB

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 69525ad7e834ae4b6b5ebf05b2a56856f60c908791760cf3d6dc443885e98f50
Instruction ID: a056f22d6fa1be5aad60754b9e70d715f965bb63502d25f593a3133c1679e172
Opcode Fuzzy Hash: 69525ad7e834ae4b6b5ebf05b2a56856f60c908791760cf3d6dc443885e98f50
Instruction Fuzzy Hash: E3519EB1A096568FEB24CF56C58A7AEB7F1FB4A318F20856AC415EB640D378E900CF50

Function 6C8FA2F4 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 899bd80cc5cba802f7ccdfeeae27d5bbd84fce2f393e526ccdac73e3d10c78fc
Instruction ID: 1bc9cab8c5e9cf0966466a17b257b71a2de5a1e6028fc190c4f93443cd9e286f
Opcode Fuzzy Hash: 899bd80cc5cba802f7ccdfeeae27d5bbd84fce2f393e526ccdac73e3d10c78fc
Instruction Fuzzy Hash: 6141C4B580421DAEDB20DF69CD88AEABBB8EF45358F1446EDE418D3600D7359E858F50

Function 6C8EC36A Relevance: 1.6, Strings: 1, Instructions: 388COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 6C8EC4FF

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: a4ebc56e7e2a14dec3de50d83e117fea86392a8ede2f876511ffb29100201b85
Instruction ID: 4fa1ebc2ea5d35af0597323f27dd498bf8f19d96ca71d453cd04ba1cfbae6a9d
Opcode Fuzzy Hash: a4ebc56e7e2a14dec3de50d83e117fea86392a8ede2f876511ffb29100201b85
Instruction Fuzzy Hash: 29E1AE70A006058FC734EF69C680AAEBFB1BF4F318B205E5DD4569BAA2D730E945CB51

Function 6C8EBFDC Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 6C8EC16A

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: de55ae7ef87b67a7be4c91385d4f8365fff9fdd95291b0b8e1b1b4776413e342
Instruction ID: 0e24ba1356f588da12339274279763b188c5c04ae5b2fe931ef9a8fb13ec3c08
Opcode Fuzzy Hash: de55ae7ef87b67a7be4c91385d4f8365fff9fdd95291b0b8e1b1b4776413e342
Instruction Fuzzy Hash: 1FC19070E046498FCB35AE69C6906AABFB1BB0F308F144E1DD46697B92C731A846CB51

Function 6C8FD5A7 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 6C8F02DC: GetLastError.KERNEL32(?,00000008,6C8F9E39,00000000,6C8E68B0), ref: 6C8F02E0
Part of subcall function 6C8F02DC: SetLastError.KERNEL32(00000000,00000008,000000FF), ref: 6C8F0382

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6C8FD5FB

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 6ad9901e3c269b261403da85bf62285b9f3bb5ec0616c830f55d1eb3efe31c0c
Instruction ID: c9e777df9c7cad451e7293d7df37aa720d1079b4096907d70f03e481514dc2e0
Opcode Fuzzy Hash: 6ad9901e3c269b261403da85bf62285b9f3bb5ec0616c830f55d1eb3efe31c0c
Instruction Fuzzy Hash: F621D8726152069FDB288E19DE41EAE33A8EF05348B10057EEA15D7940EB38DC068790

Function 6C8FD22E Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C8F02DC: GetLastError.KERNEL32(?,00000008,6C8F9E39,00000000,6C8E68B0), ref: 6C8F02E0
Part of subcall function 6C8F02DC: SetLastError.KERNEL32(00000000,00000008,000000FF), ref: 6C8F0382

EnumSystemLocalesW.KERNEL32(6C8FD354,00000001,00000000,?,-00000050,?,6C8FD985,00000000,?,?,?,00000055,?), ref: 6C8FD2A0

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 6bbaeb8edf259c6bf2f2f73e70b93864cfa98745563235538e9364595f237361
Instruction ID: 079b7effea3959fa40df78b621bb1e3e14c7fb00b450457f2a984eacd76105d0
Opcode Fuzzy Hash: 6bbaeb8edf259c6bf2f2f73e70b93864cfa98745563235538e9364595f237361
Instruction Fuzzy Hash: D41129372043055FDB289F39C9905AAB7A1FF8039DB18492EDA5687F40E371B903C740

Function 6C8FD7D6 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C8F02DC: GetLastError.KERNEL32(?,00000008,6C8F9E39,00000000,6C8E68B0), ref: 6C8F02E0
Part of subcall function 6C8F02DC: SetLastError.KERNEL32(00000000,00000008,000000FF), ref: 6C8F0382

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,6C8FD651,00000000,00000000,?), ref: 6C8FD802

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: aecc067971c45b4ef08628a07fb7d8cc8cd4b176fe1f4c2211050061eaa84e41
Instruction ID: 978547ac358e6da870a3de1059e0070e84bb208ab13ec3b0639f90fba44a03d1
Opcode Fuzzy Hash: aecc067971c45b4ef08628a07fb7d8cc8cd4b176fe1f4c2211050061eaa84e41
Instruction Fuzzy Hash: DBF0F932A21229ABDB245F658905BFA3768EF40798F604D2ADE25A3540EB70FD43C590

Function 6C8FD13C Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 6C8F02DC: GetLastError.KERNEL32(?,00000008,6C8F9E39,00000000,6C8E68B0), ref: 6C8F02E0
Part of subcall function 6C8F02DC: SetLastError.KERNEL32(00000000,00000008,000000FF), ref: 6C8F0382

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 6C8FD190

Strings

utf8, xrefs: 6C8FD0FF

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 5d853baab0221ed253f5e422c976434dd079e536cbecda4b5e707eab12349a70
Instruction ID: 527987a17e199bcde992c1aa621dd5fabba569bc1feba49078cd55c5d016077e
Opcode Fuzzy Hash: 5d853baab0221ed253f5e422c976434dd079e536cbecda4b5e707eab12349a70
Instruction Fuzzy Hash: EFF02832700109AFC7249F3CDD05AFE73A8DF49354F11057EA612EB640DB74AD068750

Function 6C8FD2C9 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C8F02DC: GetLastError.KERNEL32(?,00000008,6C8F9E39,00000000,6C8E68B0), ref: 6C8F02E0
Part of subcall function 6C8F02DC: SetLastError.KERNEL32(00000000,00000008,000000FF), ref: 6C8F0382

EnumSystemLocalesW.KERNEL32(6C8FD5A7,00000001,00000000,?,-00000050,?,6C8FD949,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 6C8FD313

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 47b54eac5b143bb5bbb80ffe1701cbcc85b8aa9f7c687ac5e6236ac1498b6b70
Instruction ID: d489ba7264764ae0da2f77632decf6b4b0273bf0b321f05f3c723872955cab52
Opcode Fuzzy Hash: 47b54eac5b143bb5bbb80ffe1701cbcc85b8aa9f7c687ac5e6236ac1498b6b70
Instruction Fuzzy Hash: 2FF04C363043045FD7245F798980A6A7BA5EF8039CF15482EFB154BA40E3B1AC03C660

Function 6C8F2995 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C8EDD5C: EnterCriticalSection.KERNEL32(-6C93C8B0,?,6C8EF08F,00000000,6C912220,0000000C,6C8EF056,6C8D1ED7,?,6C8F26B5,6C8D1ED7,?,6C8F047A,00000001,00000364,00000000), ref: 6C8EDD6B

EnumSystemLocalesW.KERNEL32(6C8F2988,00000001,6C912400,0000000C,6C8F2DB7,00000000), ref: 6C8F29CD

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 7419ea1bc5fb80b4a47b3bd454379f50f96f2c3aac879a53be3f50cd48eaef8b
Instruction ID: 2a215ab8dbf3df72f03a48a94dcf365bfd88e2201bc93080669a11e07abdc30c
Opcode Fuzzy Hash: 7419ea1bc5fb80b4a47b3bd454379f50f96f2c3aac879a53be3f50cd48eaef8b
Instruction Fuzzy Hash: 74F08732A08214DFDB20DF9CD545B9877B0FB8A369F20892AE4149B790CB794944CF80

Function 6C8FD1E3 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C8F02DC: GetLastError.KERNEL32(?,00000008,6C8F9E39,00000000,6C8E68B0), ref: 6C8F02E0
Part of subcall function 6C8F02DC: SetLastError.KERNEL32(00000000,00000008,000000FF), ref: 6C8F0382

EnumSystemLocalesW.KERNEL32(6C8FD13C,00000001,00000000,?,?,6C8FD9A7,-00000050,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 6C8FD21A

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 535574f0ac1a1aa9ed363f0a3c94d1c2546d9bee98c30df4bf0341cd065c941a
Instruction ID: b85151df9afd504cf0a789c2c9c08ea85d74c2c591e3e0284f6a0ff697e0f7c6
Opcode Fuzzy Hash: 535574f0ac1a1aa9ed363f0a3c94d1c2546d9bee98c30df4bf0341cd065c941a
Instruction Fuzzy Hash: 2FF0A33630010557C7149F79D90465ABF64EFC2354F0A445DEF158BB40D331D843C7A0

Function 6C8F2EBB Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,6C8F1888,?,20001004,00000000,00000002,?,?,6C8F0E8A), ref: 6C8F2EEF

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 603afe8f0381dcae135eca2bafbeda0f80139b6ec7352f3bddc596c68ee446de
Instruction ID: 49abd5940de21225a20518e2590b36e4a4789f8e5bbedfb92ad530110800757a
Opcode Fuzzy Hash: 603afe8f0381dcae135eca2bafbeda0f80139b6ec7352f3bddc596c68ee446de
Instruction Fuzzy Hash: 6FE0DF31600568BBCF222F24DD0CA9E3F29EF44790F104425FD2022610CB368C22AA91

Function 2DE15E3D Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 2DE15E6A

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 8a0c90a5a7600dfc6de74170f282232b9cc0a68bf6e01015507ece98bb4611d0
Instruction ID: a35e736960b650c7d7a073a1ac86cc533c4016ce540f63c3b8c129ad045e2cef
Opcode Fuzzy Hash: 8a0c90a5a7600dfc6de74170f282232b9cc0a68bf6e01015507ece98bb4611d0
Instruction Fuzzy Hash: DFF0AC76A14218CFD754DF74C59978DB7F4AB18B05F9084A8D00BE6381DA799A89CB04

Function 2DE17EC9 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00017E87), ref: 2DE17ECE

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d4fd6f06bdcacada01fbf8cb112c5e94c95be8386407e9c4f5fed4f85241b50a
Instruction ID: cd9b212ba350204da04671530f89d19a90fd91c5f2efaa0c467f0ce58adf26d7
Opcode Fuzzy Hash: d4fd6f06bdcacada01fbf8cb112c5e94c95be8386407e9c4f5fed4f85241b50a
Instruction Fuzzy Hash: 7C9002A125100086470027F0484961925E06B48A137450A547002EC129DF2688A0A525

Function 6C8F8869 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0617ea9bc420b4156c6981b64ed5973be4b1ff05cb883fe2bbce868f7c9b97e
Instruction ID: 35e3998686dc57c088f28d6ab0c17ca4f28a5404fcf5231c1de2920287886bc4
Opcode Fuzzy Hash: f0617ea9bc420b4156c6981b64ed5973be4b1ff05cb883fe2bbce868f7c9b97e
Instruction Fuzzy Hash: E8322821E2DF414DDB235935C962325A259AFB73D8F25DB3FF829B5E99EB29C0834100

Function 6C8E2AF0 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 3cca023ebeae0ced375d76f470628846b69aa8b73b6617aaaf4630e436134544
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 71113877242083E3D214AD2DDAFC6A7F395EACF3387384B7AC0628BE54D12B91459600

Function 6C8F2767 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b09f30d7b6bf7c48fafd3229394655d06458f0b2aa6ed93c603fa64a0d1ab1
Instruction ID: 89e78ee05375571f1f6339d3b3421dcaa71942467075f791229726875ca36d3e
Opcode Fuzzy Hash: 40b09f30d7b6bf7c48fafd3229394655d06458f0b2aa6ed93c603fa64a0d1ab1
Instruction Fuzzy Hash: 37E08632922268EBC720CB8CCA04D89F3ECFB45A84B1104A6B511D3500C274DE01C7D0

Function 6C8E6E04 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ec15a48c8b1f8719dfe3b1da8bb77a82207cfc92cb9bf1eb211070ea6ed9ee
Instruction ID: 090064df8a43d60539f8d31be101eb98e4735dabdd63b1b1a5b6f800d77f71ab
Opcode Fuzzy Hash: 17ec15a48c8b1f8719dfe3b1da8bb77a82207cfc92cb9bf1eb211070ea6ed9ee
Instruction Fuzzy Hash: EAC08C34405A4446CE258910D3703A43776E3A77CAFA02C8CC6128BFC1C65E9886DA41

Function 2DE15C05 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 505f710581b9283841ecc4a2d5d31879c40518d448a6c5120241a013e7c9bc73
Instruction ID: 99d04dc0369ba1252ac13c10facf11690bff2e542cc2b60f8842c8ed9d142287
Opcode Fuzzy Hash: 505f710581b9283841ecc4a2d5d31879c40518d448a6c5120241a013e7c9bc73
Instruction Fuzzy Hash: 6A90022214860CC6514115C5540573173ECA201AD3A4001A5D5119560255676410D5DD

Function 2DE0DA85 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 197stringCOMMON

Download Yara Rule

APIs

GetProfileStringA.KERNEL32(intl,sList,2DE028B4,?,00000003), ref: 2DE0DABC
IsDBCSLeadByte.KERNEL32(00000000,?,?,?,?,?), ref: 2DE0DAD6
CharNextA.USER32(?), ref: 2DE0DB05
memset.MSVCR90 ref: 2DE0DB19
CharNextA.USER32(?), ref: 2DE0DB5A
isspace.MSVCR90 ref: 2DE0DB66
memset.MSVCR90 ref: 2DE0DB75
lstrlenA.KERNEL32(00000000), ref: 2DE0DB88
CharPrevA.USER32(?,00000000), ref: 2DE0DB94
isspace.MSVCR90 ref: 2DE0DBA0
CharNextA.USER32(00000000), ref: 2DE0DBA8
memset.MSVCR90 ref: 2DE0DBB6
malloc.MSVCR90 ref: 2DE0DBEF
malloc.MSVCR90 ref: 2DE0DC11
lstrlenA.KERNEL32(?), ref: 2DE0DC30
malloc.MSVCR90 ref: 2DE0DC3A
CharNextA.USER32(?), ref: 2DE0DC58

Strings

intl, xrefs: 2DE0DAA6
sList, xrefs: 2DE0DAA1

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Char$Next$mallocmemset$isspacelstrlen$ByteLeadPrevProfileString
String ID: intl$sList
API String ID: 1792931721-3643076868
Opcode ID: bf8fbc612642cf501f2d6c9593b33af8d70f793b01dd504c461bb7771a5d14c1
Instruction ID: 85f439606f4543b4cb57da21a7ab1d77fb6269e1b93010b229283cb028babac0
Opcode Fuzzy Hash: bf8fbc612642cf501f2d6c9593b33af8d70f793b01dd504c461bb7771a5d14c1
Instruction Fuzzy Hash: CE61F475900255AFDB118F65C8C4BBDBBF8EF0526AF10806AE985F7641DB7ACA40CF60

Function 2DE14681 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 188windowCOMMON

Download Yara Rule

APIs

Part of subcall function 2DE12240: LoadResource.KERNEL32(2DE00000,00000000,2DE00000,?,000000F0), ref: 2DE1227A
Part of subcall function 2DE12240: LockResource.KERNEL32(00000000), ref: 2DE12288
Part of subcall function 2DE12240: SendDlgItemMessageA.USER32(00000001,?,?,00000000,00000000), ref: 2DE122D8
Part of subcall function 2DE12240: FreeResource.KERNEL32(?), ref: 2DE122F0

EndDialog.USER32(?,00000003), ref: 2DE146BC

Part of subcall function 2DE06288: GetDlgItem.USER32(?,?), ref: 2DE06291

ShowWindow.USER32(?,00000000,?,00000000), ref: 2DE146E7
memset.MSVCR90 ref: 2DE14714
memset.MSVCR90 ref: 2DE14723
memset.MSVCR90 ref: 2DE1476C
GetDC.USER32(00000000), ref: 2DE147BC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 2DE147CB
ReleaseDC.USER32(00000000,?), ref: 2DE147F2
CreateFontIndirectW.GDI32(FFFFFFF5), ref: 2DE14828
CreateFontIndirectW.GDI32(FFFFFFF5), ref: 2DE1483B
CreateFontIndirectW.GDI32(FFFFFFF5), ref: 2DE1485F
GetWindow.USER32(?,00000005), ref: 2DE1486A
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 2DE1488A
GetObjectW.GDI32(00000000,0000005C,?), ref: 2DE1489A
SendMessageA.USER32(?,00000030,?,00000000), ref: 2DE148D0
GetWindow.USER32(?,00000002), ref: 2DE148DA

Strings

@, xrefs: 2DE1473E
@, xrefs: 2DE147A0

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CreateFontIndirectMessageResourceSendWindowmemset$Item$CapsDeviceDialogFreeLoadLockObjectReleaseShow
String ID: @$@
API String ID: 1409219205-149943524
Opcode ID: dfd6ae548f6e67369d0b8e4d9439b5f187f1b678dd6663c1e9508cf80ad897a4
Instruction ID: f1fc852bb682c3422807fdd19d565e8e8e16324926b382bc3b4a88d834d813cd
Opcode Fuzzy Hash: dfd6ae548f6e67369d0b8e4d9439b5f187f1b678dd6663c1e9508cf80ad897a4
Instruction Fuzzy Hash: E5616D71A042689EDB219B64CC44BEEBBF8BF18745F4045A9E20AF6290DB75DE80CF54

Function 2DE041B0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 106threadCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 2DE041EF
GetWindowThreadProcessId.USER32(?,?), ref: 2DE041FC
GetCurrentProcessId.KERNEL32 ref: 2DE04202
GetLastError.KERNEL32 ref: 2DE04225
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 2DE042AB
SetLastError.KERNEL32(?), ref: 2DE042E5

Strings

q2ub, xrefs: 2DE042D8
t2ub, xrefs: 2DE0426E
n2ub, xrefs: 2DE041CF
W, xrefs: 2DE041C3
r2ub, xrefs: 2DE0425D
openas, xrefs: 2DE04293
o2ub, xrefs: 2DE042D1
Unknown, xrefs: 2DE0429A

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ErrorLast$Process$CurrentParentThreadWindow
String ID: Unknown$W$n2ub$o2ub$openas$q2ub$r2ub$t2ub
API String ID: 3874811631-1827479352
Opcode ID: 664cb6042f8f2427c7b426443daa625d9676b55b495372ee7eb878a11a592400
Instruction ID: 5624995efa62e45a80d2015e29ddcb3a68734019700b062c3cd6d2bf9985900d
Opcode Fuzzy Hash: 664cb6042f8f2427c7b426443daa625d9676b55b495372ee7eb878a11a592400
Instruction Fuzzy Hash: E631F6B2600605EFD701AFE1CA88A9E7AF8FF1465BB118529E616F7210CF74DE40CB64

Function 2DE09F94 Relevance: 21.4, APIs: 9, Strings: 3, Instructions: 365comfileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 2DE09F9E
ReadClassStg.OLE32(?,?,?,00000000,?,?,00000000,?), ref: 2DE0A089
OleLoad.OLE32(?,2DE017D0,?,?), ref: 2DE0A0D6
_strdup.MSVCR90(?), ref: 2DE0A1DB
MultiByteToWideChar.KERNEL32(00000000,00000001,?,000000FF,?,00000104,?,00000000,?,?), ref: 2DE0A250
GetClassFile.OLE32(00000000), ref: 2DE0A25F
MultiByteToWideChar.KERNEL32(00000000,00000001,?,000000FF,?,00000104,2DE017D0,00000001,00000000,?,?,?), ref: 2DE0A2C3
OleCreateLinkToFile.OLE32(00000000), ref: 2DE0A2D2
OleSetContainedObject.OLE32(?,00000001), ref: 2DE0A31A

Strings

Note, xrefs: 2DE0A307, 2DE0A30C, 2DE0A30D
L"-, xrefs: 2DE0A128, 2DE0A0EB
HrThreadFuncWaitOnClose, xrefs: 2DE0A3D9

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ByteCharClassFileMultiWide$ContainedCreateH_prolog3_LinkLoadObjectRead_strdup
String ID: HrThreadFuncWaitOnClose$L"-$Note
API String ID: 1990140484-749375652
Opcode ID: ff8526354651f11c4d5cfd00d36eaeef83786d052839b11786698df0265a969d
Instruction ID: 1e9b259ac48dd1adc301392e6ee38f33c7b3e2d421be94de005b4b1ebb7b3f5d
Opcode Fuzzy Hash: ff8526354651f11c4d5cfd00d36eaeef83786d052839b11786698df0265a969d
Instruction Fuzzy Hash: 31D14C71604128AFCB169B64CC84FAA77B9EF48701F1540A4F609FB251DB74AF81CB60

Function 2DE09A90 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 180stringCOMMON

Download Yara Rule

APIs

_splitpath_s.MSVCR90 ref: 2DE09ADD

Part of subcall function 2DE08FD6: lstrlenA.KERNEL32(?), ref: 2DE08FE3

_splitpath_s.MSVCR90 ref: 2DE09B35
lstrlenA.KERNEL32(?), ref: 2DE09B5F
_makepath_s.MSVCR90 ref: 2DE09B8C
CloseHandle.KERNEL32(00000000), ref: 2DE09BCE

Part of subcall function 2DE08FD6: IsCharAlphaNumericA.USER32(?,?), ref: 2DE09017

Part of subcall function 2DE04609: _vsnprintf.MSVCR90 ref: 2DE0463A

CharPrevA.USER32(?,?), ref: 2DE09C00
lstrlenA.KERNEL32(?), ref: 2DE09C53
_makepath_s.MSVCR90 ref: 2DE09C81
GetLastError.KERNEL32 ref: 2DE09CA1
CloseHandle.KERNEL32(00000000), ref: 2DE09CCB

Strings

%s%x, xrefs: 2DE09C37
., xrefs: 2DE09AF2

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: lstrlen$CharCloseHandle_makepath_s_splitpath_s$AlphaErrorLastNumericPrev_vsnprintf
String ID: %s%x$.
API String ID: 3070513225-3101762996
Opcode ID: c380954a205d623cb66a27fe5a850227fcbf912c343e0c476c3aab25ebe947b6
Instruction ID: de830af3b0f30261b6ab76716317b26e3682d5680cbc4ed736ce115ce1889152
Opcode Fuzzy Hash: c380954a205d623cb66a27fe5a850227fcbf912c343e0c476c3aab25ebe947b6
Instruction Fuzzy Hash: 286139B690011CAEDB209F60CD84FEBB7BCEB25346F0045A5E65AF2141EA359F84CF64

Function 2DE036BC Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(olmapi32.dll,?,2DE03757), ref: 2DE036EB
GetProcAddress.KERNEL32(00000000,SetGuardValue), ref: 2DE03704
GetProcAddress.KERNEL32(00000000,GetGuardValue), ref: 2DE03711
GetProcAddress.KERNEL32(00000000,SetExemptValue), ref: 2DE0371E
GetProcAddress.KERNEL32(00000000,GetExemptValue), ref: 2DE0372B
GetProcAddress.KERNEL32(00000000,AssertGuardedAPIAllowed), ref: 2DE03738

Strings

GetExemptValue, xrefs: 2DE03720
GetGuardValue, xrefs: 2DE03706
SetGuardValue, xrefs: 2DE036FE
olmapi32.dll, xrefs: 2DE036E6
SetExemptValue, xrefs: 2DE03713
AssertGuardedAPIAllowed, xrefs: 2DE0372D

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AssertGuardedAPIAllowed$GetExemptValue$GetGuardValue$SetExemptValue$SetGuardValue$olmapi32.dll
API String ID: 667068680-308179802
Opcode ID: 2da1637b33e42520db35a5d7ec3998ebfb3160fb8f0dfab416e0f88474edc647
Instruction ID: 988fb480c345da6b462c81b053b744b3773b4339da8b9e9e132506be8564a9c1
Opcode Fuzzy Hash: 2da1637b33e42520db35a5d7ec3998ebfb3160fb8f0dfab416e0f88474edc647
Instruction Fuzzy Hash: FAF0A4729013116AC3016F799C4CBA67FF8EF95E16308009BF06AFF21ADEB89451CB55

Function 2DE036DC Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(olmapi32.dll,?,2DE03757), ref: 2DE036EB
GetProcAddress.KERNEL32(00000000,SetGuardValue), ref: 2DE03704
GetProcAddress.KERNEL32(00000000,GetGuardValue), ref: 2DE03711
GetProcAddress.KERNEL32(00000000,SetExemptValue), ref: 2DE0371E
GetProcAddress.KERNEL32(00000000,GetExemptValue), ref: 2DE0372B
GetProcAddress.KERNEL32(00000000,AssertGuardedAPIAllowed), ref: 2DE03738

Strings

GetExemptValue, xrefs: 2DE03720
GetGuardValue, xrefs: 2DE03706
SetGuardValue, xrefs: 2DE036FE
olmapi32.dll, xrefs: 2DE036E6
SetExemptValue, xrefs: 2DE03713
AssertGuardedAPIAllowed, xrefs: 2DE0372D

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AssertGuardedAPIAllowed$GetExemptValue$GetGuardValue$SetExemptValue$SetGuardValue$olmapi32.dll
API String ID: 667068680-308179802
Opcode ID: ffc7b254352cf169da9c06b4b7315b3856ebb7b7dee4b2775e132e7724cf2903
Instruction ID: e0cd10a272b55b308a936e0bffb4ee0005b5159f6a0e10c4fde9fcb6ec60735c
Opcode Fuzzy Hash: ffc7b254352cf169da9c06b4b7315b3856ebb7b7dee4b2775e132e7724cf2903
Instruction Fuzzy Hash: E5F090729013256AC3046F39CC4CFA6BEF8EB90E16B04045BB02AFB315DBB89410CE54

Function 2DE0BCEB Relevance: 19.6, APIs: 13, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 2DE0BD3B
EnableWindow.USER32(?,00000001), ref: 2DE0BD49
DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BD63
EnableWindow.USER32(?,00000001), ref: 2DE0BD6D
DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BD92
ShowWindow.USER32(?,00000000), ref: 2DE0BDB0
EnableWindow.USER32(?,00000000), ref: 2DE0BDBD
ShowWindow.USER32(?,00000000), ref: 2DE0BDCA
EnableWindow.USER32(?,00000000), ref: 2DE0BDD7
DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BE1E
DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BE3D
DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BE59
DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,0000000C), ref: 2DE0BE86

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Defer$Enable$Show$Rect
String ID:
API String ID: 3661885419-0
Opcode ID: eecf1b75bd186642706e7a15d1bb290a6188f4abe5dc8f695ac0815e82b51720
Instruction ID: 0ed2a44ee243fdbb2ef71b4a8379aa11c53314dec4cc464ba6735a971b866519
Opcode Fuzzy Hash: eecf1b75bd186642706e7a15d1bb290a6188f4abe5dc8f695ac0815e82b51720
Instruction Fuzzy Hash: 845195B6500609AFDB11DFA8CC84EEABBF9FF48345F004419F96A96260D771AD50DF60

Function 2DE08587 Relevance: 19.6, APIs: 13, Instructions: 103windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 2DE085A1
ScreenToClient.USER32(?,?), ref: 2DE085AA
GetWindowRect.USER32(?,?), ref: 2DE085CB
ScreenToClient.USER32(?,?), ref: 2DE085D4
GetWindowRect.USER32(?,?), ref: 2DE085EE
ScreenToClient.USER32(?,?), ref: 2DE08609
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 2DE08620
MoveWindow.USER32(?,?,?,?,00000001,00000000), ref: 2DE08635
SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 2DE08643
SendMessageA.USER32(?,00000441,00000000,00000000), ref: 2DE08654
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 2DE08662
GetWindowRect.USER32(?,?), ref: 2DE0866E
ScreenToClient.USER32(?,?), ref: 2DE08677

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$ClientRectScreen$MessageSend$Move
String ID:
API String ID: 442886372-0
Opcode ID: 13306a61e9a0b6b5bd1c820945d2b3ca7b5496e6a891c2c3e65446d3432abdfe
Instruction ID: 67756aeb0e198cde58ebb18b7465ba080efbe278f67839f37bd033683e832fd5
Opcode Fuzzy Hash: 13306a61e9a0b6b5bd1c820945d2b3ca7b5496e6a891c2c3e65446d3432abdfe
Instruction Fuzzy Hash: 0A41D276900609AFDB12DFA8CA45BDEBBF9FF08701F104465F612F6260D772AA10DB14

Function 2DE08C62 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 138fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE08C69
??_U@YAPAXI@Z.MSVCR90(00001000,00000030,2DE09EEC,00000000,?,?,00000014,2DE0A4D2), ref: 2DE08CA0

Part of subcall function 2DE13812: Mailbox.LIBCMT ref: 2DE159AE

Part of subcall function 2DE06995: LoadCursorA.USER32(00000000,?), ref: 2DE069A0
Part of subcall function 2DE06995: SetCursor.USER32(00000000), ref: 2DE069A7

SetCursor.USER32(L"-,00000000), ref: 2DE08CF7
??_V@YAXPAX@Z.MSVCR90(?), ref: 2DE08D03
GetLastError.KERNEL32 ref: 2DE08D3F
ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 2DE08DA9
GetLastError.KERNEL32 ref: 2DE08DB5
CloseHandle.KERNEL32(000000FF), ref: 2DE08DC9
SetCursor.USER32(L"-), ref: 2DE08DD2
??_V@YAXPAX@Z.MSVCR90(?), ref: 2DE08DDE

Part of subcall function 2DE10293: LoadStringW.USER32(?,?,?,00000200), ref: 2DE10398

Strings

L"-, xrefs: 2DE08CBA, 2DE08DCF, 2DE08CF2

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Cursor$ErrorLastLoad$CloseFileH_prolog3_catchHandleMailboxReadString
String ID: L"-
API String ID: 318333782-653488915
Opcode ID: c72aa40b642ab750a6b29e80ed70b053074ee9c90098a300b2bd53947873a5e2
Instruction ID: 4971d3a002306baf27dbb85bec56b530cf0803773d299f597d0516b688d12f68
Opcode Fuzzy Hash: c72aa40b642ab750a6b29e80ed70b053074ee9c90098a300b2bd53947873a5e2
Instruction Fuzzy Hash: D2513A71900209EFCB05AFA4C884AEDBBB9FF18715F108659F625BB291CB348E45CB60

Function 2DE0F1BA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 126registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00000001,?,00000000,?,80000000), ref: 2DE0F246
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 2DE0F26D
RegCloseKey.ADVAPI32(?), ref: 2DE0F29F
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00000001,?), ref: 2DE0F2DA
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 2DE0F301
GetSystemDefaultLCID.KERNEL32 ref: 2DE0F31B
RegCloseKey.ADVAPI32(?), ref: 2DE0F32F
GetSystemDefaultLCID.KERNEL32 ref: 2DE0F337

Strings

Software\Policies\Microsoft\Office\14.0\Common\LanguageResources, xrefs: 2DE0F1D2
UILanguage, xrefs: 2DE0F1FC
Software\Microsoft\Office\14.0\Common\LanguageResources, xrefs: 2DE0F1F2

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CloseDefaultOpenQuerySystemValue
String ID: Software\Microsoft\Office\14.0\Common\LanguageResources$Software\Policies\Microsoft\Office\14.0\Common\LanguageResources$UILanguage
API String ID: 1931360540-2478438763
Opcode ID: 8b7d7f2f51cf58a17fe12ffb29efd41d556ee8cc938cac258ad6e5ab258ae6ad
Instruction ID: 7c40d89992d10d377e8a6cbc057cf58f26daefa917ffd8804153a0443dfdc308
Opcode Fuzzy Hash: 8b7d7f2f51cf58a17fe12ffb29efd41d556ee8cc938cac258ad6e5ab258ae6ad
Instruction Fuzzy Hash: 0D514C76A00228DFEB22CF60CC81FEAB7B8BB49715F0040D5E509FA281DB759A85CF51

Function 2DE0BFE9 Relevance: 18.2, APIs: 12, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 2DE0C02A
ScreenToClient.USER32(?,?), ref: 2DE0C033
MoveWindow.USER32(?,?,?,?,00000001,00000000), ref: 2DE0C04C

Part of subcall function 2DE0BCEB: GetWindowRect.USER32(?,?), ref: 2DE0BD3B
Part of subcall function 2DE0BCEB: EnableWindow.USER32(?,00000001), ref: 2DE0BD49
Part of subcall function 2DE0BCEB: DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BD63
Part of subcall function 2DE0BCEB: EnableWindow.USER32(?,00000001), ref: 2DE0BD6D
Part of subcall function 2DE0BCEB: DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BD92
Part of subcall function 2DE0BCEB: DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BE1E
Part of subcall function 2DE0BCEB: DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BE3D

GetWindowRect.USER32(?,?), ref: 2DE0C0AB
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 2DE0C0DD
SendMessageA.USER32(?,00000441,00000000,00000000), ref: 2DE0C0ED
SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 2DE0C16A
BeginDeferWindowPos.USER32(0000000A), ref: 2DE0C16E
DeferWindowPos.USER32(00000000,?,00000000,?,?,?,?,0000000C), ref: 2DE0C18E
EndDeferWindowPos.USER32(?), ref: 2DE0C1B7
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 2DE0C1C6
RedrawWindow.USER32(?,00000000,00000000,00000585), ref: 2DE0C1D4

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Defer$MessageRectSend$EnableMove$BeginClientRedrawScreen
String ID:
API String ID: 245351979-0
Opcode ID: 392ea8f409f4386b18b170c153050fe4b01714af582ebd3f89f5033f5cffc7eb
Instruction ID: 295d596dd3f76bd9212eee26ef93498588e950c10c010ea7f913e2cbf4e7fe7c
Opcode Fuzzy Hash: 392ea8f409f4386b18b170c153050fe4b01714af582ebd3f89f5033f5cffc7eb
Instruction Fuzzy Hash: 37513E72600B05AFDB21DFA4CD85F9ABBF5FB08705F104919E696EA690C775E910CB04

Function 6C9005DE Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C900297: CreateFileW.KERNEL32(?,00000000,?,6C900687,?,?,00000000,?,6C900687,?,0000000C), ref: 6C9002B4

GetLastError.KERNEL32 ref: 6C9006F2
__dosmaperr.LIBCMT ref: 6C9006F9
GetFileType.KERNEL32(00000000), ref: 6C900705
GetLastError.KERNEL32 ref: 6C90070F
__dosmaperr.LIBCMT ref: 6C900718
CloseHandle.KERNEL32(00000000), ref: 6C900738
CloseHandle.KERNEL32(6C8F85C2), ref: 6C900885
GetLastError.KERNEL32 ref: 6C9008B7
__dosmaperr.LIBCMT ref: 6C9008BE

Strings

H, xrefs: 6C900843

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 6a6017600685a686db84439d27ffb70378f80faca1b11dd50f5d5bf23bc2e373
Instruction ID: 18e9ab0619ed906b306d51282b73ef8bb1a0db93082cb9fa3bd2522850f4810e
Opcode Fuzzy Hash: 6a6017600685a686db84439d27ffb70378f80faca1b11dd50f5d5bf23bc2e373
Instruction Fuzzy Hash: 2CA11332B181989FCF199F68C851BAD3BB5AB47328F28025DE815DB791CB358816CB51

Function 2DE0F729 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 171stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 2DE0F7D8
GetACP.KERNEL32(00000000,?,000000FF,?,000001FC), ref: 2DE0F7F2
MultiByteToWideChar.KERNEL32(00000000), ref: 2DE0F7F9
GetModuleHandleW.KERNEL32(mso.dll), ref: 2DE0F8C8
MessageBoxW.USER32(00000000,?,00000000), ref: 2DE0F923
CallNextHookEx.USER32(?,?,?), ref: 2DE0F93C

Strings

%ld - [%08lX], xrefs: 2DE0F87D
[%08lX], xrefs: 2DE0F8A2
%ld - [%08lX:%08lX], xrefs: 2DE0F855
mso.dll, xrefs: 2DE0F8C3

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ByteCallCharHandleHookMessageModuleMultiNextWidelstrlen
String ID: %ld - [%08lX:%08lX]$%ld - [%08lX]$[%08lX]$mso.dll
API String ID: 3435520019-1696869425
Opcode ID: 68f3c54ecd80c65536ec49c389a65933bee6bc23486708add81df32937fdc499
Instruction ID: 6632497b15fad154614427512545517cd3e14c49dc6dc6b80a62fbfdef9efb69
Opcode Fuzzy Hash: 68f3c54ecd80c65536ec49c389a65933bee6bc23486708add81df32937fdc499
Instruction Fuzzy Hash: 015112B2A00204AEE7059F74CC44FBA33B9EB84B06F108564F716F6292EE35CD55CB65

Function 2DE05300 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 155windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE05307

Part of subcall function 2DE050C9: GetModuleHandleW.KERNEL32(KERNEL32), ref: 2DE050CF
Part of subcall function 2DE050C9: GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 2DE050E9
Part of subcall function 2DE050C9: GetProcAddress.KERNEL32(00000000,GetSystemDEPPolicy), ref: 2DE050F3
Part of subcall function 2DE050C9: SetProcessDEPPolicy.KERNEL32(00000001), ref: 2DE05106

malloc.MSVCR90 ref: 2DE0533A
malloc.MSVCR90 ref: 2DE0534B
LoadStringW.USER32(000089E8,00000100), ref: 2DE05378
LoadStringW.USER32(000089E9,00000100), ref: 2DE05394
CoBuildVersion.OLE32 ref: 2DE0539E
CoRegisterClassObject.OLE32(2DE01870,00000000,00000004,00000001,?,00000000), ref: 2DE0542A

Part of subcall function 2DE107A6: malloc.MSVCR90 ref: 2DE107AD
Part of subcall function 2DE107A6: memset.MSVCR90 ref: 2DE107C5

CoRegisterClassObject.OLE32(2DE01880,00000000,00000004,00000001,?), ref: 2DE0548A
LoadIconA.USER32(000088B8), ref: 2DE054D3

Strings

P'-, xrefs: 2DE054E5

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Loadmalloc$AddressClassObjectProcRegisterString$BuildH_prolog3_catchHandleIconModulePolicyProcessVersionmemset
String ID: P'-
API String ID: 1755118194-2584166019
Opcode ID: 28f7e23118dc3acc643fd7b8ac87c173cb4aaf25c63295a351871c1544e6cff4
Instruction ID: e9248fa266bd0ab0321e40bbad4e779263de8f3c427335b518fade255b8144fc
Opcode Fuzzy Hash: 28f7e23118dc3acc643fd7b8ac87c173cb4aaf25c63295a351871c1544e6cff4
Instruction Fuzzy Hash: 1951A171604301EAEB019BB48884BBE77F9EB54702F114429E656F7281DF74CE45CB75

Function 2DE03FCE Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

MonitorFromWindow.USER32(?,00000002), ref: 2DE03FF3
GetMonitorInfoA.USER32(00000000,00000028), ref: 2DE04002
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 2DE04020
GetWindowRect.USER32(00000000,?), ref: 2DE0403A
GetWindowRect.USER32(?,?), ref: 2DE0404F
OffsetRect.USER32(?,?,?), ref: 2DE04071
OffsetRect.USER32(?,?,?), ref: 2DE04083
OffsetRect.USER32(?,?,?), ref: 2DE04095
SetWindowPos.USER32(?,00000000,?,00000000,00000000,00000000,00000015), ref: 2DE040F3

Strings

(, xrefs: 2DE03FE2

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Rect$Window$Offset$InfoMonitor$FromParametersSystem
String ID: (
API String ID: 4041948150-3887548279
Opcode ID: bcdddc2fbb7ce1fd213c2208a322fd5db06f06bde79b51b33d8f3d453df6a6b7
Instruction ID: 77c544383c1879327f06983830d1c02703d5717c1e0533ad171fb3cd03f375ce
Opcode Fuzzy Hash: bcdddc2fbb7ce1fd213c2208a322fd5db06f06bde79b51b33d8f3d453df6a6b7
Instruction Fuzzy Hash: D6411672900129AFDF01DEA8CD49EEEB7B9FF09312F018515F905FB140DA75AA05CAA1

Function 2DE07F1D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 2DE07F43

Strings

ToolbarWindow32, xrefs: 2DE07FA2

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Color
String ID: ToolbarWindow32
API String ID: 2811717613-4104838417
Opcode ID: 2ab60dcac5baf6bb9fae96b4d6f8d27d49f2f4fdf497751750df43edbe0d005e
Instruction ID: c797d141d1d3883edc3d9a7a90880dc866bc37ce7b681b71bf71d112a2fc20fe
Opcode Fuzzy Hash: 2ab60dcac5baf6bb9fae96b4d6f8d27d49f2f4fdf497751750df43edbe0d005e
Instruction Fuzzy Hash: 1F51D4B1D4438CAEEB119FA88C81BEEBFB9FF59744F40442DE185B7282C6750805CB25

Function 2DE16050 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 2DE16055
LoadCursorA.USER32(00000000,00007F02), ref: 2DE160C7
LoadCursorA.USER32(00000000,00007F00), ref: 2DE160D2
GetModuleHandleA.KERNEL32(USER32.DLL), ref: 2DE160E4
GetProcAddress.KERNEL32(00000000,SetScrollInfo), ref: 2DE160F8
GetProcAddress.KERNEL32(00000000,GetScrollInfo), ref: 2DE16103

Strings

GetScrollInfo, xrefs: 2DE160FA
USER32.DLL, xrefs: 2DE160DF
SetScrollInfo, xrefs: 2DE160F2

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressCursorLoadProc$HandleModuleVersion
String ID: GetScrollInfo$SetScrollInfo$USER32.DLL
API String ID: 3295075773-1004610577
Opcode ID: 1eba720bb6c36f43fd72991fa9cef78ea57288b4313243eb17b2792ac18ffcbb
Instruction ID: c47a7faa6d8b0227adf5dab4a68e6e4710002941c9648e46e0793025975227e8
Opcode Fuzzy Hash: 1eba720bb6c36f43fd72991fa9cef78ea57288b4313243eb17b2792ac18ffcbb
Instruction Fuzzy Hash: A611B4B1B147518FC7289F7A888052ABAE9FB89606341493EE58BF3B51DA34E805CF54

Function 2DE10444 Relevance: 15.2, APIs: 10, Instructions: 228stringCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 2DE10454
lstrlenW.KERNEL32(?,00000007,?), ref: 2DE105C3
lstrlenW.KERNEL32(?), ref: 2DE105D1
GetACP.KERNEL32(00000000,?,000000FF,?,?,00000000,00000000,-00000013,?), ref: 2DE1068B
WideCharToMultiByte.KERNEL32(00000000), ref: 2DE10694
GetACP.KERNEL32(00000000,?,000000FF,?,?,00000000,00000000), ref: 2DE106C0
WideCharToMultiByte.KERNEL32(00000000), ref: 2DE106C3

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$Read
String ID:
API String ID: 3283085596-0
Opcode ID: a68fe9bf361fa882e981f7bc5e13af20647d4b7a11db2f98ea1b66025d25eb58
Instruction ID: c8b53590c37ef724fd5d91c9f448a7f496b27f7cba7d678864240d19d94bf70f
Opcode Fuzzy Hash: a68fe9bf361fa882e981f7bc5e13af20647d4b7a11db2f98ea1b66025d25eb58
Instruction Fuzzy Hash: C2910976A00109EFCB05CF98C980EA9BBF5FF48314B258499E915BB251DB36EE41DF90

Function 2DE18822 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 67registrylibraryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion,00000000,00020019,?), ref: 2DE18862
RegQueryValueExW.ADVAPI32(?,CommonFilesDir,00000000,00000000,?,0000020A), ref: 2DE1888C
RegCloseKey.ADVAPI32(?), ref: 2DE188A2
LoadLibraryW.KERNEL32(?,\Microsoft Shared\office14\mso.dll,?,00000105), ref: 2DE188E1

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 2DE18846
CommonFilesDir, xrefs: 2DE18881
mso.dll, xrefs: 2DE188ED
\Microsoft Shared\office14\mso.dll, xrefs: 2DE188D0

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CloseLibraryLoadOpenQueryValue
String ID: CommonFilesDir$Software\Microsoft\Windows\CurrentVersion$\Microsoft Shared\office14\mso.dll$mso.dll
API String ID: 3751545530-1101215619
Opcode ID: c8d833a188daccb41fc1b09bb0f4e7fe9d4bef7075bbbddee5e7968869715a63
Instruction ID: 370d49b2195adcbbf26a1951422e1d59c8951ebf9aa13338ddd935fd53c0911b
Opcode Fuzzy Hash: c8d833a188daccb41fc1b09bb0f4e7fe9d4bef7075bbbddee5e7968869715a63
Instruction Fuzzy Hash: E1217F31A4522DABC721EA64CCCDEEEB7B8EB14742F4000A5E55AF6251DE709E84CB94

Function 2DE0381E Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 55libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 2DE03837
GetFileAttributesW.KERNEL32(???.???), ref: 2DE03842
GetModuleHandleA.KERNEL32(Unicows.dll), ref: 2DE0384D
GetProcAddress.KERNEL32(00000000,?), ref: 2DE03875
GetVersion.KERNEL32 ref: 2DE03888
GetProcAddress.KERNEL32(00000000,?), ref: 2DE038A8

Strings

???.???, xrefs: 2DE0383D
Unicows.dll, xrefs: 2DE03848

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressProcVersion$AttributesFileHandleModule
String ID: ???.???$Unicows.dll
API String ID: 3183861727-2162356649
Opcode ID: e8e219809b013d43b3d314c81efa147e24bc2402a84ff571fa5e9cc5c0b92630
Instruction ID: fa81cac4052d2628061e5d0508ff01a45a3444face8aa59a4143dbbbde494ed5
Opcode Fuzzy Hash: e8e219809b013d43b3d314c81efa147e24bc2402a84ff571fa5e9cc5c0b92630
Instruction Fuzzy Hash: DB119132600206EFD7019FE9C848B69B7F8EF04756B1040A5F845FB251DB78E910CB24

Function 6C8E1920 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,6C8DCF5A,6C8DCF5C,00000000,00000000,7B4BA14C,?,?,?,6C8DCF5A,00000000,?,6C8D3AA5,6C8DCF5A,0000000C), ref: 6C8E19A9
MultiByteToWideChar.KERNEL32(00000000,00000000,6C8DCF5A,?,00000000,00000000,?,6C8DCF5A,00000000,?,6C8D3AA5,6C8DCF5A), ref: 6C8E1A24
SysAllocString.OLEAUT32(00000000), ref: 6C8E1A2F
_com_issue_error.COMSUPP ref: 6C8E1A58
_com_issue_error.COMSUPP ref: 6C8E1A62
GetLastError.KERNEL32(80070057,7B4BA14C,?,?,?,6C8DCF5A,00000000,?,6C8D3AA5,6C8DCF5A,0000000C,?,6C8DCF5A), ref: 6C8E1A67
_com_issue_error.COMSUPP ref: 6C8E1A7A
GetLastError.KERNEL32(00000000,?,?,?,6C8DCF5A,00000000,?,6C8D3AA5,6C8DCF5A,0000000C,?,6C8DCF5A), ref: 6C8E1A90
_com_issue_error.COMSUPP ref: 6C8E1AA3

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: bc889f977c46543d857ae41a73b0726673fe47b70cb55173c2ea68ba6725fb13
Instruction ID: 756918b99bd01fdcd0480f26254200bdf5cdb07947fb73846d2168516d27266a
Opcode Fuzzy Hash: bc889f977c46543d857ae41a73b0726673fe47b70cb55173c2ea68ba6725fb13
Instruction Fuzzy Hash: 7E412872B042199BCB20DF68CA40BEEBBB8AB4E754F20463DE515E7B41D734D544CBA0

Function 6C8E5646 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6C8E5765
___TypeMatch.LIBVCRUNTIME ref: 6C8E5873
_UnwindNestedFrames.LIBCMT ref: 6C8E59C5
CallUnexpected.LIBVCRUNTIME ref: 6C8E59E0

Strings

csm, xrefs: 6C8E579C
csm, xrefs: 6C8E5683
csm, xrefs: 6C8E56F0

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 2bfab5c363702beb46ae8b9f1aa2629cd3561b294ad2a863858529e096e841d1
Instruction ID: 503aa5d7e4449b3d82d9ab5354676608193e9b0df341705cb21837b33d0edfa1
Opcode Fuzzy Hash: 2bfab5c363702beb46ae8b9f1aa2629cd3561b294ad2a863858529e096e841d1
Instruction Fuzzy Hash: 62B1AE31800319EFCF24DFA5DA809DEB7B5FF0E318B14496AE8146BA11C731EA65CB91

Function 2DE0C374 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 226windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE0C37B
DrawFocusRect.USER32(?,?), ref: 2DE0C3D9
PatBlt.GDI32(?,?,?,?,?,00FF0062), ref: 2DE0C421

Strings

..., xrefs: 2DE0C45F

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: DrawFocusH_prolog3_catchRect
String ID: ...
API String ID: 1217028765-440645147
Opcode ID: bcabece07dfa2d26e0098002f728779582adff982a86f0164d042d6ce9e659aa
Instruction ID: 923dcaa54c14ee2e312f531f88915f41705df3fbee8760594fb78c26d6aa5b86
Opcode Fuzzy Hash: bcabece07dfa2d26e0098002f728779582adff982a86f0164d042d6ce9e659aa
Instruction Fuzzy Hash: 48914670904249DFDB15CFA4C994AAEBBB5FF28305F21415CEA46B7291DF30AE09CB60

Function 2DE185D0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77registryCOMMON

Download Yara Rule

APIs

memset.MSVCR90 ref: 2DE18605
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion,00000000,00020019,000000FF), ref: 2DE18659
RegQueryValueExW.ADVAPI32(000000FF,CommonFilesDir,00000000,00000000,?,0000020A), ref: 2DE1867E

Part of subcall function 2DE18540: LoadLibraryW.KERNEL32(?), ref: 2DE185BC

RegCloseKey.ADVAPI32(000000FF), ref: 2DE186CA

Strings

Microsoft Shared\office14\, xrefs: 2DE1861A
Software\Microsoft\Windows\CurrentVersion, xrefs: 2DE1864F
CommonFilesDir, xrefs: 2DE18673

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CloseLibraryLoadOpenQueryValuememset
String ID: CommonFilesDir$Microsoft Shared\office14\$Software\Microsoft\Windows\CurrentVersion
API String ID: 79794857-3032397660
Opcode ID: 36f6e2e8efc4a1afc073490d849ddbc5e79cd0c02741d218dd8b772c7fc5326f
Instruction ID: 3179c54ee98db966a47d3ae70f41689afa1a0afbf442958fca9fbd6fd9890271
Opcode Fuzzy Hash: 36f6e2e8efc4a1afc073490d849ddbc5e79cd0c02741d218dd8b772c7fc5326f
Instruction Fuzzy Hash: 9C217C71A0422CAFDB22DB64CC80EEAB7BCEB08754F4001A5A559F6191DA30DF85CFA4

Function 2DE0FB74 Relevance: 12.2, APIs: 8, Instructions: 194stringthreadCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,?,80000000), ref: 2DE0FBFE
lstrlenA.KERNEL32(00000000,?,80000000), ref: 2DE0FC06
LoadStringW.USER32(?,?,?,00000200), ref: 2DE0FC79
GetACP.KERNEL32(00000000,00000201,000000FF,?,00000201,00000201,?,?,80000000), ref: 2DE0FCEA
MultiByteToWideChar.KERNEL32(00000000), ref: 2DE0FCF1
GetCurrentThreadId.KERNEL32 ref: 2DE0FCF7
SetWindowsHookExW.USER32(000000FF,2DE0F729,00000000,00000000), ref: 2DE0FD06
UnhookWindowsHookEx.USER32(00000000), ref: 2DE0FD70

Part of subcall function 2DE0F61C: GetModuleHandleW.KERNEL32(mso.dll,?,2DE0FBDC,?,00000201,?,?,80000000), ref: 2DE0F624

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: HookWindowslstrlen$ByteCharCurrentHandleLoadModuleMultiStringThreadUnhookWide
String ID:
API String ID: 4184960637-0
Opcode ID: 065262e888bcc708b1f284206782184192a233539428be98c1ed4cef9a25e176
Instruction ID: 9e26e9592c1b3ef935f090cda8942afb7a38772dde86cd67278933ade216867e
Opcode Fuzzy Hash: 065262e888bcc708b1f284206782184192a233539428be98c1ed4cef9a25e176
Instruction Fuzzy Hash: 9A616F72A00205EFCB01DFA4C985A6EBBB4FF08756F10452AFA16F7290CB34D964CB95

Function 2DE172DD Relevance: 12.1, APIs: 8, Instructions: 108COMMON

Download Yara Rule

APIs

??_V@YAXPAX@Z.MSVCR90(?,?,?,?,?,2DE15264,?,000000FF,?,?,?,2DE0A56B,?,?), ref: 2DE172FC
??_U@YAPAXI@Z.MSVCR90(?,?,?,?,?,2DE15264,?,000000FF,?,?,?,2DE0A56B,?,?), ref: 2DE1731A
memset.MSVCR90 ref: 2DE17326
memset.MSVCR90 ref: 2DE1734F
??_U@YAPAXI@Z.MSVCR90(?,?,?,?,?,2DE15264,?,000000FF,?,?,?,2DE0A56B,?,?), ref: 2DE1739F
memcpy.MSVCR90(00000000,?,?,?,?,?,?,?,2DE15264,?,000000FF,?,?,?,2DE0A56B,?), ref: 2DE173B1
memset.MSVCR90 ref: 2DE173C7
??_V@YAXPAX@Z.MSVCR90(?,?,00000000,?,00000000,?,?,?,?,?,?,?,2DE15264,?,000000FF), ref: 2DE173CF

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: cab2f0a68c08a215e292c57bf758677830bf06002173c9b7a8a0609d3745db6e
Instruction ID: 01e67216fbd168e9696475533a605f4c877463738e65f529f3b1af394df0e4cf
Opcode Fuzzy Hash: cab2f0a68c08a215e292c57bf758677830bf06002173c9b7a8a0609d3745db6e
Instruction Fuzzy Hash: 0131C5B1704700DBD721AF69CCC2E1EB7D5EB44A54B21C92DEA6AFB640DA30EC44CB40

Function 2DE13210 Relevance: 12.1, APIs: 8, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE13217
CloseHandle.KERNEL32(?,00000004,2DE04F48,00000004,2DE04F78), ref: 2DE13234
Mailbox.LIBCMT ref: 2DE13266
Mailbox.LIBCMT ref: 2DE13277
Mailbox.LIBCMT ref: 2DE13288
Mailbox.LIBCMT ref: 2DE13299
Mailbox.LIBCMT ref: 2DE132AA
??3@YAXPAX@Z.MSVCR90(00000000,00000004,2DE04F48,00000004,2DE04F78), ref: 2DE132DE

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Mailbox$??3@CloseH_prolog3Handle
String ID:
API String ID: 1655960846-0
Opcode ID: f279f09d6a0b4f1a54489b2b22a88a0736dae57d32d307f9707cba6c43cbac02
Instruction ID: f50f39fb23b1299c94324f8a5f5e8def76818ed0c64aaa32ecb0b1b37edad16d
Opcode Fuzzy Hash: f279f09d6a0b4f1a54489b2b22a88a0736dae57d32d307f9707cba6c43cbac02
Instruction Fuzzy Hash: A92136747047029BCB24AFA18491A6DBBE2FF64304F52092DC3DA77681CE71ED88CB91

Function 2DE0F952 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

isdigit.MSVCR90 ref: 2DE0F9B4
isdigit.MSVCR90 ref: 2DE0FB18

Strings

z, xrefs: 2DE0FAD9

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: isdigit
String ID: z
API String ID: 2326231117-1657960367
Opcode ID: ac17b01145ba7ca2fbfc3fa967c8219a4834eb07b47c83a8880dca6859013e69
Instruction ID: ecc6e3a7f133e5940974b534aaebc0fa7f412d777ee8df15538e836b9cb1db30
Opcode Fuzzy Hash: ac17b01145ba7ca2fbfc3fa967c8219a4834eb07b47c83a8880dca6859013e69
Instruction Fuzzy Hash: B471A271D0061AEFCF01DFA4C840AAEB7B4FF8431AF608556E952BB280DB349A61CF51

Function 2DE0657A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 166windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 2DE06584

Part of subcall function 2DE1127F: __EH_prolog3_catch.LIBCMT ref: 2DE11286

Part of subcall function 2DE0646A: GetWindowRect.USER32(?,?), ref: 2DE0647F
Part of subcall function 2DE0646A: ScreenToClient.USER32(?,?), ref: 2DE0648C
Part of subcall function 2DE0646A: MoveWindow.USER32(?,?,?,?,00000001,00000000), ref: 2DE064A2
Part of subcall function 2DE0646A: SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 2DE064D5
Part of subcall function 2DE0646A: MoveWindow.USER32(?,00000000,?,?,?,00000001), ref: 2DE064EA
Part of subcall function 2DE0646A: SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 2DE064F8
Part of subcall function 2DE0646A: RedrawWindow.USER32(?,00000000,00000000,00000585), ref: 2DE06508

GetDlgItem.USER32(00000001,000088C2), ref: 2DE065CD

Part of subcall function 2DE04745: _wcsicmp.MSVCR90 ref: 2DE04757

EnableWindow.USER32(?,00000000), ref: 2DE06778
SetWindowTextW.USER32(?,?), ref: 2DE0679E
SetFocus.USER32(?), ref: 2DE067BA

Strings

IPM.Conflict.Message, xrefs: 2DE065E4

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$MessageMoveSend$ClientEnableFocusH_prolog3_catchH_prolog3_catch_ItemRectRedrawScreenText_wcsicmp
String ID: IPM.Conflict.Message
API String ID: 3324545711-3689180561
Opcode ID: 89563ce0b3311e031b671a500e1268eac639902acf466ff22f93cf609b6259ac
Instruction ID: b3752bfa17b56596601b3db8dcab7f0adfb8ff7e85b8668bb76bba10a4b40695
Opcode Fuzzy Hash: 89563ce0b3311e031b671a500e1268eac639902acf466ff22f93cf609b6259ac
Instruction Fuzzy Hash: F7518370E4825A9BDB11DB54CD81BAD73A4EF20302F4541A8AA49BF285DE34AF45CF91

Function 2DE071EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE071F3
memset.MSVCR90 ref: 2DE07206

Part of subcall function 2DE052D6: GetProcAddress.KERNEL32(00000000,00000142), ref: 2DE052F4

GetWindowRect.USER32(?,?), ref: 2DE072E8
PostMessageA.USER32(00000001,00000111,0000891C,00000000), ref: 2DE07357
SetCursor.USER32(?), ref: 2DE07360

Strings

D, xrefs: 2DE07296

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressCursorH_prolog3MessagePostProcRectWindowmemset
String ID: D
API String ID: 308528978-2746444292
Opcode ID: 96d0d382f976984e268bdff0539b49b3f1270286629b71aa9eb46c8836169717
Instruction ID: 634d7ecd115178018482c171c355e894373862168e1187e81785f10fcec3337e
Opcode Fuzzy Hash: 96d0d382f976984e268bdff0539b49b3f1270286629b71aa9eb46c8836169717
Instruction Fuzzy Hash: FD415070A04605DFDB11EFA0C889FAEBBB9FF44706F20451CE65ABB291DB35A905CB11

Function 6C8E4DE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6C8E4E17
___except_validate_context_record.LIBVCRUNTIME ref: 6C8E4E1F
_ValidateLocalCookies.LIBCMT ref: 6C8E4EA8
__IsNonwritableInCurrentImage.LIBCMT ref: 6C8E4ED3
_ValidateLocalCookies.LIBCMT ref: 6C8E4F28

Strings

csm, xrefs: 6C8E4EBD

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: bd981ace971ecf3a411b894a973b3c030490cefc78a1d0fd5bd573ba25962dd3
Instruction ID: f2eb5d60866becd2814c63a9c687c4881cec84c9212b291cea1272048b927853
Opcode Fuzzy Hash: bd981ace971ecf3a411b894a973b3c030490cefc78a1d0fd5bd573ba25962dd3
Instruction Fuzzy Hash: EF417534A002099FCF20CFADC944ADE7BB5AFCA328F14C969D9189BB51D731D915CB91

Function 2DE13EC3 Relevance: 10.6, APIs: 7, Instructions: 112windowCOMMON

Download Yara Rule

APIs

Part of subcall function 2DE15D40: GetFocus.USER32 ref: 2DE15D44
Part of subcall function 2DE15D40: GetParent.USER32(00000000), ref: 2DE15D6C
Part of subcall function 2DE15D40: GetWindowLongA.USER32(?,000000F0), ref: 2DE15D87
Part of subcall function 2DE15D40: GetParent.USER32(?), ref: 2DE15D95
Part of subcall function 2DE15D40: GetDesktopWindow.USER32 ref: 2DE15D99
Part of subcall function 2DE15D40: SendMessageA.USER32(00000000,0000014F,00000000,00000000), ref: 2DE15DAD

Part of subcall function 2DE15923: __EH_prolog3.LIBCMT ref: 2DE1592A
Part of subcall function 2DE15923: GetLastError.KERNEL32(00000004,2DE10854,00000004,2DE109B6,00000000,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE1592F

GetMenu.USER32(?), ref: 2DE13F12
GetMenu.USER32(?), ref: 2DE13F27
GetMenuItemCount.USER32(00000000), ref: 2DE13F30
GetSubMenu.USER32(00000000,00000000), ref: 2DE13F41
GetMenuItemCount.USER32(?), ref: 2DE13F65
GetMenuItemID.USER32(?,?), ref: 2DE13F7F
GetMenuItemID.USER32(?,00000000), ref: 2DE13FA2

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Menu$Item$CountParentWindow$DesktopErrorFocusH_prolog3LastLongMessageSend
String ID:
API String ID: 666752450-0
Opcode ID: 9be9fc55af222156d3f25f59f4677193daa099dbe6c32b64145a41323d57a954
Instruction ID: d26a778a9b28378a9b9412e49421c64afadef5f417993a0c201165685ec7c745
Opcode Fuzzy Hash: 9be9fc55af222156d3f25f59f4677193daa099dbe6c32b64145a41323d57a954
Instruction Fuzzy Hash: 17417971A04208ABCF019F68CC809EEBBB6FF48314F20856AE951F6251DB31DD41DF60

Function 2DE15A21 Relevance: 10.6, APIs: 7, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 2DE15923: __EH_prolog3.LIBCMT ref: 2DE1592A
Part of subcall function 2DE15923: GetLastError.KERNEL32(00000004,2DE10854,00000004,2DE109B6,00000000,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE1592F

_msize.MSVCR90 ref: 2DE15A7F
_msize.MSVCR90 ref: 2DE15A99
free.MSVCR90 ref: 2DE15AA1
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCR90 ref: 2DE15AB1
malloc.MSVCR90 ref: 2DE15ABF
malloc.MSVCR90 ref: 2DE15AD2
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCR90 ref: 2DE15ADB

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ?_set_new_handler@@_msizemalloc$ErrorH_prolog3Lastfree
String ID:
API String ID: 3808399026-0
Opcode ID: a9b4a528f875a6e218f063e785ad0623a17c94ad4a478d07bee21cb377004e87
Instruction ID: fcf538b6cc03881a03c65b434e03e0854ad692f342596e42acc1d1a290db2e0b
Opcode Fuzzy Hash: a9b4a528f875a6e218f063e785ad0623a17c94ad4a478d07bee21cb377004e87
Instruction Fuzzy Hash: 84215E71B48B059FEB10ABB5D880B6AB7F8FF00655B21852AD645F3680EF35ED04CB64

Function 2DE15F07 Relevance: 10.6, APIs: 7, Instructions: 75stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 2DE15F24
IsWindowUnicode.USER32(?), ref: 2DE15F2D
SetWindowTextW.USER32(?,?), ref: 2DE15F66

Part of subcall function 2DE15CD7: IsWindowUnicode.USER32(?), ref: 2DE15CE0
Part of subcall function 2DE15CD7: GetWindowTextW.USER32(?,00000100,?), ref: 2DE15CF3

lstrcmpW.KERNEL32(?,?,?,?,00000100,?,00000000), ref: 2DE15F5A
lstrcmpA.KERNEL32(?,00000000,?,?,00000100,?,00000001,?,00000000), ref: 2DE15FA1
SetWindowTextA.USER32(?,00000000), ref: 2DE15FAD
free.MSVCR90 ref: 2DE15FB4

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Text$Unicodelstrcmp$freelstrlen
String ID:
API String ID: 1265395221-0
Opcode ID: 786049158eaa192aea86022bd4c83b0f3c1c87c26f6fc3538a559443fe02bcca
Instruction ID: 87922f438859e4ced7c0ebfa7fd4c1cdc410c9255412a9d22884fd765a7b883f
Opcode Fuzzy Hash: 786049158eaa192aea86022bd4c83b0f3c1c87c26f6fc3538a559443fe02bcca
Instruction Fuzzy Hash: 121130B2705108ABDB119AA4CCC4EBFB3BCEB08B45B00456AF642F6241DF38DE44C665

Function 6C8F2B5E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,7B4BA14C,?,6C8F2C6B,?,?,00000000,00000000), ref: 6C8F2C1F

Strings

api-ms-, xrefs: 6C8F2BB5
ext-ms-, xrefs: 6C8F2BC9

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: cf3a35656ce2901ec22b742315da6f61fb974a65747785bd2cb9092fb531ba5e
Instruction ID: 688a73315bd12e11e1441e28152e3578675e73c6214d5e0e476294163fc66f2d
Opcode Fuzzy Hash: cf3a35656ce2901ec22b742315da6f61fb974a65747785bd2cb9092fb531ba5e
Instruction Fuzzy Hash: 54213B3170A661F7CB319F69DD58A4B37789B537B4F210A14ED25EB680D734EA02CA90

Function 2DE0646A Relevance: 10.6, APIs: 7, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 2DE0647F
ScreenToClient.USER32(?,?), ref: 2DE0648C
MoveWindow.USER32(?,?,?,?,00000001,00000000), ref: 2DE064A2
SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 2DE064D5
MoveWindow.USER32(?,00000000,?,?,?,00000001), ref: 2DE064EA
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 2DE064F8
RedrawWindow.USER32(?,00000000,00000000,00000585), ref: 2DE06508

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$MessageMoveSend$ClientRectRedrawScreen
String ID:
API String ID: 4152145988-0
Opcode ID: 04a9ca4bb46a16451840b574f6294cfb57172a5967cbfa26b447275fba0050d6
Instruction ID: b5ac50140a410b60ad33f8386210b9b37e20caadc3da37fb2d49580a715190a1
Opcode Fuzzy Hash: 04a9ca4bb46a16451840b574f6294cfb57172a5967cbfa26b447275fba0050d6
Instruction Fuzzy Hash: 18114232200654BFDB215FA5CC49F5B7FB9FB48B41F048418F646BA1A0CBB6E510DB54

Function 2DE141D3 Relevance: 10.6, APIs: 7, Instructions: 60COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(2DE00000,?,00000005,00000000,?,00000000,?,?,?,2DE14967,?,?,00000000,?,?), ref: 2DE141EC
LoadResource.KERNEL32(2DE00000,00000000,?,2DE14967,?,?,00000000,?,?,?,2DE07D54,?,?,?,00000000,?), ref: 2DE141FA
LockResource.KERNEL32(00000000,?,2DE14967,?,?,00000000,?,?,?,2DE07D54,?,?,?,00000000,?,?), ref: 2DE14208
SizeofResource.KERNEL32(2DE00000,00000000,?,2DE14967,?,?,00000000,?,?,?,2DE07D54,?,?,?,00000000,?), ref: 2DE14217
malloc.MSVCR90 ref: 2DE1422D
memcpy.MSVCR90(00000000,?,00000000,2DE14967,?,?,00000000,?,?,?,2DE07D54,?,?,?,00000000,?), ref: 2DE14240
FreeResource.KERNEL32(?,?,2DE14967,?,?,00000000,?,?,?,2DE07D54,?,?,?,00000000,?,?), ref: 2DE1424B

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Resource$FindFreeLoadLockSizeofmallocmemcpy
String ID:
API String ID: 2295636306-0
Opcode ID: 48227763c1cff33241410102a9e0115e82b0c1e9edc6b40d3a9e5449d4db98a2
Instruction ID: f8a201167685b9d33afba2d9e38b5c3827bf90187039fb53aa4c1ea71aba8f6d
Opcode Fuzzy Hash: 48227763c1cff33241410102a9e0115e82b0c1e9edc6b40d3a9e5449d4db98a2
Instruction Fuzzy Hash: 8211FE7660060AABDB015FE5C848BAA7BF8EF49696B104065F905F6300EE75DD40CB74

Function 2DE0B7D5 Relevance: 10.5, APIs: 7, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE0B7DC
~_Task_impl.LIBCPMT ref: 2DE0B7F9

Part of subcall function 2DE15440: __EH_prolog3.LIBCMT ref: 2DE15447

~_Task_impl.LIBCPMT ref: 2DE0B808

Part of subcall function 2DE154BD: __EH_prolog3.LIBCMT ref: 2DE154C4

~_Task_impl.LIBCPMT ref: 2DE0B817
~_Task_impl.LIBCPMT ref: 2DE0B826
~_Task_impl.LIBCPMT ref: 2DE0B835

Part of subcall function 2DE153F3: __EH_prolog3.LIBCMT ref: 2DE153FA

~_Task_impl.LIBCPMT ref: 2DE0B844

Part of subcall function 2DE04873: ??_V@YAXPAX@Z.MSVCR90(?,?,2DE04B1B), ref: 2DE04883

Part of subcall function 2DE08409: __EH_prolog3.LIBCMT ref: 2DE08410

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Task_impl$H_prolog3
String ID:
API String ID: 1204490572-0
Opcode ID: 42fdf4db1f5d96ef5b0637e4c9123a91e82bf00f202e36c817deb2d8951b791f
Instruction ID: f871b9a218d52c0f83e817faefbdcacda5ea4abe6513e976151fc633c50e5947
Opcode Fuzzy Hash: 42fdf4db1f5d96ef5b0637e4c9123a91e82bf00f202e36c817deb2d8951b791f
Instruction Fuzzy Hash: 58111930509684DAD715EBA4C1557DDBBE0AF35301F95488DCA9A33281DFB86B08D763

Function 2DE0D55E Relevance: 10.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

malloc.MSVCR90 ref: 2DE0D57E
malloc.MSVCR90 ref: 2DE0D592
malloc.MSVCR90 ref: 2DE0D5EC
memcpy.MSVCR90(?,?,?,?,2DE0DE55,?,?), ref: 2DE0D60A
free.MSVCR90 ref: 2DE0D612
malloc.MSVCR90 ref: 2DE0D627
memcpy.MSVCR90(00000000,000000FF,?,2DE0DE55,?,?), ref: 2DE0D649
free.MSVCR90 ref: 2DE0D651

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5661ad0a6e5cfc74636c64c71a1a3c6b9fffe8cc6fc472692e95c15f62cccbaa
Instruction ID: d6d4f02f5280555b0b18b1130327dd0fbfa5368a3c4b8e22ba8db3a39bbf7455
Opcode Fuzzy Hash: 5661ad0a6e5cfc74636c64c71a1a3c6b9fffe8cc6fc472692e95c15f62cccbaa
Instruction Fuzzy Hash: B7418DB1600705AFEB14CF69D88096AB7E9FF44259750C82EE95EFB740EA31EA00CB50

Function 6C8F5384 Relevance: 9.3, APIs: 6, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38b87c806989fc2c0dd5aa48609b3bc6bc4970df835a6c9630bb3cb24f207596
Instruction ID: cfb473e2bf0c79e87d71682837bb5626e3e1938dfe8f8503324b24d0da3eaa67
Opcode Fuzzy Hash: 38b87c806989fc2c0dd5aa48609b3bc6bc4970df835a6c9630bb3cb24f207596
Instruction Fuzzy Hash: 53B10770A043499FDB21DF9CC580BAEBBB1BF8A358F208958D5349BB81C7749947CB60

Function 6C8E1712 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 6C8E175B
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 6C8E17C6
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6C8E17E3
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 6C8E1822
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6C8E1881
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6C8E18A4

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: e4031d0e6505bb6944d581e75d5fda48b57a81501535d779767bf10b195240c8
Instruction ID: 47792181d4a082caf1558a40e5a6ec72a26d385c3dec9ba4e50fc43c725e3d79
Opcode Fuzzy Hash: e4031d0e6505bb6944d581e75d5fda48b57a81501535d779767bf10b195240c8
Instruction Fuzzy Hash: CA51917260122AAFEF204F95CD44FEF3BBAEF4A744F214929F924A6551E734D814CB90

Function 2DE11AAA Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE11AB1
GetPropA.USER32(?,00000000), ref: 2DE11AC1

Part of subcall function 2DE15923: __EH_prolog3.LIBCMT ref: 2DE1592A
Part of subcall function 2DE15923: GetLastError.KERNEL32(00000004,2DE10854,00000004,2DE109B6,00000000,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE1592F

CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 2DE11B58

Part of subcall function 2DE11492: GetWindowLongA.USER32(?,000000F0), ref: 2DE114A6
Part of subcall function 2DE11492: GetWindowRect.USER32(?,?), ref: 2DE114BA
Part of subcall function 2DE11492: IsWindowEnabled.USER32(?), ref: 2DE114DF

SetWindowLongA.USER32(?,000000FC,?), ref: 2DE11B77
RemovePropA.USER32(?,00000000), ref: 2DE11B86

Part of subcall function 2DE10D23: GetWindowRect.USER32(?,?), ref: 2DE10D2C
Part of subcall function 2DE10D23: GetWindowLongA.USER32(?,000000F0), ref: 2DE10D37

CallWindowProcA.USER32(?,?,?,?,00000000), ref: 2DE11BE3

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Long$CallProcPropRect$EnabledErrorH_prolog3H_prolog3_catchLastRemove
String ID:
API String ID: 1391589453-0
Opcode ID: ffad048c8b34a72d7a6c69f4442e6b2fde040e45d61777dcfabd33ee11cab945
Instruction ID: 96506f3b843138997fd9f60d06af548f1c76365dbfa81683476a650b1af7e867
Opcode Fuzzy Hash: ffad048c8b34a72d7a6c69f4442e6b2fde040e45d61777dcfabd33ee11cab945
Instruction Fuzzy Hash: 94416972A04209EBCF058FA4C944AEE7BB4FF08715F014519FA15BB290DB39DE44DBA1

Function 2DE084B0 Relevance: 9.1, APIs: 6, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 2DE084B7

Part of subcall function 2DE08374: SendMessageA.USER32(00000000,00000031,00000000,00000000), ref: 2DE0837D

GetObjectA.GDI32(?,0000003C,?), ref: 2DE084DA
GetDC.USER32(00000000), ref: 2DE084E2

Part of subcall function 2DE08338: CreateFontIndirectA.GDI32(?), ref: 2DE08341

Part of subcall function 2DE14F4C: SelectObject.GDI32(?,00000000), ref: 2DE14F70
Part of subcall function 2DE14F4C: SelectObject.GDI32(?,00000000), ref: 2DE14F86

GetTextMetricsA.GDI32(?,?), ref: 2DE08528
GetTextMetricsA.GDI32(?), ref: 2DE08555
ReleaseDC.USER32(00000000,?), ref: 2DE0856F

Part of subcall function 2DE14ED4: __EH_prolog3.LIBCMT ref: 2DE14EDB
Part of subcall function 2DE14ED4: DeleteDC.GDI32(00000000), ref: 2DE14EFB

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Object$MetricsSelectText$CreateDeleteFontH_prolog3H_prolog3_IndirectMessageReleaseSend
String ID:
API String ID: 275216013-0
Opcode ID: 6f85af226e3e9eb24055429f268d7bf1b4e6bf0b06176b899814b474779f6fb9
Instruction ID: b30ef81324e946df8c211b8d22f9bc6ecd6266c7dc84ea51ba510d75a7b9a020
Opcode Fuzzy Hash: 6f85af226e3e9eb24055429f268d7bf1b4e6bf0b06176b899814b474779f6fb9
Instruction Fuzzy Hash: F621EA71D042089BDB15EBE0C855BDDB7B9FF64701F528128E126BB2A4DF345E09CB50

Function 6C8E52D8 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6C8E51E9,6C8E22B5,6C8E1EC9,?,6C8E2101,?,00000001,?,?,00000001,?,6C911EC0,0000000C,6C8E21FA), ref: 6C8E52E6
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6C8E52F4
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6C8E530D
SetLastError.KERNEL32(00000000,6C8E2101,?,00000001,?,?,00000001,?,6C911EC0,0000000C,6C8E21FA,?,00000001,?), ref: 6C8E535F

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a7c8b112924b2aa0fa1298826fe7935de4cd47b30cb4e9d4817ca39196be6dcb
Instruction ID: 67f7c79b4e6674462c54849eba8138052d344b259a15c539b8f5fa060a9941da
Opcode Fuzzy Hash: a7c8b112924b2aa0fa1298826fe7935de4cd47b30cb4e9d4817ca39196be6dcb
Instruction Fuzzy Hash: 3B01B53274D71D9E973016BA6E4664A3764EB0F77C734077EE22087DD0EFA14805D990

Function 2DE042F4 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

memset.MSVCR90 ref: 2DE0430C

Part of subcall function 2DE041B0: SetLastError.KERNEL32(?), ref: 2DE042E5

GetLastError.KERNEL32 ref: 2DE04371
CloseHandle.KERNEL32(?), ref: 2DE0437C
SetLastError.KERNEL32(00000000), ref: 2DE04383

Strings

print, xrefs: 2DE04321
<, xrefs: 2DE04305

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ErrorLast$CloseHandlememset
String ID: <$print
API String ID: 637397322-3177634819
Opcode ID: 18d370b77e54d34ebe53159cfae541cdeb08ff4bf82062987019277edca8232a
Instruction ID: fcf8abda46fda7240f698b63cce29f223ea9272e953617a6dbfc18840b0ab5e2
Opcode Fuzzy Hash: 18d370b77e54d34ebe53159cfae541cdeb08ff4bf82062987019277edca8232a
Instruction Fuzzy Hash: F2110776900209EFCB01DFA8D985ACEBBF8FF48741F105115FA05F7240EA359A40CB94

Function 2DE15D40 Relevance: 9.1, APIs: 6, Instructions: 51windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 2DE15D44
GetParent.USER32(00000000), ref: 2DE15D6C

Part of subcall function 2DE15C0F: GetWindowLongA.USER32(?,000000F0), ref: 2DE15C2E
Part of subcall function 2DE15C0F: GetClassNameA.USER32(?,?,0000000A), ref: 2DE15C43
Part of subcall function 2DE15C0F: lstrcmpiA.KERNEL32(?,combobox), ref: 2DE15C52

GetWindowLongA.USER32(?,000000F0), ref: 2DE15D87
GetParent.USER32(?), ref: 2DE15D95
GetDesktopWindow.USER32 ref: 2DE15D99
SendMessageA.USER32(00000000,0000014F,00000000,00000000), ref: 2DE15DAD

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$LongParent$ClassDesktopFocusMessageNameSendlstrcmpi
String ID:
API String ID: 2818563221-0
Opcode ID: 1a3ad4a00d918fdb247f9d954a4a716af5aff6d572be12d0044c2225596d024f
Instruction ID: a9e3dff40b9d7885f04898d4581539cacfa45017e541848d1718740af7ea2004
Opcode Fuzzy Hash: 1a3ad4a00d918fdb247f9d954a4a716af5aff6d572be12d0044c2225596d024f
Instruction Fuzzy Hash: A901813330129227D7112A65DD8CBBF26FEAB81A55F510129FF06FA280DF69DC419264

Function 2DE186E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Office\14.0\Common\FilesPaths,00000000,00020019,?,?,00000000), ref: 2DE18736
RegQueryValueExW.ADVAPI32(?,mso.dll,00000000,00000000,?,00000208,?,00000000), ref: 2DE18757
RegCloseKey.ADVAPI32(?,?,00000000), ref: 2DE1876B

Strings

Software\Microsoft\Office\14.0\Common\FilesPaths, xrefs: 2DE1871A
mso.dll, xrefs: 2DE1874C

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Software\Microsoft\Office\14.0\Common\FilesPaths$mso.dll
API String ID: 3677997916-1420724145
Opcode ID: f60ce6fccb4e41d6652ac2e8efa62d5778fec80625394eea3dd066dfe61d73ae
Instruction ID: 6e084b46f3e811a975964d34db1a303380612177b0176f1329720a750f69ae28
Opcode Fuzzy Hash: f60ce6fccb4e41d6652ac2e8efa62d5778fec80625394eea3dd066dfe61d73ae
Instruction Fuzzy Hash: 2C215B71A4011DAADB10DF64CCC8BEAB7B8EB64345F0046A6A21AF2150DE708E90DBA0

Function 6C8E6382 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,?,?,?,6C8E6445,6C8E500A,?,?,00000000,?,6C8E64F7,00000002,FlsGetValue,6C906D98), ref: 6C8E6413

Strings

api-ms-, xrefs: 6C8E63D3

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 42b66682f1f154d58d526ced92cba26035bb1f8cb7ac4320695baef49c50b17c
Instruction ID: 66915d7ac3e53f5cf78192822b41aa98a8abba9ac046521018d9c8873f90907e
Opcode Fuzzy Hash: 42b66682f1f154d58d526ced92cba26035bb1f8cb7ac4320695baef49c50b17c
Instruction Fuzzy Hash: 5C11A731B49629A7DF325A698D4078F33B49F1B778F250A24EA14EB681D760E9008AD1

Function 6C8E6E26 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,7B4BA14C,?,?,00000000,6C903507,000000FF,?,6C8E6DB6,?,?,6C8E6D8A,00000000), ref: 6C8E6E5B
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6C8E6E6D
FreeLibrary.KERNEL32(00000000,?,00000000,6C903507,000000FF,?,6C8E6DB6,?,?,6C8E6D8A,00000000), ref: 6C8E6E8F

Strings

mscoree.dll, xrefs: 6C8E6E54
CorExitProcess, xrefs: 6C8E6E65

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 309bd2f8ecd0f033c3f5e627d8912b0d7481c4dcd0ae5b5dee575592929616d7
Instruction ID: aff7f97e327a09b86bc895ffac06d3a311c58ee15ed13281eb15e099f43961fd
Opcode Fuzzy Hash: 309bd2f8ecd0f033c3f5e627d8912b0d7481c4dcd0ae5b5dee575592929616d7
Instruction Fuzzy Hash: 62018F31B08619EFDB118F50CD05BAE7BB8FB59655F200A2DE921E6A80DB34E900CE40

Function 2DE05BEE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_stricmp.MSVCR90(?,IPM.Conflict.Message), ref: 2DE05C06
_stricmp.MSVCR90(?,IPM.Conflict.Folder), ref: 2DE05C16
_stricmp.MSVCR90(?,?), ref: 2DE05C2A

Strings

IPM.Conflict.Message, xrefs: 2DE05BFE
IPM.Conflict.Folder, xrefs: 2DE05C0E

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: _stricmp
String ID: IPM.Conflict.Folder$IPM.Conflict.Message
API String ID: 2884411883-576266925
Opcode ID: 564cbe624c09ca8c227525b9305e26052e260498469267e899f1e8d5fbd803a5
Instruction ID: c97715b8df6266089f91de3113929b6bae2433a7a4c94a12d4d54910a65067c8
Opcode Fuzzy Hash: 564cbe624c09ca8c227525b9305e26052e260498469267e899f1e8d5fbd803a5
Instruction Fuzzy Hash: E4F0123361421E6EDB059E54EC41AA537D4DB052B3F108036FA04FA0A1DF31E520DB94

Function 2DE0D31D Relevance: 7.6, APIs: 6, Instructions: 146stringCOMMON

Download Yara Rule

APIs

malloc.MSVCR90 ref: 2DE0D3D2
free.MSVCR90 ref: 2DE0D3F3
lstrlenA.KERNEL32(?,?,?), ref: 2DE0D43E
malloc.MSVCR90 ref: 2DE0D44B
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000001), ref: 2DE0D466
free.MSVCR90 ref: 2DE0D46F

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: freemalloc$ByteCharMultiWidelstrlen
String ID:
API String ID: 4100972401-0
Opcode ID: 102c381f2fc540e0f038b68253f69bba324e2bed05107579eaea646f6cd13b81
Instruction ID: 26a3426ecc2a8f34f61077ba64bc92ea1fb9ce682320a2d090f25e135ba90bad
Opcode Fuzzy Hash: 102c381f2fc540e0f038b68253f69bba324e2bed05107579eaea646f6cd13b81
Instruction Fuzzy Hash: 0941BF71500205EFCB16CF64CC84AAE7BB9FF84752F20465AF552F6281EB76E950CB60

Function 2DE08126 Relevance: 7.6, APIs: 5, Instructions: 120windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE0812D

Part of subcall function 2DE06995: LoadCursorA.USER32(00000000,?), ref: 2DE069A0
Part of subcall function 2DE06995: SetCursor.USER32(00000000), ref: 2DE069A7

MessageBoxW.USER32(00000005,?,?,00000134), ref: 2DE0820B
GetWindowRect.USER32(00000003,?), ref: 2DE08260
PostMessageA.USER32(00000003,00000111,0000891C,00000000), ref: 2DE082BA
SetCursor.USER32(?), ref: 2DE082F2

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Cursor$Message$H_prolog3_catchLoadPostRectWindow
String ID:
API String ID: 4269587068-0
Opcode ID: eede814cac093db274cd42a96288956f70f4508ceef63e869826cbc2612dfb86
Instruction ID: edbaf0299842b7f1dcc832f9f4eff0489452ccf26f7a0b469851212eb6380468
Opcode Fuzzy Hash: eede814cac093db274cd42a96288956f70f4508ceef63e869826cbc2612dfb86
Instruction Fuzzy Hash: 69518D70904649EFDB01EBE0C989BAEBBB5FF14305F50445CE25AB7291DF74AA05CB21

Function 2DE06E33 Relevance: 7.6, APIs: 5, Instructions: 85windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE06E3A

Part of subcall function 2DE06995: LoadCursorA.USER32(00000000,?), ref: 2DE069A0
Part of subcall function 2DE06995: SetCursor.USER32(00000000), ref: 2DE069A7

SetCursor.USER32(?), ref: 2DE06E9B
SetCursor.USER32(?), ref: 2DE06EC4
GetWindowRect.USER32(?,?), ref: 2DE06ED5
PostMessageA.USER32(?,00000111,0000891C,00000000), ref: 2DE06F25

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Cursor$H_prolog3LoadMessagePostRectWindow
String ID:
API String ID: 4037273543-0
Opcode ID: 156ed51494b0159286956f793ebb0e94bf0f997a6d6818c495b087d76b2e3195
Instruction ID: 86eb4a21c072395de83c148fb0e06717df5be47f85e98d512a6da6a8f2c24c40
Opcode Fuzzy Hash: 156ed51494b0159286956f793ebb0e94bf0f997a6d6818c495b087d76b2e3195
Instruction Fuzzy Hash: 82317C70604645EFCB019FA0C988AAEBBF5FF58706F01445CE256BB2A1DF75AA05CB11

Function 2DE08A57 Relevance: 7.6, APIs: 5, Instructions: 85fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE08A5E
??_U@YAPAXI@Z.MSVCR90(00001000), ref: 2DE08ACD

Part of subcall function 2DE13812: Mailbox.LIBCMT ref: 2DE159AE

WriteFile.KERNEL32(000000FF,?,?,2DE0224C,00000000), ref: 2DE08B01
CloseHandle.KERNEL32(000000FF), ref: 2DE08B2F
??_V@YAXPAX@Z.MSVCR90(?), ref: 2DE08B3C

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CloseFileH_prolog3_catchHandleMailboxWrite
String ID:
API String ID: 1130278343-0
Opcode ID: 065bb4f6139d51091db4575a76bd8ca3d7e67ee927b7c07f13cce97f0ccf0df5
Instruction ID: 8334981f4ead742b9e58342f37ae7b1a3e668adbd2ec2c5f321c2e3d955baca1
Opcode Fuzzy Hash: 065bb4f6139d51091db4575a76bd8ca3d7e67ee927b7c07f13cce97f0ccf0df5
Instruction Fuzzy Hash: 163169B5900109EFDF05AFA4CC85EAEBBB8FF18765F108119F625B6290CB358E00CB60

Function 2DE0D4A0 Relevance: 7.6, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

free.MSVCR90 ref: 2DE0D4CA
free.MSVCR90 ref: 2DE0D4D9
free.MSVCR90 ref: 2DE0D51D
free.MSVCR90 ref: 2DE0D537
free.MSVCR90 ref: 2DE0D546
free.MSVCR90 ref: 2DE0D54C

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3a960de938612066f142219ca59dfcf8434106141cde5a3ec68a2566a8e3164c
Instruction ID: b1fedd88a8861667a14835a3b2191d6bc744d4d315d07332eda2730f4a389a20
Opcode Fuzzy Hash: 3a960de938612066f142219ca59dfcf8434106141cde5a3ec68a2566a8e3164c
Instruction Fuzzy Hash: 23218372A00109EFDF058F54D880A6DBBB5FF4036AF208066ED04BA651DF72E990DB90

Function 2DE04391 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 2DE0444B

Part of subcall function 2DE042F4: memset.MSVCR90 ref: 2DE0430C

GetLastError.KERNEL32 ref: 2DE0441B

Strings

l2ub, xrefs: 2DE043D3
k2ub, xrefs: 2DE043BA
m2ub, xrefs: 2DE043EC

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ErrorLast$memset
String ID: k2ub$l2ub$m2ub
API String ID: 4054172246-710509214
Opcode ID: 168d225024a1194765b8a9f4d278713f5513f8ca819256893d0824a40027fd85
Instruction ID: 32d4356d281ed8dcb7d7dc82b16cd82833e8e83e67c045396158fe5e85a35737
Opcode Fuzzy Hash: 168d225024a1194765b8a9f4d278713f5513f8ca819256893d0824a40027fd85
Instruction Fuzzy Hash: 2A212F7290051CFBCB02AFA5CE44EDEBBB9EFA4652F128061F611B7120DB758E52DB50

Function 2DE12319 Relevance: 7.6, APIs: 5, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 2DE15923: __EH_prolog3.LIBCMT ref: 2DE1592A
Part of subcall function 2DE15923: GetLastError.KERNEL32(00000004,2DE10854,00000004,2DE109B6,00000000,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE1592F

CallNextHookEx.USER32(?,?,?,?), ref: 2DE12336
CallNextHookEx.USER32(?,00000003,?,?), ref: 2DE1237D
UnhookWindowsHookEx.USER32(?), ref: 2DE12388
GetCurrentThreadId.KERNEL32 ref: 2DE1239D
SetWindowsHookExA.USER32(00000004,Function_00011CD5,00000000,00000000), ref: 2DE123AD

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Hook$CallNextWindows$CurrentErrorH_prolog3LastThreadUnhook
String ID:
API String ID: 2915796353-0
Opcode ID: 35c89ffeb11118563167a88b60114744a4bbe5544c6afa1e357258ae295a485a
Instruction ID: c28a60bc6b8884df7cd784d2ba1559001dc12b6a8d6cd3893b405f497c109756
Opcode Fuzzy Hash: 35c89ffeb11118563167a88b60114744a4bbe5544c6afa1e357258ae295a485a
Instruction Fuzzy Hash: 6D116A72200306EFDB128F60CD89B5A7BB4FF08756F009428FA47AA661CB75E950CF14

Function 2DE12A2D Relevance: 7.5, APIs: 5, Instructions: 48windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,?,?), ref: 2DE12A5A
GetFocus.USER32 ref: 2DE12A6C
GetParent.USER32(?), ref: 2DE12A7A
SetFocus.USER32(?,00000000), ref: 2DE12A95
EnableWindow.USER32(?,?), ref: 2DE12AAB

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: EnableFocus$ItemMenuParentWindow
String ID:
API String ID: 783553715-0
Opcode ID: 9f8541068dd6dc94525ba4672cc3b61b7697c0c0e761181a845f1e7ddec6c45b
Instruction ID: 88973a2d0e5b55169448c28d145a71a65d5d1818f7eed4389f02d1b716188759
Opcode Fuzzy Hash: 9f8541068dd6dc94525ba4672cc3b61b7697c0c0e761181a845f1e7ddec6c45b
Instruction Fuzzy Hash: 1D018E31200A00AFCB255F60CD0AB59BBF8FF00751F018629F606B66A0CB75E894CB94

Function 2DE0510C Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

CoRevokeClassObject.OLE32 ref: 2DE05124
CoRevokeClassObject.OLE32(00000000), ref: 2DE05136
FreeLibrary.KERNEL32(00000000), ref: 2DE0515B
free.MSVCR90 ref: 2DE05170
free.MSVCR90 ref: 2DE05178

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ClassObjectRevokefree$FreeLibrary
String ID:
API String ID: 850073815-0
Opcode ID: 7e6b68fcfdf87aecec1eb33ad95c1fedb728d29ff7b08cbed3d06c4ece7a0601
Instruction ID: e10b1629123d77f3fbe548045d75b7d453761553dcd82b06fb345d40e292ef08
Opcode Fuzzy Hash: 7e6b68fcfdf87aecec1eb33ad95c1fedb728d29ff7b08cbed3d06c4ece7a0601
Instruction Fuzzy Hash: 440156772107029BE7019B24C840BA2B3F9FF44716F610419E516F7290EFB9E820CFA4

Function 2DE15C6C Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

IsWindowUnicode.USER32(?), ref: 2DE15C79
malloc.MSVCR90 ref: 2DE15C8B
GetWindowTextW.USER32(?,00000000,?), ref: 2DE15C9D
GetWindowTextA.USER32(?,00000001,?), ref: 2DE15CBA
free.MSVCR90 ref: 2DE15CC7

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Text$Unicodefreemalloc
String ID:
API String ID: 1936483696-0
Opcode ID: f43f1784aa5fde6112ff4cb00560f6a6fe0d05d3d38744361f640d88e9ac19f3
Instruction ID: 6e5b87129a65b528b8e9c7a55a91cad700c91ad396529bc23994327376e3a3a8
Opcode Fuzzy Hash: f43f1784aa5fde6112ff4cb00560f6a6fe0d05d3d38744361f640d88e9ac19f3
Instruction Fuzzy Hash: AEF04F36605219BB8B120EA18C48E9B7F79FF45B657008115F905AA210DA36D911DAA4

Function 2DE15CD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

IsWindowUnicode.USER32(?), ref: 2DE15CE0
GetWindowTextW.USER32(?,00000100,?), ref: 2DE15CF3
malloc.MSVCR90 ref: 2DE15D06
GetWindowTextA.USER32(?,00000000,?), ref: 2DE15D19
free.MSVCR90 ref: 2DE15D30

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Text$Unicodefreemalloc
String ID:
API String ID: 1936483696-0
Opcode ID: 23b2954ff4199587148b1173ab37ec70c897069216bfba93d2a17cc605535660
Instruction ID: d7483974c5e49b9004eec7edfc8ef93c524ba96cb70139aa195c049263fa7e0a
Opcode Fuzzy Hash: 23b2954ff4199587148b1173ab37ec70c897069216bfba93d2a17cc605535660
Instruction Fuzzy Hash: 08F01236604249BFCF011FA5DC48E9B3FB9EB497A57008429F916E6210DB36C911DB64

Function 2DE04896 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

??_V@YAXPAX@Z.MSVCR90(?), ref: 2DE049C3

Part of subcall function 2DE0F52B: malloc.MSVCR90 ref: 2DE0F531

memmove.MSVCR90(?,?,?), ref: 2DE04991
memmove.MSVCR90(?,8007000E,?), ref: 2DE049A6

Strings

jsr9, xrefs: 2DE048D5

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: memmove$malloc
String ID: jsr9
API String ID: 3263852767-1633979662
Opcode ID: a3486c3d2975eaa75eb20887dc8753533e0c63cf0bf5078e67d4f5d0abe642be
Instruction ID: 6e192201dfb37d2482f8a0568231fc8ff6e71942eca15cd59e15a66f7f9b6c00
Opcode Fuzzy Hash: a3486c3d2975eaa75eb20887dc8753533e0c63cf0bf5078e67d4f5d0abe642be
Instruction Fuzzy Hash: 58419F71A00605EBCB11CF59CA8095EBBF9FF90355B61C92EE59AFB610DB70EA41CB40

Function 2DE14385 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE1438C
GetWindowLongA.USER32(?,000000F0), ref: 2DE143BB
GetParent.USER32(?), ref: 2DE143CB

Strings

0, xrefs: 2DE14391

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: H_prolog3_catchLongParentWindow
String ID: 0
API String ID: 944585138-4108050209
Opcode ID: 6b51049e77c5a2b1e6da7dd6e4f6b296ee358181ea833fd8f6afe21c6304d70a
Instruction ID: e9e01260f8d2c0dd0c0dad1adbd453b757f0624aea5a49ffb55767f54dd5c776
Opcode Fuzzy Hash: 6b51049e77c5a2b1e6da7dd6e4f6b296ee358181ea833fd8f6afe21c6304d70a
Instruction Fuzzy Hash: A3214271A0420ADBCF02EFA0C580B9E7BB0BF14314F218159EA16BB290DB75EE45CB91

Function 2DE04B08 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 2DE04873: ??_V@YAXPAX@Z.MSVCR90(?,?,2DE04B1B), ref: 2DE04883

GetACP.KERNEL32 ref: 2DE04B25
WideCharToMultiByte.KERNEL32(?,?,?,000000FF,00000000,00000000,00000000,00000000), ref: 2DE04B44
WideCharToMultiByte.KERNEL32(?,?,?,000000FF,?,00000001,00000000,00000000), ref: 2DE04B8A

Strings

dk29, xrefs: 2DE04B5F

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: dk29
API String ID: 626452242-1677150192
Opcode ID: 11c2cbd667b4cf0c70a0a35ab4e3ba7df2591af1eaef450e96d98d3f3a7229af
Instruction ID: 3b3a2af78c5c2a758df7fdcd4d5bab2e279977188fe99c955053a26d8ca23841
Opcode Fuzzy Hash: 11c2cbd667b4cf0c70a0a35ab4e3ba7df2591af1eaef450e96d98d3f3a7229af
Instruction Fuzzy Hash: B3113A72904118BBCF119F96CD44DDF7FBDEF85765B10825AF924B6160DA318A00DF60

Function 2DE0FFF9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE10000
GetModuleHandleW.KERNEL32(mso.dll,0000001C,2DE100FB,00000000,?,?,00000000,00000000,?,?,2DE0FD52,?,00000000,?,?,?), ref: 2DE10075

Part of subcall function 2DE04CF2: LoadStringW.USER32(?,?,?,00000100), ref: 2DE04D3C

Strings

mso.dll, xrefs: 2DE10070

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: H_prolog3_catchHandleLoadModuleString
String ID: mso.dll
API String ID: 2579502969-1671880577
Opcode ID: 5436407f10b8e63190d7fc7ff4490c1d8da8ace9c57a40dc70de2d196e56ba3f
Instruction ID: 889d5d27780fe0916f7260d7ff1ceb7c582232b4988a3270ad43a65f9f92a5c6
Opcode Fuzzy Hash: 5436407f10b8e63190d7fc7ff4490c1d8da8ace9c57a40dc70de2d196e56ba3f
Instruction Fuzzy Hash: 2111AC32A04149EACB01DFA0C905BDE3BB0EF24761F268114F961B7290CF38DE10DBA1

Function 2DE08ED9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 2DE08EEB
SystemTimeToFileTime.KERNEL32(?,?), ref: 2DE08EF9

Strings

@, xrefs: 2DE08F19
@, xrefs: 2DE08EE4

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Time$System$File
String ID: @$@
API String ID: 2838179519-149943524
Opcode ID: 6cf0c7d42f7a0f5d63c12c7d778d2b5ed957bf44b43d72727b4d61d67ed7a8d8
Instruction ID: 69efd7ca8a87e14b0ed6d0119b97ff52ca28bed46dc92cc84d8642b9caf7b633
Opcode Fuzzy Hash: 6cf0c7d42f7a0f5d63c12c7d778d2b5ed957bf44b43d72727b4d61d67ed7a8d8
Instruction Fuzzy Hash: 7911E271A11229ABDB00DFA4C889FDEBBB8FF08651F004459FA55F7240DB74E900CBA4

Function 2DE05264 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00000000,00007F00), ref: 2DE0529A
LoadCursorA.USER32(00000000,00007F00), ref: 2DE052A5
GetStockObject.GDI32(00000000), ref: 2DE052AF

Strings

Cnfnot_ClassFactory, xrefs: 2DE052BF

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Load$CursorIconObjectStock
String ID: Cnfnot_ClassFactory
API String ID: 3711576554-2905417136
Opcode ID: 12298d52779bf7885af703f20a8aa1c4a096525a430f2ac7f231a9465213ffe2
Instruction ID: 4b6ea87d5abe8fa19cea1f4ba34deefdda2b006f51061f19b668fb8050268535
Opcode Fuzzy Hash: 12298d52779bf7885af703f20a8aa1c4a096525a430f2ac7f231a9465213ffe2
Instruction Fuzzy Hash: FF011A72C05218AFCB059FEA88846EEFAFCEF59612B10416BD501F7214D6788500CFA4

Function 2DE15C0F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36stringCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 2DE15C2E
GetClassNameA.USER32(?,?,0000000A), ref: 2DE15C43
lstrcmpiA.KERNEL32(?,combobox), ref: 2DE15C52

Strings

combobox, xrefs: 2DE15C49

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ClassLongNameWindowlstrcmpi
String ID: combobox
API String ID: 2054663530-2240613097
Opcode ID: 24e7308367cef179a738491327c7cdfbe4fbd040d14787d67a9d9650722ba2b1
Instruction ID: 5eab60a80366cd03ed63695aa5b60ebd6a6c005035ddc7147f26fb50dec9e2f0
Opcode Fuzzy Hash: 24e7308367cef179a738491327c7cdfbe4fbd040d14787d67a9d9650722ba2b1
Instruction Fuzzy Hash: 48F09032A15129ABCB01EFA4CC45FBE73F8EB09A52B404915F413FB180DB38EA05C799

Function 6C8F389F Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(7B4BA14C,00000000,00000000,?), ref: 6C8F3902

Part of subcall function 6C8F9E65: WideCharToMultiByte.KERNEL32(00000000,00000000,6C8E66A1,?,6C8E6732,00000016,6C8EEE89,0000FDE9,?,?,00000008,?,00000003,6C912580,00000024,6C8EEE89), ref: 6C8F9F11

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6C8F3B5D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6C8F3BA5
GetLastError.KERNEL32 ref: 6C8F3C48

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 6af723fb12bf04ad4f7bb67a8875f4b4564badd2dc5a33cde84b03704c64abe1
Instruction ID: ef43057a3b87706c37102e9e60860871ad562f3aacb5c6e56d3862140c8a6542
Opcode Fuzzy Hash: 6af723fb12bf04ad4f7bb67a8875f4b4564badd2dc5a33cde84b03704c64abe1
Instruction Fuzzy Hash: DCD18AB5E04258AFCF21CFA8C9809EDBBB4FF49354F24492AE865E7741D730A942CB51

Function 2DE05DB3 Relevance: 6.3, APIs: 4, Instructions: 295COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 2DE05DBD
??_V@YAXPAX@Z.MSVCR90 ref: 2DE06097

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: H_prolog3_catch_
String ID:
API String ID: 1329019490-0
Opcode ID: 7360c6e30741ed6b5eb31e508070f5b12bd1e179eac239ab21476f343b717299
Instruction ID: 7f42ca27ae2b62e7484bff029b029217e6590823b0b58a4b13a545285ab1e62b
Opcode Fuzzy Hash: 7360c6e30741ed6b5eb31e508070f5b12bd1e179eac239ab21476f343b717299
Instruction Fuzzy Hash: BAC18B709082A89BDB65DBA4CD88BADB7B1EF24305F2141D8E259771A1DF349F84CF21

Function 6C8E53EF Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6C8E54B6
___AdjustPointer.LIBCMT ref: 6C8E54D9
___AdjustPointer.LIBCMT ref: 6C8E5575

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9257d1621bb0751cd862e4fd31310406f2f9a989b7c9923925f4bfc74e253ae0
Instruction ID: b7ed8f2dff8231e7340c0c7a5bb5db15518345f6df8ab9ac9cc4e2fd957ab8c3
Opcode Fuzzy Hash: 9257d1621bb0751cd862e4fd31310406f2f9a989b7c9923925f4bfc74e253ae0
Instruction Fuzzy Hash: E751D1B2606706AFDB358F98CA40BAA77B5EF4F319F200D2DD91647A90D731E841CB50

Function 6C8F6ABA Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7303fbe36ea327d128f4b038bfbf65970523db64ddd13426118725476800c869
Instruction ID: 1d9b75dfb460a5b1850d5d3118d5f5de169ca54a9e0f37300efd4fcc73a437a6
Opcode Fuzzy Hash: 7303fbe36ea327d128f4b038bfbf65970523db64ddd13426118725476800c869
Instruction Fuzzy Hash: 9641F471A00608BFD7249F78CA45B9EBBA9FB89754F104A39E121DBB80D771E5068790

Function 6C8FA0B1 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6C8F9E65: WideCharToMultiByte.KERNEL32(00000000,00000000,6C8E66A1,?,6C8E6732,00000016,6C8EEE89,0000FDE9,?,?,00000008,?,00000003,6C912580,00000024,6C8EEE89), ref: 6C8F9F11

GetLastError.KERNEL32 ref: 6C8FA115
__dosmaperr.LIBCMT ref: 6C8FA11C
GetLastError.KERNEL32(?,?,?,?), ref: 6C8FA156
__dosmaperr.LIBCMT ref: 6C8FA15D

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 8336a423ae6d250c2e2008bb35c6ae4307023f1527a4567751b9252e783df40d
Instruction ID: 099595fa6fc7ef70c72ebba3d15c414ccfc57b7c4b43183826d0354d89dbf63d
Opcode Fuzzy Hash: 8336a423ae6d250c2e2008bb35c6ae4307023f1527a4567751b9252e783df40d
Instruction Fuzzy Hash: 7321CB31604209AFD7309F6ACA808DB77B9FF453B87054D29E935D7A40D731EC428790

Function 2DE12240 Relevance: 6.1, APIs: 4, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(2DE00000,00000000,2DE00000,?,000000F0), ref: 2DE1227A
LockResource.KERNEL32(00000000), ref: 2DE12288
SendDlgItemMessageA.USER32(00000001,?,?,00000000,00000000), ref: 2DE122D8
FreeResource.KERNEL32(?), ref: 2DE122F0

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Resource$FreeItemLoadLockMessageSend
String ID:
API String ID: 3233515012-0
Opcode ID: 54da911226e47677987d5c6859ecad6d1b87d98b962e3868688c034d0c492007
Instruction ID: f0192012aa7517954cac57fad6016d4dd89499323d05f548ad05468c3b23549f
Opcode Fuzzy Hash: 54da911226e47677987d5c6859ecad6d1b87d98b962e3868688c034d0c492007
Instruction Fuzzy Hash: 46217172600114BFDB119F98CC85ABE77ECEB05355B90C026FA86F7240DA75DE41EBA4

Function 6C8EEED9 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4b36e52201d0b8c762c638dd5f5c9d25d0eb0067c5259e48fa6c9cc3d15aac
Instruction ID: c00cf421491467611821c28f5d632ec0774aab896f9fa64188704cb55fd0d2bd
Opcode Fuzzy Hash: 3e4b36e52201d0b8c762c638dd5f5c9d25d0eb0067c5259e48fa6c9cc3d15aac
Instruction Fuzzy Hash: 40218431608209BFDB309FA9DE8089A7B69FF4B3687054D64F958D7A50D731EC5487E0

Function 6C8FB060 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6C8FB068

Part of subcall function 6C8F9E65: WideCharToMultiByte.KERNEL32(00000000,00000000,6C8E66A1,?,6C8E6732,00000016,6C8EEE89,0000FDE9,?,?,00000008,?,00000003,6C912580,00000024,6C8EEE89), ref: 6C8F9F11

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6C8FB0A0
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6C8FB0C0

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: c645e2874e295e78daad5a8bda7e2139117be2c1af6573837fe2885275b25a83
Instruction ID: cd0bcbd076bdd10e91cbfac5ad5e9f6a6c5a22cd161111c232e4b91c7296aae2
Opcode Fuzzy Hash: c645e2874e295e78daad5a8bda7e2139117be2c1af6573837fe2885275b25a83
Instruction Fuzzy Hash: 261182A1709519FFA73116BA9E88CBF697DDF861D83100939F42191600EF649D0646B9

Function 2DE04B96 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 2DE04873: ??_V@YAXPAX@Z.MSVCR90(?,?,2DE04B1B), ref: 2DE04883

MultiByteToWideChar.KERNEL32(?,00000000,?,000000FF,00000000,00000000), ref: 2DE04BF9
MultiByteToWideChar.KERNEL32(?,00000000,?,000000FF,?,?), ref: 2DE04C39

Strings

pq8e, xrefs: 2DE04BD3
ek29, xrefs: 2DE04C13

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: ek29$pq8e
API String ID: 626452242-1107266725
Opcode ID: ce4bb88f205e0af481b9bfe892d5e043abb8357571322b4b005d7a6b3fe14bf0
Instruction ID: be86faf887ee6353c6523344bb696ce9baeb0910394add7470d99ebaf3857a78
Opcode Fuzzy Hash: ce4bb88f205e0af481b9bfe892d5e043abb8357571322b4b005d7a6b3fe14bf0
Instruction Fuzzy Hash: F511AFB2904118BFDF01AF95CDC0CAE7FBDFF052A6B208126F619B2150EA318E51DB60

Function 2DE04F8C Relevance: 6.1, APIs: 4, Instructions: 66timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?,?), ref: 2DE04FAA
FileTimeToSystemTime.KERNEL32(?,?), ref: 2DE04FB8
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,?), ref: 2DE04FD0
GetTimeFormatW.KERNEL32(00000400,?,?,00000000,00000000,?), ref: 2DE05018

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Time$File$Format$DateLocalSystem
String ID:
API String ID: 4010208002-0
Opcode ID: 55d76e91ffc06cb61a2d4dba41318085536051da4817d29b16013b24dcfb9706
Instruction ID: f38912fda9bd5f074ee0737b4064089315bde1cc702859d34c9f6b714a09bcab
Opcode Fuzzy Hash: 55d76e91ffc06cb61a2d4dba41318085536051da4817d29b16013b24dcfb9706
Instruction Fuzzy Hash: 511160776102096BDB10CBA4CD45FEB77BDEF49B0AF018021EA06F7281DA709941C7E0

Function 2DE1199D Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON

Download Yara Rule

APIs

IsWindowEnabled.USER32(00000000), ref: 2DE119AD
EnableWindow.USER32(00000000,00000001), ref: 2DE119DA

Part of subcall function 2DE13955: IsWindow.USER32(?), ref: 2DE1397E
Part of subcall function 2DE13955: EnableWindow.USER32(?,00000001), ref: 2DE13990
Part of subcall function 2DE13955: ??_V@YAXPAX@Z.MSVCR90(?,00000000,00000000,?,2DE119D5,?,?,?,2DE11DC9,?,?,00000034,2DE07728,?,?,?), ref: 2DE139A8

GetWindowLongA.USER32(00000000,000000F0), ref: 2DE119E5
SendMessageA.USER32(?,0000036E,?,?), ref: 2DE11A2A

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Enable$EnabledLongMessageSend
String ID:
API String ID: 2621221260-0
Opcode ID: bb32262985773ac4c274de814cd8d7655f76918331de0e9f2c0d111f52b75e43
Instruction ID: ed0aa6e6f5bd644c96fbd842ebb37869c49961a97d3258602a31e6ba4ec09716
Opcode Fuzzy Hash: bb32262985773ac4c274de814cd8d7655f76918331de0e9f2c0d111f52b75e43
Instruction Fuzzy Hash: CB11E131714A05AFDF124F64C845BAE7AF5EB40A95F10812AE22AFA250EF32DD40CB00

Function 2DE11920 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 2DE1192E
GetTopWindow.USER32(00000000), ref: 2DE1196D
GetWindow.USER32(00000000,00000002), ref: 2DE1198B

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: b729a9e4a16570d845ed4569ce66a9d6bb9f616785952e555f7525a1062118bb
Instruction ID: fec8727d7d8e7ba6ea117a30a31bb2514799f35f5b82e6184f2dab452ec24182
Opcode Fuzzy Hash: b729a9e4a16570d845ed4569ce66a9d6bb9f616785952e555f7525a1062118bb
Instruction Fuzzy Hash: 6801E53620411ABBCF135F909C04F9E3B6AFF183D1F018010FA29B5160CB36CA61EBA5

Function 2DE1137C Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(2DE00000,?,00000005,?,?,?,2DE11500,2DE1E6DC), ref: 2DE113A3
LoadResource.KERNEL32(2DE00000,00000000,?,?,?,2DE11500,2DE1E6DC), ref: 2DE113AF
LockResource.KERNEL32(?,?,?,?,2DE11500,2DE1E6DC), ref: 2DE113C0
FreeResource.KERNEL32(?,?,?,?,2DE11500,2DE1E6DC), ref: 2DE113DF

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: a8efbe4908ec1c30af3138e6126bc090e3f7a193e84cd5ac370c438b2d57004a
Instruction ID: a83c390b76d7d32bf5f5ba7546a353102d56c1239423eb3a03057b618e331e4a
Opcode Fuzzy Hash: a8efbe4908ec1c30af3138e6126bc090e3f7a193e84cd5ac370c438b2d57004a
Instruction Fuzzy Hash: 10012633305D509FC7032BA288C8A7A33F8AF4561E703416DEA42FB605EB76CD428794

Function 2DE111CF Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(000088C4,?), ref: 2DE111DA
GetTopWindow.USER32(00000000), ref: 2DE111ED

Part of subcall function 2DE111CF: GetWindow.USER32(00000000,00000002), ref: 2DE11234

GetTopWindow.USER32(000088C4), ref: 2DE1121D

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 0ed834fd8d47b5b5f2f938f65daeef79185cd43fddb9785e295095d7fe1ff936
Instruction ID: 78caea8ff3a2c42641585fb84a70031ac7c1f5089cf3231b375ab8e39500d269
Opcode Fuzzy Hash: 0ed834fd8d47b5b5f2f938f65daeef79185cd43fddb9785e295095d7fe1ff936
Instruction Fuzzy Hash: 60014B36305626A7CB132E618C00F9E3AA9AF157D5F018020FE04F5111EF35DE51E6E9

Function 2DE11A35 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 2DE11A66
GetForegroundWindow.USER32(00000000,?,?,2DE11DE0,?,?,00000034,2DE07728,?,?,?), ref: 2DE11A78
IsWindowEnabled.USER32(?), ref: 2DE11A8B
SetForegroundWindow.USER32(?), ref: 2DE11A98

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Foreground$ActiveEnabledLastPopup
String ID:
API String ID: 3209796547-0
Opcode ID: fec151bf59149b915f30028da6df567905d8e51527dcf3a3a4c1db77088edd60
Instruction ID: 4237eff81fc594085150e6e58ff0ff235704687a9804344f421f4b2d54d88b24
Opcode Fuzzy Hash: fec151bf59149b915f30028da6df567905d8e51527dcf3a3a4c1db77088edd60
Instruction Fuzzy Hash: 3CF0A432B09B01EFDF115B60E80866A7BE8AF00756B01C124E625F4050CFB9CD48CB90

Function 2DE1416D Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE14174
DeleteObject.GDI32(?), ref: 2DE14197
DeleteObject.GDI32(?), ref: 2DE141A4
DeleteObject.GDI32(?), ref: 2DE141B1

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: DeleteObject$H_prolog3
String ID:
API String ID: 2471701793-0
Opcode ID: 5755b9e2f4bf303a9d8c68cd99a4ca2b5906f1947a79675eecd3f6a190e20cb5
Instruction ID: 38ace634ff8e6bf6bb9e00150678546841b3af3d9f301dc73749b2e9d0ecd5db
Opcode Fuzzy Hash: 5755b9e2f4bf303a9d8c68cd99a4ca2b5906f1947a79675eecd3f6a190e20cb5
Instruction Fuzzy Hash: B6F03C71B00710CBCB10EFA9888051EF6F5BF68614B610A2DE29AF7750CF70ED408A45

Function 2DE15923 Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE1592A
GetLastError.KERNEL32(00000004,2DE10854,00000004,2DE109B6,00000000,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE1592F
TlsGetValue.KERNEL32(0000000D,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE15955
SetLastError.KERNEL32(00000000,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE15984

Part of subcall function 2DE15E13: TlsAlloc.KERNEL32(00000000,?,2DE15946,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE15E1B
Part of subcall function 2DE15E13: GetVersion.KERNEL32(?,2DE15946,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE15E1F
Part of subcall function 2DE15E13: TlsAlloc.KERNEL32(?,2DE15946,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE15E32

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AllocErrorLast$H_prolog3ValueVersion
String ID:
API String ID: 2925315393-0
Opcode ID: 313e1bb0cc4c6370f46f50a6be960fbc810c3b6ece0fc85aff8293679f3325a7
Instruction ID: f5c9f16dda4a944d973ccb3fadc4225e0d58409ec143351d6e5ce2369c46e43b
Opcode Fuzzy Hash: 313e1bb0cc4c6370f46f50a6be960fbc810c3b6ece0fc85aff8293679f3325a7
Instruction Fuzzy Hash: 93F03072B142118FC745ABB88845B7D26F0AB18F75B510715EA3AFB3C0DF68CE409A56

Function 2DE0845B Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 2DE08462
SendMessageA.USER32(?,00000443,00000000,00000000), ref: 2DE0847F
SendMessageA.USER32(?,0000043B,00000000,00000000), ref: 2DE0848B
SendMessageA.USER32(?,00000445,00000000,00000000), ref: 2DE084A8

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: MessageSend$Color
String ID:
API String ID: 3922397608-0
Opcode ID: e1f3708014c83522ad4db5db84b6bfd067d8a4279d37c00a3d55301fab7e63e7
Instruction ID: 412843cd4cedd6ee6d8f9951360010306d7e914bd1480d890d6077efd6b5ec9f
Opcode Fuzzy Hash: e1f3708014c83522ad4db5db84b6bfd067d8a4279d37c00a3d55301fab7e63e7
Instruction Fuzzy Hash: ADF0A771500558B6DA215F12CC08F6B3E6CEBC5FA3F00803AB72879050C6714541CAA5

Function 2DE109DE Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

IsWindowUnicode.USER32(?), ref: 2DE109F9
DefWindowProcW.USER32(?,?,?,?), ref: 2DE10A0F
DefWindowProcA.USER32(?,?,?,?), ref: 2DE10A17
CallWindowProcA.USER32(?,?,?,?,?), ref: 2DE10A2C

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Proc$CallUnicode
String ID:
API String ID: 3117573011-0
Opcode ID: 6712436b275561412faa981374861e3c3c1730d9292a5f24fae0e1f0567602e9
Instruction ID: 5ebc51056c884d8a66915a40fdacbe896c621bd537ce56ead9cfa337ac5e82ae
Opcode Fuzzy Hash: 6712436b275561412faa981374861e3c3c1730d9292a5f24fae0e1f0567602e9
Instruction Fuzzy Hash: 06F0BD36200609EFDF129FA5C808E9A7FB9FF087917108418FA56FA521DB36DD24EB54

Function 2DE158AB Relevance: 6.0, APIs: 4, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE158B2
free.MSVCR90 ref: 2DE158CB
TlsGetValue.KERNEL32(00000004,2DE12DCD,?,?,2DE159B3,00000001,2DE1263C,?,?,?,?,?,?,?,?,?), ref: 2DE158DC
TlsSetValue.KERNEL32(00000000,?,?,2DE159B3,00000001,2DE1263C,?,?,?,?,?,?,?,?,?,?), ref: 2DE158EE

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Value$H_prolog3free
String ID:
API String ID: 3023147540-0
Opcode ID: 3a6368561deb6a86a7c663d617aaf33a15f012b6fb48627a54ab9144929f8cbd
Instruction ID: 248b74dc4971cf6dc8d4a5a4727e44a570cf6467323109d7d320a3340f61b2ff
Opcode Fuzzy Hash: 3a6368561deb6a86a7c663d617aaf33a15f012b6fb48627a54ab9144929f8cbd
Instruction Fuzzy Hash: 83F03771604741CBDB24EBA0C809BA97BF4BB10B15F518529E566B6290DFB4EE04CB18

Function 6C901BDC Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,6C8E14C0,6C8E899D,00000000,00000000,?,6C8FE1F8,00000000,00000001,00000000,?,?,6C8F3C9C,?,00000000,00000000), ref: 6C901BF3
GetLastError.KERNEL32(?,6C8FE1F8,00000000,00000001,00000000,?,?,6C8F3C9C,?,00000000,00000000,?,?,?,6C8F425A,?), ref: 6C901BFF

Part of subcall function 6C901BC5: CloseHandle.KERNEL32(FFFFFFFE,6C901C0F,?,6C8FE1F8,00000000,00000001,00000000,?,?,6C8F3C9C,?,00000000,00000000,?,?), ref: 6C901BD5

___initconout.LIBCMT ref: 6C901C0F

Part of subcall function 6C901B87: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6C901BB6,6C8FE1E5,?,?,6C8F3C9C,?,00000000,00000000,?), ref: 6C901B9A

WriteConsoleW.KERNEL32(00000000,6C8E14C0,6C8E899D,00000000,?,6C8FE1F8,00000000,00000001,00000000,?,?,6C8F3C9C,?,00000000,00000000,?), ref: 6C901C24

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 95cc652dccfcac65a12e863cec067dc8de9d4f328d25e40813601fbf0f3a0c88
Instruction ID: b309c99814f12a2892f102d2b34e5215ab7abdc7616bf639a6fb284e7b11d512
Opcode Fuzzy Hash: 95cc652dccfcac65a12e863cec067dc8de9d4f328d25e40813601fbf0f3a0c88
Instruction Fuzzy Hash: 0AF01C36708125BBCF121F91DC05A8D3F7AFB2A7A8B15411CFA19A5920D732C820DF95

Function 2DE16019 Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

Part of subcall function 2DE15FCC: KiUserCallbackDispatcher.NTDLL(00000002), ref: 2DE15FDE
Part of subcall function 2DE15FCC: GetSystemMetrics.USER32(00000003), ref: 2DE15FE8

GetDC.USER32(00000000), ref: 2DE16025
GetDeviceCaps.GDI32(00000000,00000058), ref: 2DE16036
GetDeviceCaps.GDI32(00000000,0000005A), ref: 2DE1603E
ReleaseDC.USER32(00000000,00000000), ref: 2DE16046

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CapsDevice$CallbackDispatcherMetricsReleaseSystemUser
String ID:
API String ID: 1894321826-0
Opcode ID: ed19f3a8a7568dd4d60e5bd3a194388b818b3a0316d68a6f1a556f99a2e371a5
Instruction ID: 553c4bdd1fff6e8aea2a5325422da035ac18e58c8707a684d20b922f92c956bb
Opcode Fuzzy Hash: ed19f3a8a7568dd4d60e5bd3a194388b818b3a0316d68a6f1a556f99a2e371a5
Instruction Fuzzy Hash: 74E04F726407146AD21017728C48F4BAFECEB58A63F004422F609EB2C1CA7988008EA0

Function 6C8D8AA6 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 341COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 6C8D8B58
_strcspn.LIBCMT ref: 6C8D8B9B

Strings

@, xrefs: 6C8D8D25

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: 45ff1ea02da4861ac947a869f1c2c77c226706a496360b41299ae03b691388b4
Instruction ID: 2cab782ab3cfe4054665caf90b1351f9244d5190bb462f25f79e4eb1d28b885d
Opcode Fuzzy Hash: 45ff1ea02da4861ac947a869f1c2c77c226706a496360b41299ae03b691388b4
Instruction Fuzzy Hash: 39E1257190024DDFDF14DFA8DA90AEDBBB5FF09308F12486AE815AB660DB30A955CF50

Function 6C8E59EB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6C8E5A10

Strings

MOC, xrefs: 6C8E5A22
RCC, xrefs: 6C8E5A2A

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ec1dbb2166079a454f3f48ebb7bc228227eac3d16b51d990e4cf5245dbbbe4d9
Instruction ID: 73de47d5019957da928d8546db45a4e75c998d780900052b135b568dfdb02d72
Opcode Fuzzy Hash: ec1dbb2166079a454f3f48ebb7bc228227eac3d16b51d990e4cf5245dbbbe4d9
Instruction Fuzzy Hash: DB415831A00209EFCF15DF98CE81AEE7BB5BF8E308F244969F91467651D3359950DB50

Function 2DE06FBB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE06FC2
memset.MSVCR90 ref: 2DE06FD5

Part of subcall function 2DE052D6: GetProcAddress.KERNEL32(00000000,00000142), ref: 2DE052F4

Strings

D, xrefs: 2DE07047

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressH_prolog3Procmemset
String ID: D
API String ID: 2467443255-2746444292
Opcode ID: c50c3fe2fbca24ef6d2e30d2d293ab88aa1bbfa10507a061da2d1030a258762c
Instruction ID: 3a9c6c71b7a73342d50ca9b557e526051739088e0d00c0d9f9f0e05f7d1a5fc7
Opcode Fuzzy Hash: c50c3fe2fbca24ef6d2e30d2d293ab88aa1bbfa10507a061da2d1030a258762c
Instruction Fuzzy Hash: FB316CB1A04605EBDB10EFA0C885A9E7BB9FF84745F208518E659BB290DF35ED01CB11

Function 6C8E8D88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C8F5AAD: MultiByteToWideChar.KERNEL32(6C8FAE39,00000100,E8458D00,00000000,00000000,00000020,?,6C8F8002,00000000,00000000,00000100,00000020,00000000,00000000,E8458D00,00000100), ref: 6C8F5B1D

GetLastError.KERNEL32(?,?,?,?,?,?,?,6C8E8FCF,00000000,?,00000000,2463616368652E646174), ref: 6C8E8DEC
__dosmaperr.LIBCMT ref: 6C8E8DF3

Strings

2463616368652E646174, xrefs: 6C8E8D8D

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: 2463616368652E646174
API String ID: 2434981716-3036274828
Opcode ID: 84938ab8dc6ae9330b15720c10605fe75f3f0137180ac88b91faa620407ce00b
Instruction ID: a08be2abaeb443f35200762f458d7a65bbfde0a4644c83e1e08b229ad70d7fb9
Opcode Fuzzy Hash: 84938ab8dc6ae9330b15720c10605fe75f3f0137180ac88b91faa620407ce00b
Instruction Fuzzy Hash: 2921AB31604615BFD7315F2E8E0094F77A5EF9B3A5B154A1AE82497A90E770E8118790

Function 2DE117FB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 2DE15923: __EH_prolog3.LIBCMT ref: 2DE1592A
Part of subcall function 2DE15923: GetLastError.KERNEL32(00000004,2DE10854,00000004,2DE109B6,00000000,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE1592F

GetClassInfoA.USER32(-00000068,?), ref: 2DE1185A

Part of subcall function 2DE04609: _vsnprintf.MSVCR90 ref: 2DE0463A

Strings

Afx:%x:%x:%x:%x, xrefs: 2DE1183F
Afx:%x, xrefs: 2DE11825

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ClassErrorH_prolog3InfoLast_vsnprintf
String ID: Afx:%x$Afx:%x:%x:%x:%x
API String ID: 3801848739-1102061830
Opcode ID: 5cda9b0a7c72ecb1f9619b295853e0c3c7125269b2711f997083b6715b1dff32
Instruction ID: ce794fe46332818bfdc4c536d4e11fed8198e1b0adb0a543ba67ab41ce5d34f2
Opcode Fuzzy Hash: 5cda9b0a7c72ecb1f9619b295853e0c3c7125269b2711f997083b6715b1dff32
Instruction Fuzzy Hash: A52121B1E00209ABCB01DF95D840BEE7BF9EF59655F04802AF915F2201EB75DA50CBA5

Function 2DE0AD2B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE0AD32
SetRectEmpty.USER32(?), ref: 2DE0ADEB

Strings

X$-, xrefs: 2DE0ADC3

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: EmptyH_prolog3Rect
String ID: X$-
API String ID: 1443337074-1787739716
Opcode ID: 9152f942eca8f583369fd8cb702b94d0e5284345be57e5738ea352421ee21b01
Instruction ID: 230fc07bf141b474d574ac46816416a1e246d67377fabd3dbe831035d7e122bd
Opcode Fuzzy Hash: 9152f942eca8f583369fd8cb702b94d0e5284345be57e5738ea352421ee21b01
Instruction Fuzzy Hash: EE21D3B0805B40CFC321CFAAC18465AFBF4BF65705F508A4ED19AA7A60CBB5A648CB55

Function 2DE0F61C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(mso.dll,?,2DE0FBDC,?,00000201,?,?,80000000), ref: 2DE0F624
MessageBoxW.USER32(00000000,7FFFFEF8,80000008,00000000), ref: 2DE0F681

Strings

mso.dll, xrefs: 2DE0F61F

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: HandleMessageModule
String ID: mso.dll
API String ID: 2216695990-1671880577
Opcode ID: 8e45b0e745f1a8061f8f225e02fd858c7839db9153886311a60a073155b07bbb
Instruction ID: d0f851e8aab955daaa466e203f5171b14a45a552adbc087ad9cebd2e24ed3510
Opcode Fuzzy Hash: 8e45b0e745f1a8061f8f225e02fd858c7839db9153886311a60a073155b07bbb
Instruction Fuzzy Hash: 31F0B43219410ABBE3449AB4CC06FA537ECE724B46F048110F146F62D0DE6DD594CB76

Function 6C8E12E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6C8E12F3
std::_Lockit::~_Lockit.LIBCPMT ref: 6C8E1331

Strings

outlook-web.ddns.net, xrefs: 6C8E12EC

Memory Dump Source

Source File: 00000006.00000002.3382361998.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000006.00000002.3382342298.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382391438.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382416056.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382437212.000000006C924000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382457720.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.3382474415.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: outlook-web.ddns.net
API String ID: 593203224-2894021055
Opcode ID: 5194702f17f0ef2d75552974635466a53989dcefc40f6e661027ce3c5331d194
Instruction ID: 44bf2bccd086bdd494015e98e179b275bac667e138ca9b64d709497016b0cdf4
Opcode Fuzzy Hash: 5194702f17f0ef2d75552974635466a53989dcefc40f6e661027ce3c5331d194
Instruction Fuzzy Hash: 5EF0BE726001909ECB60EB5DCA40A99BBE5EBCB754B254A78C42AD7702EB30E942C781

Function 2DE135E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCR90(?,p(-,?,?,2DE13669,p(-,?,00000000,?,2DE157B6,00000000,?,?,?,2DE02870,?), ref: 2DE13607

Strings

p(-, xrefs: 2DE135EC
p(-, xrefs: 2DE135ED

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID:
String ID: p(-$p(-
API String ID: 0-773738704
Opcode ID: cc3a28099630c4a92c833c90afcec42e4b710eff09a216eab597794e02bd7e12
Instruction ID: eac8867002c6476c7256e3ccf449a015698073b16dcffed580ea3734e6da1714
Opcode Fuzzy Hash: cc3a28099630c4a92c833c90afcec42e4b710eff09a216eab597794e02bd7e12
Instruction Fuzzy Hash: 19E06D7A2047069AC721CF4AD000B42FBE8EFA5760F51842AD6D8A3600CB70F8808BA0

Function 2DE052D7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 2DE03F46: LoadLibraryA.KERNEL32(?,2DE19D60,00000010), ref: 2DE03F75

GetProcAddress.KERNEL32(00000000,00000142), ref: 2DE052F4

Strings

4-, xrefs: 2DE052D7
olmapi32.dll, xrefs: 2DE052DF

Memory Dump Source

Source File: 00000006.00000002.3382268368.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000006.00000002.3382250238.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382290925.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382307287.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3382325267.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: 4-$olmapi32.dll
API String ID: 2574300362-675466117
Opcode ID: 8ccf418b054d2ad8586eb34c0dcd90fb179f0bb6e35669667af19ac5602818c3
Instruction ID: fdf3de23cda28f83e7e81ee7a96c9e15eaa9415382723889029e1f57285b39c2
Opcode Fuzzy Hash: 8ccf418b054d2ad8586eb34c0dcd90fb179f0bb6e35669667af19ac5602818c3
Instruction Fuzzy Hash: 75C08CF690E2411ECB102F6059CA7CC3AF0FB2AF03F000545F286F8656CEA8C444CA07

Analysis Process: MSWordServices.exePID: 1468, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	3.7%
Signature Coverage:	0%
Total number of Nodes:	1418
Total number of Limit Nodes:	13

Executed Functions

Function 6C8D4F22 Relevance: 169.2, APIs: 48, Strings: 47, Instructions: 2972
filesleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8,58160781928836700431202065781531683322301950835055,528C51E4,?,?,?,?,?,?,6C8E4DE0,6C9118B0,000000FE,?,6C8D7E9A), ref: 6C8D4F76
GetModuleFileNameA.KERNEL32(00000000,?,?,?), ref: 6C8D4FD2
CreateFileA.KERNELBASE(00000000,00000080,00000000,?,6C90438C,000000FF,?), ref: 6C8D508E
CloseHandle.KERNEL32(?), ref: 6C8D50B4
Sleep.KERNEL32(0000EA60), ref: 6C8D50BF

Part of subcall function 6C8DCB90: CoInitializeEx.OLE32(00000000,00000000,?,74732E646174), ref: 6C8DCBA9

CreateFileA.KERNEL32(00000000,?,?,?,80000000,00000000,00000000,00000001,00000080,00000000), ref: 6C8D5101
CloseHandle.KERNEL32(?,?,?,?,80000000,00000000,00000000,00000001,00000080,00000000), ref: 6C8D511E
CloseHandle.KERNELBASE(?), ref: 6C8D512C
GetUserNameA.ADVAPI32(?,?), ref: 6C8D515C
Sleep.KERNEL32(00000BB8,?), ref: 6C8D51BB
CreateFileA.KERNELBASE(00000000,00000080,00000000,?,?,?,00000000,?,?,?,?,?,?), ref: 6C8D5328
ReadFile.KERNEL32(?,?,0000000F,?,00000000,?,?,00000000,?,?,?,?,?,?), ref: 6C8D535D
CloseHandle.KERNELBASE(?), ref: 6C8D53B9
Sleep.KERNELBASE(?,?,?,?), ref: 6C8D5467
CreateFileA.KERNELBASE(00000000,00000080,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8D589E
RpcStringBindingComposeA.RPCRT4(00000000,?,?,?,00000000,?), ref: 6C8D5BBF
RpcBindingFromStringBindingA.RPCRT4(?,?), ref: 6C8D5BD8
_strcat.LIBCMT ref: 6C8D5C8F

Strings

c, xrefs: 6C8D5A72
---------, xrefs: 6C8D527E
n, xrefs: 6C8D5A87
>> , xrefs: 6C8D77B5
433A5C5C50726F6772616D446174615C5C, xrefs: 6C8D4F7F
<, xrefs: 6C8D75C2
53495A45, xrefs: 6C8D5582
_, xrefs: 6C8D5A8E
a, xrefs: 6C8D5A79
d, xrefs: 6C8D6221
----, xrefs: 6C8D7915
4552524F52, xrefs: 6C8D5619
d, xrefs: 6C8D7A6C
636D642E657865202F6320, xrefs: 6C8D57A7
44574E, xrefs: 6C8D554F
4552524F525245504C414345, xrefs: 6C8D56C1
n, xrefs: 6C8D5A6B
c, xrefs: 6C8D5AB1
434D44, xrefs: 6C8D576B
_, xrefs: 6C8D5AA3
4E4554455252, xrefs: 6C8D55E6
5C6E5C6E205B50524F43455353204C4953545D205C6E, xrefs: 6C8D5234
|-|, xrefs: 6C8D6872
74732E646174, xrefs: 6C8D501E
i, xrefs: 6C8D5A95
494E46, xrefs: 6C8D551C
24746D702E747874, xrefs: 6C8D52B7
p, xrefs: 6C8D5A9C
53595354454D20494E464F524D4154494F4E205C6E, xrefs: 6C8D51D3
633A5C55736572735C5075626C69635C63722E646174, xrefs: 6C8D57E4
outlook-web.ddns.net, xrefs: 6C8D5B8A
58160781928836700431202065781531683322301950835055, xrefs: 6C8D4F61
52554E, xrefs: 6C8D56F9
2463616368652E646174, xrefs: 6C8D53E2
|, xrefs: 6C8D5D31
t, xrefs: 6C8D5AAA
5645524946494544, xrefs: 6C8D564D
48415348, xrefs: 6C8D55B4
p, xrefs: 6C8D5AB8
4F4B, xrefs: 6C8D5687
4944, xrefs: 6C8D54E5
444C59, xrefs: 6C8D5732
443, xrefs: 6C8D5A4B
c, xrefs: 6C8D5A80
633A5C5C50726F6772616D446174615C5C24746D702E747874, xrefs: 6C8D54AB
7C2A3F2928257D5E267B, xrefs: 6C8D5470
d, xrefs: 6C8D5CA2

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: File$CloseCreateHandleSleep$Binding$NameString$ComposeFromInitializeModuleReadUser_strcat
String ID: ----$---------$2463616368652E646174$24746D702E747874$433A5C5C50726F6772616D446174615C5C$434D44$443$444C59$44574E$4552524F52$4552524F525245504C414345$48415348$4944$494E46$4E4554455252$4F4B$52554E$53495A45$53595354454D20494E464F524D4154494F4E205C6E$5645524946494544$58160781928836700431202065781531683322301950835055$5C6E5C6E205B50524F43455353204C4953545D205C6E$633A5C55736572735C5075626C69635C63722E646174$633A5C5C50726F6772616D446174615C5C24746D702E747874$636D642E657865202F6320$74732E646174$7C2A3F2928257D5E267B$<$>> $_$_$a$c$c$c$d$d$d$i$n$n$outlook-web.ddns.net$p$p$t$|$|-|
API String ID: 163969156-3700135009
Opcode ID: 9a064508f81a66c85862c914a9660877120f207e37f22351f348c349e1a342eb
Instruction ID: 526b2a0a3c68c2dad3853101b2f59770ce03f1411d57ee0b4dcabdc85bdb5089
Opcode Fuzzy Hash: 9a064508f81a66c85862c914a9660877120f207e37f22351f348c349e1a342eb
Instruction Fuzzy Hash: 9D431C72D1022D9ADB35DB64CD91EDEB378AF54208F4109F6A589A2590EFB0A7CCCF50

Function 6C8DEA93 Relevance: 155.5, APIs: 25, Strings: 63, Instructions: 1459
registryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 6C8DEAD0
GetSystemInfo.KERNELBASE(?), ref: 6C8DEB13
GetComputerNameW.KERNEL32(?,00000400), ref: 6C8DEB31
RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000101,?,6C904B84,00000000,?,?,?,?,?,?,?,6C8D51CF,?), ref: 6C8DEC11

Strings

BiosVersion:, xrefs: 6C8DF69A
Page File Location(s):, xrefs: 6C8E00FB
Registered Owner:, xrefs: 6C8DEF1E
RegisteredOrganization, xrefs: 6C8DEF5C
To Be Filled By O.E.M., xrefs: 6C8DF235
MIME\Database\Rfc1766, xrefs: 6C8DF8F2
SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management, xrefs: 6C8E0020
SystemPartition, xrefs: 6C8DF824
Virtual Memory: In Use:, xrefs: 6C8DFFDD
Identifier, xrefs: 6C8DF514
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 6C8DEC07
System Manufacturer:, xrefs: 6C8DF1F0
HARDWARE\DESCRIPTION\System, xrefs: 6C8DF637
System type:, xrefs: 6C8DF375
PagingFiles, xrefs: 6C8E001B
SystemBiosVersion, xrefs: 6C8DF632
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones, xrefs: 6C8DFB6B
HARDWARE\DESCRIPTION\System, xrefs: 6C8DF783
Processor(s):, xrefs: 6C8DF464
RegisteredOwner, xrefs: 6C8DEEB8
Available Physical Memory:, xrefs: 6C8DFE11
Error! RegOpenKeyEx failed., xrefs: 6C8DEC1B
SystemBiosDate, xrefs: 6C8DF77E
SYSTEM\Setup, xrefs: 6C8DF829
General, xrefs: 6C8DF194
[%02u]: , xrefs: 6C8DF4E0
MIME\Database\Rfc1766, xrefs: 6C8DFA4B
CurrentType, xrefs: 6C8DEE14
Domain:, xrefs: 6C8E01C6
OS Build Type :, xrefs: 6C8DEE7A
To Be Filled By O.E.M., xrefs: 6C8DF18A
System Locale:, xrefs: 6C8DF9AF
Error! GetComputerName failed., xrefs: 6C8DEB3B
Virtual Memory: Max Size:, xrefs: 6C8DFEA8
InstallDate, xrefs: 6C8DF09F
ProductName, xrefs: 6C8DEC59
HARDWARE\DESCRIPTION\System\BIOS, xrefs: 6C8DF6DD
RegisteredOrganization:, xrefs: 6C8DEFC2
BIOSVENDOR, xrefs: 6C8DF6D8
Install Date:, xrefs: 6C8DF11E
HARDWARE\DESCRIPTION\System\CentralProcessor\%u, xrefs: 6C8DF4C4
System Model:, xrefs: 6C8DF29B
Keyboard Layout\Preload, xrefs: 6C8DFA08
Model, xrefs: 6C8DF23A
General, xrefs: 6C8DF23F
Total Physical Memory:, xrefs: 6C8DFD7A
Input Locale:, xrefs: 6C8DFB08
Host Name:, xrefs: 6C8DEBA8
Error! GetSystemDirectory failed., xrefs: 6C8DEADA
BIOSVENDOR:, xrefs: 6C8DF740
Manufacturer, xrefs: 6C8DF18F
Virtual Memory: Available:, xrefs: 6C8DFF3F
Boot Device:, xrefs: 6C8DF88C
OS Name:, xrefs: 6C8DECC6
%s\oeminfo.ini, xrefs: 6C8DF163
Product ID:, xrefs: 6C8DF066
VendorIdentifier, xrefs: 6C8DF57F
ProductId, xrefs: 6C8DF000
OS Version :, xrefs: 6C8DED6B
BIOS Date:, xrefs: 6C8DF7E6
Time zone:, xrefs: 6C8DFC97
Display, xrefs: 6C8DFC2C
Std, xrefs: 6C8DFBE9

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: System$ComputerDirectoryInfoNameOpen
String ID: %s\oeminfo.ini$Available Physical Memory:$BIOS Date:$BIOSVENDOR$BIOSVENDOR:$BiosVersion:$Boot Device:$CurrentType$Display$Domain:$Error! GetComputerName failed.$Error! GetSystemDirectory failed.$Error! RegOpenKeyEx failed.$General$General$HARDWARE\DESCRIPTION\System$HARDWARE\DESCRIPTION\System$HARDWARE\DESCRIPTION\System\BIOS$HARDWARE\DESCRIPTION\System\CentralProcessor\%u$Host Name:$Identifier$Input Locale:$Install Date:$InstallDate$Keyboard Layout\Preload$MIME\Database\Rfc1766$MIME\Database\Rfc1766$Manufacturer$Model$OS Build Type :$OS Name:$OS Version :$Page File Location(s):$PagingFiles$Processor(s):$Product ID:$ProductId$ProductName$Registered Owner:$RegisteredOrganization$RegisteredOrganization:$RegisteredOwner$SOFTWARE\Microsoft\Windows NT\CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones$SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management$SYSTEM\Setup$Std$System Locale:$System Manufacturer:$System Model:$System type:$SystemBiosDate$SystemBiosVersion$SystemPartition$Time zone:$To Be Filled By O.E.M.$To Be Filled By O.E.M.$Total Physical Memory:$VendorIdentifier$Virtual Memory: Available:$Virtual Memory: In Use:$Virtual Memory: Max Size:$[%02u]:
API String ID: 1805411109-2676738833
Opcode ID: fd8e017dd0dfc346139625e06b60c14464e8223b8f3f2d7a859e2438a6bb71e7
Instruction ID: 629e078bff64b969d28ca8e44f8c79f723c35b7bed688229b81624331e52f29f
Opcode Fuzzy Hash: fd8e017dd0dfc346139625e06b60c14464e8223b8f3f2d7a859e2438a6bb71e7
Instruction Fuzzy Hash: 51D2F9719000699ACB35EB54CE90EDDB379EF65308F4109F9A10AB2960EF31AF99DF50

Function 6C8DE49B Relevance: 54.3, APIs: 16, Strings: 15, Instructions: 73
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?GetFileVersionInfoByHandleEx@@YGHXZ.OLMAPI32(?,?,6C8E2118,?,00000001,00000000,?,00000001,00000000,?,00000001,00000000,6C911EC0,0000000C,00000007,6C911E98), ref: 6C8DE4B0
GetProcAddress.KERNEL32(GetFileVersionInfoA), ref: 6C8DE4C0
GetProcAddress.KERNEL32(GetFileVersionInfoByHandle), ref: 6C8DE4D6
GetProcAddress.KERNEL32(GetFileVersionInfoExW), ref: 6C8DE4EC
GetProcAddress.KERNEL32(GetFileVersionInfoSizeA), ref: 6C8DE502
GetProcAddress.KERNEL32(GetFileVersionInfoSizeExW), ref: 6C8DE518
GetProcAddress.KERNEL32(GetFileVersionInfoSizeW), ref: 6C8DE52E
GetProcAddress.KERNEL32(GetFileVersionInfoW), ref: 6C8DE544
GetProcAddress.KERNEL32(VerFindFileA), ref: 6C8DE55A
GetProcAddress.KERNEL32(VerFindFileW), ref: 6C8DE570
GetProcAddress.KERNEL32(VerInstallFileA), ref: 6C8DE586
GetProcAddress.KERNEL32(VerInstallFileW), ref: 6C8DE59C
GetProcAddress.KERNEL32(VerLanguageNameA), ref: 6C8DE5B2
GetProcAddress.KERNEL32(VerLanguageNameW), ref: 6C8DE5C8
GetProcAddress.KERNEL32(VerQueryValueA), ref: 6C8DE5DE
GetProcAddress.KERNEL32(VerQueryValueW), ref: 6C8DE5F4

Strings

GetFileVersionInfoByHandle, xrefs: 6C8DE4CB
VerInstallFileW, xrefs: 6C8DE591
VerQueryValueA, xrefs: 6C8DE5D3
GetFileVersionInfoW, xrefs: 6C8DE539
VerInstallFileA, xrefs: 6C8DE57B
GetFileVersionInfoSizeA, xrefs: 6C8DE4F7
GetFileVersionInfoA, xrefs: 6C8DE4B5
VerFindFileA, xrefs: 6C8DE54F
VerLanguageNameA, xrefs: 6C8DE5A7
VerQueryValueW, xrefs: 6C8DE5E9
VerLanguageNameW, xrefs: 6C8DE5BD
VerFindFileW, xrefs: 6C8DE565
GetFileVersionInfoExW, xrefs: 6C8DE4E1
GetFileVersionInfoSizeExW, xrefs: 6C8DE50D
GetFileVersionInfoSizeW, xrefs: 6C8DE523

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: AddressProc$Ex@@FileHandleInfoVersion
String ID: GetFileVersionInfoA$GetFileVersionInfoByHandle$GetFileVersionInfoExW$GetFileVersionInfoSizeA$GetFileVersionInfoSizeExW$GetFileVersionInfoSizeW$GetFileVersionInfoW$VerFindFileA$VerFindFileW$VerInstallFileA$VerInstallFileW$VerLanguageNameA$VerLanguageNameW$VerQueryValueA$VerQueryValueW
API String ID: 3596192317-236624654
Opcode ID: f072896a3b02348bb7a272fdb9553e8c93e0909353785a1f3a2cbfd6befbd3db
Instruction ID: e53535ee521f09cf2b35ecded4f048107fcc1d63a5eaadbc3567a4ebcff32684
Opcode Fuzzy Hash: f072896a3b02348bb7a272fdb9553e8c93e0909353785a1f3a2cbfd6befbd3db
Instruction Fuzzy Hash: 7231207471A924EFDF217FA0CA088263FB5F767742321062DB909A6620E7315A20FF48

Function 6C8DFB96 Relevance: 30.2, APIs: 5, Strings: 12, Instructions: 457
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumKeyExW.KERNELBASE(?,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 6C8DFBCF
RegCloseKey.ADVAPI32(?), ref: 6C8DFD02
GlobalMemoryStatus.KERNEL32(?), ref: 6C8DFD0F

Part of subcall function 6C8E05F9: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000101,?,?,00000000), ref: 6C8E062C

Part of subcall function 6C8E05F9: RegQueryValueExW.KERNELBASE(?,00000000,00000000,00000000,?,?,?,00000000), ref: 6C8E0650
Part of subcall function 6C8E05F9: RegCloseKey.KERNELBASE(00000006), ref: 6C8E0689

Part of subcall function 6C8E03E4: GetNumberFormatW.KERNEL32(00000800,00000000,?,00000000,?,000003FD), ref: 6C8E0441

NetGetJoinInformation.NETAPI32(00000000,?,?,?,00000000,?,00000000,?), ref: 6C8E0153
NetApiBufferFree.NETAPI32(?,6C905408,?,Domain:,00000000,?,00000000,?,00000000,?), ref: 6C8E0214

Strings

Total Physical Memory:, xrefs: 6C8DFD7A
SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management, xrefs: 6C8E0020
Virtual Memory: In Use:, xrefs: 6C8DFFDD
Page File Location(s):, xrefs: 6C8E00FB
Virtual Memory: Max Size:, xrefs: 6C8DFEA8
Available Physical Memory:, xrefs: 6C8DFE11
Time zone:, xrefs: 6C8DFC97
Display, xrefs: 6C8DFC2C
Virtual Memory: Available:, xrefs: 6C8DFF3F
Domain:, xrefs: 6C8E01C6
PagingFiles, xrefs: 6C8E001B
Std, xrefs: 6C8DFBE9

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Close$BufferEnumFormatFreeGlobalInformationJoinMemoryNumberOpenQueryStatusValue
String ID: Available Physical Memory:$Display$Domain:$Page File Location(s):$PagingFiles$SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management$Std$Time zone:$Total Physical Memory:$Virtual Memory: Available:$Virtual Memory: In Use:$Virtual Memory: Max Size:
API String ID: 369352865-1736252339
Opcode ID: f569cd222b59f05cfcfec16784d3243669aa6de6b15faf39224c1d438dd23949
Instruction ID: c043fef11c118bd54a1e68b5ad4d18ade83cf3639b0c8c706722672764f93f81
Opcode Fuzzy Hash: f569cd222b59f05cfcfec16784d3243669aa6de6b15faf39224c1d438dd23949
Instruction Fuzzy Hash: E212FC318110699ACF35EB68CE90DDDB379AF95348F4109F9A10AA2960EF306F9DDF50

Function 2DE174DE Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 61
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,HeapSetInformation), ref: 2DE174F1
GetProcAddress.KERNEL32(00000000), ref: 2DE174F8
GetProcessHeap.KERNEL32(00000001,00000000,00000000), ref: 2DE1750A
GetSystemTimeAsFileTime.KERNEL32(?), ref: 2DE17517
GetCurrentProcessId.KERNEL32 ref: 2DE17523
GetCurrentThreadId.KERNEL32 ref: 2DE1752B
GetTickCount.KERNEL32 ref: 2DE17533
QueryPerformanceCounter.KERNEL32(?), ref: 2DE1753F
VirtualProtect.KERNELBASE(2DE032CC,00000004,00000040,?), ref: 2DE17561
VirtualProtect.KERNELBASE(2DE032CC,00000004,?,?), ref: 2DE17581

Strings

HeapSetInformation, xrefs: 2DE174E7
kernel32.dll, xrefs: 2DE174EC

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CurrentProcessProtectTimeVirtual$AddressCountCounterFileHandleHeapModulePerformanceProcQuerySystemThreadTick
String ID: HeapSetInformation$kernel32.dll
API String ID: 2966426798-3597996958
Opcode ID: 5ac41d8e3d28cc468847c5eea9df34e449443920141bdb95cdfff572bc11dd1b
Instruction ID: abf493660a71ce8ec7c99d90046e81815dfaf38e62c8f3643371ce2a7650bd3f
Opcode Fuzzy Hash: 5ac41d8e3d28cc468847c5eea9df34e449443920141bdb95cdfff572bc11dd1b
Instruction Fuzzy Hash: 261121B7D00214ABC710ABB0CC49B9E77F8AB08B56F420551FA42FB241DA75DA01CBA4

Function 2DE03C77 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 111
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 2DE03D39
SetLastError.KERNEL32(0000006F), ref: 2DE03D4F
GetLastError.KERNEL32 ref: 2DE03DA7
LoadLibraryW.KERNELBASE(Comctl32.dll), ref: 2DE03E19

Strings

Comctl32.dll, xrefs: 2DE03E05, 2DE03E0A, 2DE03E18
, xrefs: 2DE03D5A
GetModuleHandleExW, xrefs: 2DE03CF7
QueryActCtxW, xrefs: 2DE03CB0
@, xrefs: 2DE03DF4

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ErrorLast$FileLibraryLoadModuleName
String ID: $@$Comctl32.dll$GetModuleHandleExW$QueryActCtxW
API String ID: 2178654626-2626125606
Opcode ID: 97e74fdcb0b57d66c85690f563f94ca4b38ed0024d4d6e5f46bb0ac998f6ff87
Instruction ID: 4a448aeae9a162b8c916a73a19ce401ab2f0d65dcee8bd01de611009da70ed5a
Opcode Fuzzy Hash: 97e74fdcb0b57d66c85690f563f94ca4b38ed0024d4d6e5f46bb0ac998f6ff87
Instruction Fuzzy Hash: A741C3319093249ADB609B65CC88BED77B4EF94B16F100399E249F6190DF788A81CF55

Function 6C8D7E9F Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67
processCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 6C8D7EB6
Process32First.KERNEL32(000000FF,00000128), ref: 6C8D7EF6
CloseHandle.KERNEL32(000000FF,00000002,00000000), ref: 6C8D7F05

Strings

ERROR, xrefs: 6C8D7F0B
ERROR, xrefs: 6C8D7ECA

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID: ERROR$ERROR
API String ID: 1083639309-2579291623
Opcode ID: a95d703a53c0c058863904cc0947bf2bcfc29bfc1955ab9b1c5f65cfe8e3dd9b
Instruction ID: 7697f07892553eb9d7a520f610ebe72598f5d72a68a11f534e12970435c0934a
Opcode Fuzzy Hash: a95d703a53c0c058863904cc0947bf2bcfc29bfc1955ab9b1c5f65cfe8e3dd9b
Instruction Fuzzy Hash: 4F212F30A00218EBCB34DF65DE40BDD7774AF59305F1149B8A519A6AA0DB30AE89CF40

Function 6C8EDA0B Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 284
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 6C8EDB93
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C8EDBAF
__allrem.LIBCMT ref: 6C8EDBC6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C8EDBE4
__allrem.LIBCMT ref: 6C8EDBFB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C8EDC19

Strings

74732E646174, xrefs: 6C8EDC9F

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID: 74732E646174
API String ID: 1992179935-138923103
Opcode ID: 94d0e94a8f46061bbfe044791ce4e181156ba776a5c7f4a890ea9cae3aa4525e
Instruction ID: 72014c4ff83479da2e2638c78fcae1d52f8342a43993aab490f89b544408e354
Opcode Fuzzy Hash: 94d0e94a8f46061bbfe044791ce4e181156ba776a5c7f4a890ea9cae3aa4525e
Instruction Fuzzy Hash: FE812B716007159BE3309E6CCE40B9A73A9DFCA7A8F148A3FE510D7B80EB70DA098750

Function 2DE050C9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32), ref: 2DE050CF
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 2DE050E9
GetProcAddress.KERNEL32(00000000,GetSystemDEPPolicy), ref: 2DE050F3
SetProcessDEPPolicy.KERNEL32(00000001), ref: 2DE05106

Strings

SetProcessDEPPolicy, xrefs: 2DE050E3
GetSystemDEPPolicy, xrefs: 2DE050EB
KERNEL32, xrefs: 2DE050CA

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: GetSystemDEPPolicy$KERNEL32$SetProcessDEPPolicy
API String ID: 3256987805-2000083379
Opcode ID: 65ded2f1829e9e66ef7d8077a9ecd5e414f64ba099834ed8ba9d74fbec52d4cf
Instruction ID: f2df36c6b64b63516e6bc1c9e43c0d7bd62a94cfa4d811259a97d2892a6e7fee
Opcode Fuzzy Hash: 65ded2f1829e9e66ef7d8077a9ecd5e414f64ba099834ed8ba9d74fbec52d4cf
Instruction Fuzzy Hash: 91E08C32605B113AD60062F95CC4FBB6AF89FE99ABB100526FA01F620ACE95D411C5A2

Function 6C8E1FF8 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6C8E203F
___scrt_uninitialize_crt.LIBCMT ref: 6C8E2059

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: d30657f23192f3f9fabb32c9287ee10b359f23dffd83b2fd9d414469b4c6306f
Instruction ID: 7808d35ea3dd8998f4e9cd21bbd1eaa33e8ba8573b4c57d838a6f62d78f2d2d3
Opcode Fuzzy Hash: d30657f23192f3f9fabb32c9287ee10b359f23dffd83b2fd9d414469b4c6306f
Instruction Fuzzy Hash: 7E41EA72D0462AEBDB309F59CE08B9E7B75FB4B768F104D25E81967B40C7389A05CB90

Function 2DE16528 Relevance: 10.6, APIs: 7, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCR90 ref: 2DE1653D

Part of subcall function 2DE171BB: _setmbcp.MSVCR90 ref: 2DE171C3

free.MSVCR90 ref: 2DE165A5
Mailbox.LIBCMT ref: 2DE165B8
Mailbox.LIBCMT ref: 2DE165C9
Mailbox.LIBCMT ref: 2DE165DA
Mailbox.LIBCMT ref: 2DE165EB
Mailbox.LIBCMT ref: 2DE165FC

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Mailbox$?_set_new_handler@@_setmbcpfree
String ID:
API String ID: 2556944153-0
Opcode ID: 6af910436fbf5c720a7919511e3d48fdfbc5420c8bf4f35e033a9d1fa9ecf0ad
Instruction ID: df05ffe40137f81d467fc9d5efd219c420521f51f37c70c22b2472e2ec13b6fc
Opcode Fuzzy Hash: 6af910436fbf5c720a7919511e3d48fdfbc5420c8bf4f35e033a9d1fa9ecf0ad
Instruction Fuzzy Hash: 963135B0300A009BCB259F68C450A6EBBF2FF98710F104A1CE686B7694DF32ED41CB90

Function 6C8D7AE4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000,00000080,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8D589E
_strcat.LIBCMT ref: 6C8D7ABD
_strcat.LIBCMT ref: 6C8D7B2D
_strncpy.LIBCMT ref: 6C8D7B5F
Sleep.KERNEL32(00003A98,?,?,?,?,?,?,6C9042B6,6C9042A7,0000000C,0000000C,?,?,6C934458), ref: 6C8D7C23
Sleep.KERNEL32(?,6C9042B6,6C9042A7,0000000C,0000000C,?,?,6C934458), ref: 6C8D7C31
RpcStringFreeA.RPCRT4(?), ref: 6C8D7CDA

Strings

d, xrefs: 6C8D7A6C

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Sleep_strcat$CreateFileFreeString_strncpy
String ID: d
API String ID: 2099396881-2564639436
Opcode ID: 74a8efbd481e36517c7b804c19a520793e4418e79ea70e317d1c4bc0eb0c5a55
Instruction ID: cab01d362a9e7ce676c5be67d5187cae1e70aca3407062ff9fa2bc38db0af25f
Opcode Fuzzy Hash: 74a8efbd481e36517c7b804c19a520793e4418e79ea70e317d1c4bc0eb0c5a55
Instruction Fuzzy Hash: A3817870924169CADF74DB28CE91EEDB375AFA0208F5209F9918962990DFB067CDDF40

Function 6C8D62A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 176
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000,00000080,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8D589E
_strcat.LIBCMT ref: 6C8D6279
_strcat.LIBCMT ref: 6C8D62E9
_strncpy.LIBCMT ref: 6C8D631B
Sleep.KERNEL32(00003A98,?,?,?,?,?,?,6C9042B6,6C9042A7,0000000C,0000000C,?,?,6C934458), ref: 6C8D7C23
RpcStringFreeA.RPCRT4(?), ref: 6C8D7CDA

Strings

d, xrefs: 6C8D6221

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: _strcat$CreateFileFreeSleepString_strncpy
String ID: d
API String ID: 437704486-2564639436
Opcode ID: 0ddffeb2ce710e8e32f4c3328b5745409d06f914371a12b2d5371e3db3fa5005
Instruction ID: 990b239921dfbda015b4a2bdd6089ebfd2e7150170c786d2a35196f60d720569
Opcode Fuzzy Hash: 0ddffeb2ce710e8e32f4c3328b5745409d06f914371a12b2d5371e3db3fa5005
Instruction Fuzzy Hash: 06719870864159CADF74DB68CE91EEDB375AFA0208F4209E9918A62990DFB037CDDF41

Function 6C8E20A8 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6C8E20E5
dllmain_crt_dispatch.LIBCMT ref: 6C8E20FC
dllmain_raw.LIBCMT ref: 6C8E2144
dllmain_crt_dispatch.LIBCMT ref: 6C8E2157
dllmain_raw.LIBCMT ref: 6C8E216A

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 6f4113a9eb224bba814715fea13bb47d3d544fd429beb550260c0396608c9e7a
Instruction ID: e9de1c48a1f7ea62cf7922c6c43ca56a1492c3293e7a2e5416474546ed31aed8
Opcode Fuzzy Hash: 6f4113a9eb224bba814715fea13bb47d3d544fd429beb550260c0396608c9e7a
Instruction Fuzzy Hash: 17212C71D0161AEBCB314F59CE48AAF3A79FB8B798F004925F91867B50C3389E058BD0

Function 6C8E05F9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83
registryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000101,?,?,00000000), ref: 6C8E062C
RegQueryValueExW.KERNELBASE(?,00000000,00000000,00000000,?,?,?,00000000), ref: 6C8E0650
RegCloseKey.KERNELBASE(00000006), ref: 6C8E0689

Strings

N/A, xrefs: 6C8E066A

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: N/A
API String ID: 3677997916-2525114547
Opcode ID: 18d8f29ad51da1591e5f4898b785a875fe089768eead5829cca283be17493595
Instruction ID: cb5949d71f6e5449538a8392335ee3c82ea18182f36ce38c71cef2eed1057aa9
Opcode Fuzzy Hash: 18d8f29ad51da1591e5f4898b785a875fe089768eead5829cca283be17493595
Instruction Fuzzy Hash: AB310570A0424EEFDF10DF99D940BAE7BB0BF49304F208829E815A66A0DB74DA54DF60

Function 6C8F711E Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,6C8F7563,00000000,00000000,00000000), ref: 6C8F7422

Strings

Eastern Summer Time, xrefs: 6C8F74CF
Eastern Standard Time, xrefs: 6C8F74BB

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: abe699cafe15fe5e6993a97440c01dc0d1f784161c37fb9153ecc9b7945664fb
Instruction ID: fe7ce845a31338db922db90a63b816319a5cc5d7e36d2ba1631f3d503c815438
Opcode Fuzzy Hash: abe699cafe15fe5e6993a97440c01dc0d1f784161c37fb9153ecc9b7945664fb
Instruction Fuzzy Hash: 2AC18072A00125ABEB30AF68CE01AEE7779EF45798F644935E824D7780E7709E46C790

Function 6C8F73B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C8F26DF: HeapFree.KERNEL32(00000000,00000000,?,6C8FC163,?,00000000,?,?,6C8FC404,?,00000007,?,?,6C8FB896,?,?), ref: 6C8F26F5
Part of subcall function 6C8F26DF: GetLastError.KERNEL32(?,?,6C8FC163,?,00000000,?,?,6C8FC404,?,00000007,?,?,6C8FB896,?,?), ref: 6C8F2700

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,6C8F7563,00000000,00000000,00000000), ref: 6C8F7422

Strings

Eastern Summer Time, xrefs: 6C8F74CF
Eastern Standard Time, xrefs: 6C8F74BB

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3335090040-239921721
Opcode ID: 3ec4e08a8a8fcfafcbb5e9d37910b355c6a8b63227a6db8ecb68052a8f4ca216
Instruction ID: ed72e744227235909ece651e0b04b78dc7b137eced7242f6cf476cd5d8b955b9
Opcode Fuzzy Hash: 3ec4e08a8a8fcfafcbb5e9d37910b355c6a8b63227a6db8ecb68052a8f4ca216
Instruction Fuzzy Hash: 9541D971900525ABDB30AF6DCE059CE7F78EF46798B204A75E428D7A90EB709D06CB90

Function 6C8D7C93 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000,00000080,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8D589E
RpcStringFreeA.RPCRT4(?), ref: 6C8D7CDA

Strings

Runtime reported exception , xrefs: 6C8D7CAD

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: CreateFileFreeString
String ID: Runtime reported exception
API String ID: 201379981-1260309434
Opcode ID: 021a616e3411806567aaf6cadc33d07ad7f6781a8c2646d549db630f9d53c8d7
Instruction ID: 8bfeabe740e8de3a2c5e3fef4bd909eee90ff7ac8682709177c09cf7314fc884
Opcode Fuzzy Hash: 021a616e3411806567aaf6cadc33d07ad7f6781a8c2646d549db630f9d53c8d7
Instruction Fuzzy Hash: 20515730924169CADF74DB28CD91EEDB371AFA4218F5109E9918E62A90DFB076CDDF40

Function 2DE171BB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

_setmbcp.MSVCR90 ref: 2DE171C3

Part of subcall function 2DE15E3D: GetVersionExA.KERNEL32(?), ref: 2DE15E6A

Part of subcall function 2DE11766: __EH_prolog3.LIBCMT ref: 2DE1176D
Part of subcall function 2DE11766: GetClassInfoW.USER32(?,?,?), ref: 2DE1177F

Strings

AfxWndA, xrefs: 2DE1723E
AfxWndW, xrefs: 2DE17245

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ClassH_prolog3InfoVersion_setmbcp
String ID: AfxWndA$AfxWndW
API String ID: 329514372-64854810
Opcode ID: 6a282e33f2a40a4e87bd68a475a5dfcb41cda586579e782e554a13593cf369ce
Instruction ID: 997b85a27c01012eea14ebacc4fe09b4552363ffe2b16b2a11f63688770db368
Opcode Fuzzy Hash: 6a282e33f2a40a4e87bd68a475a5dfcb41cda586579e782e554a13593cf369ce
Instruction Fuzzy Hash: 132128B2A04249DFDB04DFA9C441A9EBBF4FB48750F10812AE515F7340EB35D942CB65

Function 2DE03E45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup), ref: 2DE03E58
GetLastError.KERNEL32 ref: 2DE03E8E

Strings

IsolationAware function called after IsolationAwareCleanup, xrefs: 2DE03E53

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: DebugErrorLastOutputString
String ID: IsolationAware function called after IsolationAwareCleanup
API String ID: 4132100945-2690750368
Opcode ID: 4f7ed09b74f1d6dacb50aa306d3edb595997ddf75352d858c255c980011f5f0d
Instruction ID: 527cd5ec6fc51f33c58d2766b730fd58c3500574e357dd278dc4eea3d0efc616
Opcode Fuzzy Hash: 4f7ed09b74f1d6dacb50aa306d3edb595997ddf75352d858c255c980011f5f0d
Instruction Fuzzy Hash: FFF09032A083248B8715AFA5890077EB6E5D705F977140226F7A6F0600CF75C852DBE5

Function 6C8E056B Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000004,00000000,00000000,00000101,00000004), ref: 6C8E05A0
RegQueryValueExW.KERNELBASE(00000004,00000001,00000000,00000000,00000004,00000004), ref: 6C8E05C1
RegCloseKey.ADVAPI32(00000004), ref: 6C8E05E4

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 8550ecd9173f44a70354ad687c1c09e1f6efc0b83701180902316e09f9642a2e
Instruction ID: e52b0e7b2ba543c2c155afb70677102ffb8a741499f1d7e15b490fa2f582bcac
Opcode Fuzzy Hash: 8550ecd9173f44a70354ad687c1c09e1f6efc0b83701180902316e09f9642a2e
Instruction Fuzzy Hash: 3F11237060420DEFEF11CF60C905BEE7BB4BB0A309F208829E915AA190DBB4DA94DF10

Function 6C8F5B29 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(6C8E8FE3,?,6C8E8FE3,?,?,?,2463616368652E646174), ref: 6C8F5B31
GetLastError.KERNEL32(?,6C8E8FE3,?,?,?,2463616368652E646174), ref: 6C8F5B3B
__dosmaperr.LIBCMT ref: 6C8F5B42

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: 582112237b673bd98227b13081c0256f4944977c3062010f2a47ba6ada68cae6
Instruction ID: b31711ba2f4e51905ac3e6c338d0632aab457fb7ec8f4fc8db7370024f6e0b18
Opcode Fuzzy Hash: 582112237b673bd98227b13081c0256f4944977c3062010f2a47ba6ada68cae6
Instruction Fuzzy Hash: CDD0123230C20CBB9F503FF6EC0884A7B7E9BA23787294A29F52CC5590EF31C4959951

Function 2DE19C6E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 4COMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(AfxOldWndProc), ref: 2DE19C73

Strings

AfxOldWndProc, xrefs: 2DE19C6E

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AtomGlobal
String ID: AfxOldWndProc
API String ID: 2189174293-2134796454
Opcode ID: d4217dee72e4177300e25165df6d35abc6edc369c666346bf9ee81b424c5cd5f
Instruction ID: 8490e39fbf53fde2146f8bf48e1fdd2717d6ea3805bb5707b58b8df0217edc5d
Opcode Fuzzy Hash: d4217dee72e4177300e25165df6d35abc6edc369c666346bf9ee81b424c5cd5f
Instruction Fuzzy Hash: 1CA022AB0020008383008FF0C0C8BE032F0AF80A03B2200C38033F03388E280080C38F

Function 6C8E0479 Relevance: 3.1, APIs: 2, Instructions: 78timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetDateFormatW.KERNELBASE(00000800,00000000,?,00000000,6C8DF0CA,000003FE,?,?,?,6C8DF0CA,?,00000000,?,00000000,?,00000000), ref: 6C8E0501
GetTimeFormatW.KERNEL32(00000800,00000000,?,00000000,00000000,00000000), ref: 6C8E0559

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Format$DateTime
String ID:
API String ID: 2545834208-0
Opcode ID: f790838552091bdce9506e4161047a615fa6f0e2860cf53d55d2d95df32ece6e
Instruction ID: 8ce486bdf476db4b2df769246b6438726bb0476480b6d625f5d9c18658a18c9e
Opcode Fuzzy Hash: f790838552091bdce9506e4161047a615fa6f0e2860cf53d55d2d95df32ece6e
Instruction Fuzzy Hash: 1A31A478E0024A9FDB00DFA8C981BAEB7B4EF18704F10445AE915EB750E734AA45CBA5

Function 2DE116D6 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE116DD
GetClassInfoA.USER32(?,?,?), ref: 2DE116EF

Part of subcall function 2DE10D75: RegisterClassA.USER32(?), ref: 2DE10DA4

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Class$H_prolog3InfoRegister
String ID:
API String ID: 1538853570-0
Opcode ID: c7c22eb8f7b14e36dca255616a0ec666563476ed3652da8b2b9a615a1859b1bc
Instruction ID: 41f7c54c93f7348133383d2809edf97374919f27fa2577515922fd41d20de380
Opcode Fuzzy Hash: c7c22eb8f7b14e36dca255616a0ec666563476ed3652da8b2b9a615a1859b1bc
Instruction Fuzzy Hash: 5A01B171704254BACB026A608C81F9F7BADEF26745F118514F659B6190CE34DE0187B6

Function 2DE05027 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?), ref: 2DE05032

Strings

0-, xrefs: 2DE05052

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: lstrcmpi
String ID: 0-
API String ID: 1586166983-1114002220
Opcode ID: a787ed22da077df86fa8b5d37a2b146f29c00f357b760bf3763710e4c0c6d434
Instruction ID: 8a9d2ef84c5730c7ed6c033890644b0a333031032d0f9abf4a54e8a4bddb1987
Opcode Fuzzy Hash: a787ed22da077df86fa8b5d37a2b146f29c00f357b760bf3763710e4c0c6d434
Instruction Fuzzy Hash: D2E0ED31214115AFD7529E65CC40A667BE8FF45B95340C82AF859F6114EE72D910DBE0

Function 2DE15FCC Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000002), ref: 2DE15FDE
GetSystemMetrics.USER32(00000003), ref: 2DE15FE8

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: 9e4da9da6fd3846626be3a876d2cad014e43beda641b95538cee8958df5b12cc
Instruction ID: 9044a5b9f88155e5f7a41718bf5436ce1e8e80d6e2b5ab320940da893f2200bf
Opcode Fuzzy Hash: 9e4da9da6fd3846626be3a876d2cad014e43beda641b95538cee8958df5b12cc
Instruction Fuzzy Hash: 58D05E338092208ED70C9B9498087A837F4F308B10F04400BF246A6380C7BC8841CB98

Function 6C8F2719 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,?,?,6C8E1C0F,00000000,?,6C8D447E,00000000,?,6C8D179D,00000000,?,6C8DA4C6,00000000,?), ref: 6C8F274B

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 497472592a46656b4dd3b86fa06673237a1eb467f7419ac2c1bf5eb72847fdc5
Instruction ID: 7c3010103d445a209ef135f61c1330da23ee34cc41fada962f478cad73faaa93
Opcode Fuzzy Hash: 497472592a46656b4dd3b86fa06673237a1eb467f7419ac2c1bf5eb72847fdc5
Instruction Fuzzy Hash: B5E02B312052656BEB312A6E8F0978B7A5C9F537E4F110931DD34D2DC0DB18D41342E1

Function 2DE10D75 Relevance: 1.5, APIs: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegisterClassA.USER32(?), ref: 2DE10DA4

Part of subcall function 2DE03E45: OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup), ref: 2DE03E58

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ClassDebugOutputRegisterString
String ID:
API String ID: 3599523695-0
Opcode ID: f7ecc1f92a0668298174b18dbe70631bd3bfc5fdc31549c9e8484fc3f079f4da
Instruction ID: 777efd4dfe5afe9d8f14c631cd8cb51412d98a8228a122e5ade9ae0b62ae19ab
Opcode Fuzzy Hash: f7ecc1f92a0668298174b18dbe70631bd3bfc5fdc31549c9e8484fc3f079f4da
Instruction Fuzzy Hash: 4BF03071D05209DACB40EFA589006FDBAF5FF54700F614116E565F6190CF34CA42DB24

Function 2DE181E3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 3c9221a8330db71b842a43b363df4827e11af7726f289f1a230b4738da640df6
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 3c9221a8330db71b842a43b363df4827e11af7726f289f1a230b4738da640df6
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE181F0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 374f67c20174960b52ec27608b5ab030bc443be68ee213b82e3feaf5970ff3fc
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 374f67c20174960b52ec27608b5ab030bc443be68ee213b82e3feaf5970ff3fc
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE181FD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: fd43a3fdb2278bbe56b9ac39c2a82664b83aad6ef90ab75cbd57617ea47e249d
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: fd43a3fdb2278bbe56b9ac39c2a82664b83aad6ef90ab75cbd57617ea47e249d
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE181C9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 46b048f0821808117381df587b5b8618c0fad5ea4ea476e1da7cef26fa50cee7
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 46b048f0821808117381df587b5b8618c0fad5ea4ea476e1da7cef26fa50cee7
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE181D6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 5bc63d5c6e5a8a3ef60220b49febf800ab0fc058a1edb16725ab86c0f77e6273
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 5bc63d5c6e5a8a3ef60220b49febf800ab0fc058a1edb16725ab86c0f77e6273
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE181BC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 063e76ee425b43f93cf38798988bf6c04c12ff4ad0aec89d06dcffa3ae7c9730
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 063e76ee425b43f93cf38798988bf6c04c12ff4ad0aec89d06dcffa3ae7c9730
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE1819E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 8a923b9224360a3a599a032f7f8a87c35929414743092b0e913b1d5e3866dd41
Instruction ID: cebcb2f984bb943f2752833b3bbbad2641584a406617695772ac7b2ee9e42ff2
Opcode Fuzzy Hash: 8a923b9224360a3a599a032f7f8a87c35929414743092b0e913b1d5e3866dd41
Instruction Fuzzy Hash: E8A011A23A8002BC300A8208AC88CBA830CC2C0A20320C30AF020F0000AC00EC080030

Function 2DE18244 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 684399203c9170340643cc195a1b5a13f624fcf938c97921d1119d1a4a7f695a
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 684399203c9170340643cc195a1b5a13f624fcf938c97921d1119d1a4a7f695a
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE18254 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: f482adabd21e7af47428a80a1bf8fbbba5d94189440d9136d560cb4316e510b9
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: f482adabd21e7af47428a80a1bf8fbbba5d94189440d9136d560cb4316e510b9
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE18224 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 0e10e93c898f85eb97ec8577bce6e67cc111cf1ce03047cd5587b9a48a1f9c0b
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 0e10e93c898f85eb97ec8577bce6e67cc111cf1ce03047cd5587b9a48a1f9c0b
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE18234 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 91ea8d7b3527954384456e8f02118ab07569016c625addee9a318f1b907ff370
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 91ea8d7b3527954384456e8f02118ab07569016c625addee9a318f1b907ff370
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE1820A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 80fe5ea136582966b2d23c62aa090d18069f494a45ee588e0e9344bac8a7ba4b
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 80fe5ea136582966b2d23c62aa090d18069f494a45ee588e0e9344bac8a7ba4b
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE18217 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 2DE181A8

Part of subcall function 2DE18A22: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 2DE18A9B

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 5981c30ec32350a43957859c9a7d0fd5bab64f05ceb70fa934ec85ea2d86ad43
Instruction ID: efc6d43cba1d3b2f555f985efa26ea3c6e1e122e654d18d09dcf306df2d5a65f
Opcode Fuzzy Hash: 5981c30ec32350a43957859c9a7d0fd5bab64f05ceb70fa934ec85ea2d86ad43
Instruction Fuzzy Hash: C5A011823AC002FC300A8208AC88CBA830CC2C0AA0320CB0AE020B0000AC00CC080030

Function 2DE178B5 Relevance: 1.5, APIs: 1, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CurrentProcessProtectTimeVirtual$AddressCountCounterFileHandleHeapModulePerformanceProcQuerySystemThreadTick
String ID:
API String ID: 2966426798-0
Opcode ID: b1d9e3360e75d73aef1975e7a51aa155834824d47b87844c87d294b04e291f44
Instruction ID: e78b5431c3df2289def5fc0514eb564146f851374970ea3c46f2ab85c2feb5c9
Opcode Fuzzy Hash: b1d9e3360e75d73aef1975e7a51aa155834824d47b87844c87d294b04e291f44
Instruction Fuzzy Hash:

Non-executed Functions

Function 2DE07BC9 Relevance: 21.3, APIs: 14, Instructions: 274windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE07BD0
IsIconic.USER32(00000001), ref: 2DE07C45
SetForegroundWindow.USER32(00000001), ref: 2DE07C69
LoadMenuW.USER32(?,00000048), ref: 2DE07CA7
MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000001), ref: 2DE07CDB
SetWindowLongA.USER32(00000003,000000F4,0000E900), ref: 2DE07D64
GetFocus.USER32 ref: 2DE07D6A
SetFocus.USER32(00000003,00000000,?,?,00000000,?,?,00CF0000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 2DE07D83

Part of subcall function 2DE12F6C: GetMessageA.USER32(2DE1E9A0,00000000,00000000,00000000), ref: 2DE12F79
Part of subcall function 2DE12F6C: TranslateMessage.USER32(2DE1E9A0), ref: 2DE12F99
Part of subcall function 2DE12F6C: DispatchMessageA.USER32(2DE1E9A0), ref: 2DE12FA0

GetSystemMetrics.USER32(00000000), ref: 2DE07DAF
GetSystemMetrics.USER32(00000001), ref: 2DE07DDF
GetSystemMetrics.USER32(00000001), ref: 2DE07E15
SetForegroundWindow.USER32(00000003), ref: 2DE07E48
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 2DE07E7E
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 2DE07ECD

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Message$MetricsSystemWindow$FocusForegroundPeek$ByteCharDispatchH_prolog3_catchIconicLoadLongMenuMultiTranslateWide
String ID:
API String ID: 2541888167-0
Opcode ID: 290a08594d3c1373832ecd646cb7b35f3fae9b5f89bf84448277df58dea2848e
Instruction ID: 62f3655488501c880ed43d426ecc0c1284c9343c02d18e12cd801800864164f7
Opcode Fuzzy Hash: 290a08594d3c1373832ecd646cb7b35f3fae9b5f89bf84448277df58dea2848e
Instruction Fuzzy Hash: 34A19E71A01119EBCF05EFA4C885AAE7BB5EF48756F118019F90ABB245CF74DE41CBA0

Function 6C8FCF41 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C8F02DC: GetLastError.KERNEL32(?,00000008,6C8F9E39,00000000,6C8E68B0), ref: 6C8F02E0
Part of subcall function 6C8F02DC: SetLastError.KERNEL32(00000000,00000008,000000FF), ref: 6C8F0382

GetACP.KERNEL32(?,?,?,?,?,?,6C8F0D22,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 6C8FD002
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,6C8F0D22,?,?,?,00000055,?,-00000050,?,?), ref: 6C8FD02D
_wcschr.LIBVCRUNTIME ref: 6C8FD0C1
_wcschr.LIBVCRUNTIME ref: 6C8FD0CF
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 6C8FD190

Strings

utf8, xrefs: 6C8FD0FF

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: f25d2644a2116f46da9e3f5c971fe230a5ac3fb505c60491beee5c9367101c9e
Instruction ID: 2b38e6b40aa3979c9678efbce03e91a5ae66100e7df6e7bca8fca3736114b0ad
Opcode Fuzzy Hash: f25d2644a2116f46da9e3f5c971fe230a5ac3fb505c60491beee5c9367101c9e
Instruction Fuzzy Hash: E7712F71604206AAE734AF39CE41BE6B3A8EF45388F104C3AE625D7A81F774D547C760

Function 2DE17592 Relevance: 10.6, APIs: 7, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 2DE17E3C
_crt_debugger_hook.MSVCR90(00000001), ref: 2DE17E49
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 2DE17E51
UnhandledExceptionFilter.KERNEL32(2DE03308), ref: 2DE17E5C
_crt_debugger_hook.MSVCR90(00000001), ref: 2DE17E6D
GetCurrentProcess.KERNEL32(C0000409), ref: 2DE17E78
TerminateProcess.KERNEL32(00000000), ref: 2DE17E7F

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled_crt_debugger_hook$CurrentDebuggerPresentTerminate
String ID:
API String ID: 3369434319-0
Opcode ID: 57dc467342b30da1e5f46a0a0a29976b29a7f0103eb706373591e4cd37f5fbd6
Instruction ID: 0ed8bb1e5ad0440355285c97adff1f601f88bbca9fa52522f07f9a61804034bf
Opcode Fuzzy Hash: 57dc467342b30da1e5f46a0a0a29976b29a7f0103eb706373591e4cd37f5fbd6
Instruction Fuzzy Hash: D421DFB7902744AFC321DFA4D4897583BF4BB08B11F50901AE40AA7B50EB789981CF0D

Function 6C8FD6D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,6C8FD9EE,00000002,00000000,?,?,?,6C8FD9EE,?,00000000), ref: 6C8FD769
GetLocaleInfoW.KERNEL32(?,20001004,6C8FD9EE,00000002,00000000,?,?,?,6C8FD9EE,?,00000000), ref: 6C8FD792
GetACP.KERNEL32(?,?,6C8FD9EE,?,00000000), ref: 6C8FD7A7

Strings

ACP, xrefs: 6C8FD6EE
OCP, xrefs: 6C8FD724

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8427f81026d0536a92782b880799bef533a4b414c83e27bfb0f1c5ded288f7bf
Instruction ID: b4b84f9f22adb7cf97d06a1a91b9e5ace976bdf5778f696542764f6845f173e4
Opcode Fuzzy Hash: 8427f81026d0536a92782b880799bef533a4b414c83e27bfb0f1c5ded288f7bf
Instruction Fuzzy Hash: 1721A722709104D6D7349F15CB01B8772B6EB43BD8B668E2AEA29DF900F731DD42C750

Function 6C8FD8A5 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C8F02DC: GetLastError.KERNEL32(?,00000008,6C8F9E39,00000000,6C8E68B0), ref: 6C8F02E0
Part of subcall function 6C8F02DC: SetLastError.KERNEL32(00000000,00000008,000000FF), ref: 6C8F0382

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 6C8FD9B1
IsValidCodePage.KERNEL32(00000000), ref: 6C8FD9FA
IsValidLocale.KERNEL32(?,00000001), ref: 6C8FDA09
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 6C8FDA51
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 6C8FDA70

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 708086c4e929f383090b5a1528856f07b7b57a0338e027e95d1c5452b1a648d9
Instruction ID: c6f67a2f4b8f4d88825ebd16f7911bd8815e6fb4e1cda28e5e091fb8be41164e
Opcode Fuzzy Hash: 708086c4e929f383090b5a1528856f07b7b57a0338e027e95d1c5452b1a648d9
Instruction Fuzzy Hash: FC516571B012059FEF20DFA9CD40BAE77F8AF45744F21482AAA34E7640D770E9468B61

Function 6C8F5CB2 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6C8F5D3F

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 5a2df6829468a3d1ba630fb8cbc36a6c6803c4e92b5340e5fff4db1baf62b945
Instruction ID: 64f91ab19adffea2910eab6a9a835cc02ef0ef7f7d0e31aa798ed129f3759cb2
Opcode Fuzzy Hash: 5a2df6829468a3d1ba630fb8cbc36a6c6803c4e92b5340e5fff4db1baf62b945
Instruction Fuzzy Hash: 68B16C31A053459FEB218F68C990BEEBBB5EF55384F14C5AAD424ABB41D334D907CBA0

Function 6C8E270B Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6C8E2717
IsDebuggerPresent.KERNEL32 ref: 6C8E27E3
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6C8E2803
UnhandledExceptionFilter.KERNEL32(?), ref: 6C8E280D

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 638b0b6778bf47af338e41ad40fcffda6bb9859e1233b36c375a9042896f14e5
Instruction ID: a478b33246b67ff7313430a183f11d77b5e313af9914d6309095d93a5fe49f09
Opcode Fuzzy Hash: 638b0b6778bf47af338e41ad40fcffda6bb9859e1233b36c375a9042896f14e5
Instruction Fuzzy Hash: 59314A75D0522D9BDF21DFA5DA897CCBBB8BF19304F1045AAE40CAB240EB749B849F44

Function 2DE0DA85 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 197stringCOMMON

Download Yara Rule

APIs

GetProfileStringA.KERNEL32(intl,sList,2DE028B4,?,00000003), ref: 2DE0DABC
IsDBCSLeadByte.KERNEL32(00000000,?,?,?,?,?), ref: 2DE0DAD6
CharNextA.USER32(?), ref: 2DE0DB05
memset.MSVCR90 ref: 2DE0DB19
CharNextA.USER32(?), ref: 2DE0DB5A
isspace.MSVCR90 ref: 2DE0DB66
memset.MSVCR90 ref: 2DE0DB75
lstrlenA.KERNEL32(00000000), ref: 2DE0DB88
CharPrevA.USER32(?,00000000), ref: 2DE0DB94
isspace.MSVCR90 ref: 2DE0DBA0
CharNextA.USER32(00000000), ref: 2DE0DBA8
memset.MSVCR90 ref: 2DE0DBB6
malloc.MSVCR90 ref: 2DE0DBEF
malloc.MSVCR90 ref: 2DE0DC11
lstrlenA.KERNEL32(?), ref: 2DE0DC30
malloc.MSVCR90 ref: 2DE0DC3A
CharNextA.USER32(?), ref: 2DE0DC58

Strings

sList, xrefs: 2DE0DAA1
intl, xrefs: 2DE0DAA6

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Char$Next$mallocmemset$isspacelstrlen$ByteLeadPrevProfileString
String ID: intl$sList
API String ID: 1792931721-3643076868
Opcode ID: bf8fbc612642cf501f2d6c9593b33af8d70f793b01dd504c461bb7771a5d14c1
Instruction ID: 85f439606f4543b4cb57da21a7ab1d77fb6269e1b93010b229283cb028babac0
Opcode Fuzzy Hash: bf8fbc612642cf501f2d6c9593b33af8d70f793b01dd504c461bb7771a5d14c1
Instruction Fuzzy Hash: CE61F475900255AFDB118F65C8C4BBDBBF8EF0526AF10806AE985F7641DB7ACA40CF60

Function 2DE14681 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 188windowCOMMON

Download Yara Rule

APIs

Part of subcall function 2DE12240: LoadResource.KERNEL32(2DE00000,00000000,2DE00000,?,000000F0), ref: 2DE1227A
Part of subcall function 2DE12240: LockResource.KERNEL32(00000000), ref: 2DE12288
Part of subcall function 2DE12240: SendDlgItemMessageA.USER32(00000001,?,?,00000000,00000000), ref: 2DE122D8
Part of subcall function 2DE12240: FreeResource.KERNEL32(?), ref: 2DE122F0

EndDialog.USER32(?,00000003), ref: 2DE146BC

Part of subcall function 2DE06288: GetDlgItem.USER32(?,?), ref: 2DE06291

ShowWindow.USER32(?,00000000,?,00000000), ref: 2DE146E7
memset.MSVCR90 ref: 2DE14714
memset.MSVCR90 ref: 2DE14723
memset.MSVCR90 ref: 2DE1476C
GetDC.USER32(00000000), ref: 2DE147BC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 2DE147CB
ReleaseDC.USER32(00000000,?), ref: 2DE147F2
CreateFontIndirectW.GDI32(FFFFFFF5), ref: 2DE14828
CreateFontIndirectW.GDI32(FFFFFFF5), ref: 2DE1483B
CreateFontIndirectW.GDI32(FFFFFFF5), ref: 2DE1485F
GetWindow.USER32(?,00000005), ref: 2DE1486A
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 2DE1488A
GetObjectW.GDI32(00000000,0000005C,?), ref: 2DE1489A
SendMessageA.USER32(?,00000030,?,00000000), ref: 2DE148D0
GetWindow.USER32(?,00000002), ref: 2DE148DA

Strings

@, xrefs: 2DE147A0
@, xrefs: 2DE1473E

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CreateFontIndirectMessageResourceSendWindowmemset$Item$CapsDeviceDialogFreeLoadLockObjectReleaseShow
String ID: @$@
API String ID: 1409219205-149943524
Opcode ID: dfd6ae548f6e67369d0b8e4d9439b5f187f1b678dd6663c1e9508cf80ad897a4
Instruction ID: f1fc852bb682c3422807fdd19d565e8e8e16324926b382bc3b4a88d834d813cd
Opcode Fuzzy Hash: dfd6ae548f6e67369d0b8e4d9439b5f187f1b678dd6663c1e9508cf80ad897a4
Instruction Fuzzy Hash: E5616D71A042689EDB219B64CC44BEEBBF8BF18745F4045A9E20AF6290DB75DE80CF54

Function 2DE041B0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 106threadCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 2DE041EF
GetWindowThreadProcessId.USER32(?,?), ref: 2DE041FC
GetCurrentProcessId.KERNEL32 ref: 2DE04202
GetLastError.KERNEL32 ref: 2DE04225
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 2DE042AB
SetLastError.KERNEL32(?), ref: 2DE042E5

Strings

n2ub, xrefs: 2DE041CF
Unknown, xrefs: 2DE0429A
W, xrefs: 2DE041C3
t2ub, xrefs: 2DE0426E
q2ub, xrefs: 2DE042D8
r2ub, xrefs: 2DE0425D
openas, xrefs: 2DE04293
o2ub, xrefs: 2DE042D1

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ErrorLast$Process$CurrentParentThreadWindow
String ID: Unknown$W$n2ub$o2ub$openas$q2ub$r2ub$t2ub
API String ID: 3874811631-1827479352
Opcode ID: 664cb6042f8f2427c7b426443daa625d9676b55b495372ee7eb878a11a592400
Instruction ID: 5624995efa62e45a80d2015e29ddcb3a68734019700b062c3cd6d2bf9985900d
Opcode Fuzzy Hash: 664cb6042f8f2427c7b426443daa625d9676b55b495372ee7eb878a11a592400
Instruction Fuzzy Hash: E631F6B2600605EFD701AFE1CA88A9E7AF8FF1465BB118529E616F7210CF74DE40CB64

Function 2DE09F94 Relevance: 21.4, APIs: 9, Strings: 3, Instructions: 365comfileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 2DE09F9E
ReadClassStg.OLE32(?,?,?,00000000,?,?,00000000,?), ref: 2DE0A089
OleLoad.OLE32(?,2DE017D0,?,?), ref: 2DE0A0D6
_strdup.MSVCR90(?), ref: 2DE0A1DB
MultiByteToWideChar.KERNEL32(00000000,00000001,?,000000FF,?,00000104,?,00000000,?,?), ref: 2DE0A250
GetClassFile.OLE32(00000000), ref: 2DE0A25F
MultiByteToWideChar.KERNEL32(00000000,00000001,?,000000FF,?,00000104,2DE017D0,00000001,00000000,?,?,?), ref: 2DE0A2C3
OleCreateLinkToFile.OLE32(00000000), ref: 2DE0A2D2
OleSetContainedObject.OLE32(?,00000001), ref: 2DE0A31A

Strings

Note, xrefs: 2DE0A307, 2DE0A30C, 2DE0A30D
HrThreadFuncWaitOnClose, xrefs: 2DE0A3D9
L"-, xrefs: 2DE0A128, 2DE0A0EB

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ByteCharClassFileMultiWide$ContainedCreateH_prolog3_LinkLoadObjectRead_strdup
String ID: HrThreadFuncWaitOnClose$L"-$Note
API String ID: 1990140484-749375652
Opcode ID: ff8526354651f11c4d5cfd00d36eaeef83786d052839b11786698df0265a969d
Instruction ID: 1e9b259ac48dd1adc301392e6ee38f33c7b3e2d421be94de005b4b1ebb7b3f5d
Opcode Fuzzy Hash: ff8526354651f11c4d5cfd00d36eaeef83786d052839b11786698df0265a969d
Instruction Fuzzy Hash: 31D14C71604128AFCB169B64CC84FAA77B9EF48701F1540A4F609FB251DB74AF81CB60

Function 2DE09A90 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 180stringCOMMON

Download Yara Rule

APIs

_splitpath_s.MSVCR90 ref: 2DE09ADD

Part of subcall function 2DE08FD6: lstrlenA.KERNEL32(?), ref: 2DE08FE3

_splitpath_s.MSVCR90 ref: 2DE09B35
lstrlenA.KERNEL32(?), ref: 2DE09B5F
_makepath_s.MSVCR90 ref: 2DE09B8C
CloseHandle.KERNEL32(00000000), ref: 2DE09BCE

Part of subcall function 2DE08FD6: IsCharAlphaNumericA.USER32(?,?), ref: 2DE09017

Part of subcall function 2DE04609: _vsnprintf.MSVCR90 ref: 2DE0463A

CharPrevA.USER32(?,?), ref: 2DE09C00
lstrlenA.KERNEL32(?), ref: 2DE09C53
_makepath_s.MSVCR90 ref: 2DE09C81
GetLastError.KERNEL32 ref: 2DE09CA1
CloseHandle.KERNEL32(00000000), ref: 2DE09CCB

Strings

., xrefs: 2DE09AF2
%s%x, xrefs: 2DE09C37

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: lstrlen$CharCloseHandle_makepath_s_splitpath_s$AlphaErrorLastNumericPrev_vsnprintf
String ID: %s%x$.
API String ID: 3070513225-3101762996
Opcode ID: c380954a205d623cb66a27fe5a850227fcbf912c343e0c476c3aab25ebe947b6
Instruction ID: de830af3b0f30261b6ab76716317b26e3682d5680cbc4ed736ce115ce1889152
Opcode Fuzzy Hash: c380954a205d623cb66a27fe5a850227fcbf912c343e0c476c3aab25ebe947b6
Instruction Fuzzy Hash: 286139B690011CAEDB209F60CD84FEBB7BCEB25346F0045A5E65AF2141EA359F84CF64

Function 2DE036BC Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(olmapi32.dll,?,2DE03757), ref: 2DE036EB
GetProcAddress.KERNEL32(00000000,SetGuardValue), ref: 2DE03704
GetProcAddress.KERNEL32(00000000,GetGuardValue), ref: 2DE03711
GetProcAddress.KERNEL32(00000000,SetExemptValue), ref: 2DE0371E
GetProcAddress.KERNEL32(00000000,GetExemptValue), ref: 2DE0372B
GetProcAddress.KERNEL32(00000000,AssertGuardedAPIAllowed), ref: 2DE03738

Strings

GetExemptValue, xrefs: 2DE03720
GetGuardValue, xrefs: 2DE03706
AssertGuardedAPIAllowed, xrefs: 2DE0372D
SetExemptValue, xrefs: 2DE03713
olmapi32.dll, xrefs: 2DE036E6
SetGuardValue, xrefs: 2DE036FE

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AssertGuardedAPIAllowed$GetExemptValue$GetGuardValue$SetExemptValue$SetGuardValue$olmapi32.dll
API String ID: 667068680-308179802
Opcode ID: 2da1637b33e42520db35a5d7ec3998ebfb3160fb8f0dfab416e0f88474edc647
Instruction ID: 988fb480c345da6b462c81b053b744b3773b4339da8b9e9e132506be8564a9c1
Opcode Fuzzy Hash: 2da1637b33e42520db35a5d7ec3998ebfb3160fb8f0dfab416e0f88474edc647
Instruction Fuzzy Hash: FAF0A4729013116AC3016F799C4CBA67FF8EF95E16308009BF06AFF21ADEB89451CB55

Function 2DE036DC Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(olmapi32.dll,?,2DE03757), ref: 2DE036EB
GetProcAddress.KERNEL32(00000000,SetGuardValue), ref: 2DE03704
GetProcAddress.KERNEL32(00000000,GetGuardValue), ref: 2DE03711
GetProcAddress.KERNEL32(00000000,SetExemptValue), ref: 2DE0371E
GetProcAddress.KERNEL32(00000000,GetExemptValue), ref: 2DE0372B
GetProcAddress.KERNEL32(00000000,AssertGuardedAPIAllowed), ref: 2DE03738

Strings

GetExemptValue, xrefs: 2DE03720
GetGuardValue, xrefs: 2DE03706
AssertGuardedAPIAllowed, xrefs: 2DE0372D
SetExemptValue, xrefs: 2DE03713
olmapi32.dll, xrefs: 2DE036E6
SetGuardValue, xrefs: 2DE036FE

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AssertGuardedAPIAllowed$GetExemptValue$GetGuardValue$SetExemptValue$SetGuardValue$olmapi32.dll
API String ID: 667068680-308179802
Opcode ID: ffc7b254352cf169da9c06b4b7315b3856ebb7b7dee4b2775e132e7724cf2903
Instruction ID: e0cd10a272b55b308a936e0bffb4ee0005b5159f6a0e10c4fde9fcb6ec60735c
Opcode Fuzzy Hash: ffc7b254352cf169da9c06b4b7315b3856ebb7b7dee4b2775e132e7724cf2903
Instruction Fuzzy Hash: E5F090729013256AC3046F39CC4CFA6BEF8EB90E16B04045BB02AFB315DBB89410CE54

Function 2DE0BCEB Relevance: 19.6, APIs: 13, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 2DE0BD3B
EnableWindow.USER32(?,00000001), ref: 2DE0BD49
DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BD63
EnableWindow.USER32(?,00000001), ref: 2DE0BD6D
DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BD92
ShowWindow.USER32(?,00000000), ref: 2DE0BDB0
EnableWindow.USER32(?,00000000), ref: 2DE0BDBD
ShowWindow.USER32(?,00000000), ref: 2DE0BDCA
EnableWindow.USER32(?,00000000), ref: 2DE0BDD7
DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BE1E
DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BE3D
DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BE59
DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,0000000C), ref: 2DE0BE86

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Defer$Enable$Show$Rect
String ID:
API String ID: 3661885419-0
Opcode ID: eecf1b75bd186642706e7a15d1bb290a6188f4abe5dc8f695ac0815e82b51720
Instruction ID: 0ed2a44ee243fdbb2ef71b4a8379aa11c53314dec4cc464ba6735a971b866519
Opcode Fuzzy Hash: eecf1b75bd186642706e7a15d1bb290a6188f4abe5dc8f695ac0815e82b51720
Instruction Fuzzy Hash: 845195B6500609AFDB11DFA8CC84EEABBF9FF48345F004419F96A96260D771AD50DF60

Function 2DE08587 Relevance: 19.6, APIs: 13, Instructions: 103windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 2DE085A1
ScreenToClient.USER32(?,?), ref: 2DE085AA
GetWindowRect.USER32(?,?), ref: 2DE085CB
ScreenToClient.USER32(?,?), ref: 2DE085D4
GetWindowRect.USER32(?,?), ref: 2DE085EE
ScreenToClient.USER32(?,?), ref: 2DE08609
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 2DE08620
MoveWindow.USER32(?,?,?,?,00000001,00000000), ref: 2DE08635
SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 2DE08643
SendMessageA.USER32(?,00000441,00000000,00000000), ref: 2DE08654
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 2DE08662
GetWindowRect.USER32(?,?), ref: 2DE0866E
ScreenToClient.USER32(?,?), ref: 2DE08677

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$ClientRectScreen$MessageSend$Move
String ID:
API String ID: 442886372-0
Opcode ID: 13306a61e9a0b6b5bd1c820945d2b3ca7b5496e6a891c2c3e65446d3432abdfe
Instruction ID: 67756aeb0e198cde58ebb18b7465ba080efbe278f67839f37bd033683e832fd5
Opcode Fuzzy Hash: 13306a61e9a0b6b5bd1c820945d2b3ca7b5496e6a891c2c3e65446d3432abdfe
Instruction Fuzzy Hash: 0A41D276900609AFDB12DFA8CA45BDEBBF9FF08701F104465F612F6260D772AA10DB14

Function 2DE08C62 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 138fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE08C69
??_U@YAPAXI@Z.MSVCR90(00001000,00000030,2DE09EEC,00000000,?,?,00000014,2DE0A4D2), ref: 2DE08CA0

Part of subcall function 2DE13812: Mailbox.LIBCMT ref: 2DE159AE

Part of subcall function 2DE06995: LoadCursorA.USER32(00000000,?), ref: 2DE069A0
Part of subcall function 2DE06995: SetCursor.USER32(00000000), ref: 2DE069A7

SetCursor.USER32(L"-,00000000), ref: 2DE08CF7
??_V@YAXPAX@Z.MSVCR90(?), ref: 2DE08D03
GetLastError.KERNEL32 ref: 2DE08D3F
ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 2DE08DA9
GetLastError.KERNEL32 ref: 2DE08DB5
CloseHandle.KERNEL32(000000FF), ref: 2DE08DC9
SetCursor.USER32(L"-), ref: 2DE08DD2
??_V@YAXPAX@Z.MSVCR90(?), ref: 2DE08DDE

Part of subcall function 2DE10293: LoadStringW.USER32(?,?,?,00000200), ref: 2DE10398

Strings

L"-, xrefs: 2DE08CBA, 2DE08DCF, 2DE08CF2

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Cursor$ErrorLastLoad$CloseFileH_prolog3_catchHandleMailboxReadString
String ID: L"-
API String ID: 318333782-653488915
Opcode ID: c72aa40b642ab750a6b29e80ed70b053074ee9c90098a300b2bd53947873a5e2
Instruction ID: 4971d3a002306baf27dbb85bec56b530cf0803773d299f597d0516b688d12f68
Opcode Fuzzy Hash: c72aa40b642ab750a6b29e80ed70b053074ee9c90098a300b2bd53947873a5e2
Instruction Fuzzy Hash: D2513A71900209EFCB05AFA4C884AEDBBB9FF18715F108659F625BB291CB348E45CB60

Function 2DE0F1BA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 126registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00000001,?,00000000,?,80000000), ref: 2DE0F246
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 2DE0F26D
RegCloseKey.ADVAPI32(?), ref: 2DE0F29F
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00000001,?), ref: 2DE0F2DA
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 2DE0F301
GetSystemDefaultLCID.KERNEL32 ref: 2DE0F31B
RegCloseKey.ADVAPI32(?), ref: 2DE0F32F
GetSystemDefaultLCID.KERNEL32 ref: 2DE0F337

Strings

UILanguage, xrefs: 2DE0F1FC
Software\Policies\Microsoft\Office\14.0\Common\LanguageResources, xrefs: 2DE0F1D2
Software\Microsoft\Office\14.0\Common\LanguageResources, xrefs: 2DE0F1F2

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CloseDefaultOpenQuerySystemValue
String ID: Software\Microsoft\Office\14.0\Common\LanguageResources$Software\Policies\Microsoft\Office\14.0\Common\LanguageResources$UILanguage
API String ID: 1931360540-2478438763
Opcode ID: 8b7d7f2f51cf58a17fe12ffb29efd41d556ee8cc938cac258ad6e5ab258ae6ad
Instruction ID: 7c40d89992d10d377e8a6cbc057cf58f26daefa917ffd8804153a0443dfdc308
Opcode Fuzzy Hash: 8b7d7f2f51cf58a17fe12ffb29efd41d556ee8cc938cac258ad6e5ab258ae6ad
Instruction Fuzzy Hash: 0D514C76A00228DFEB22CF60CC81FEAB7B8BB49715F0040D5E509FA281DB759A85CF51

Function 2DE183CC Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 116libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 2DE183F5
LoadLibraryExW.KERNEL32(?,00000000,00000008,msi.dll,?,00000106), ref: 2DE1844A
LoadLibraryW.KERNEL32(msi.dll), ref: 2DE18457
GetProcAddress.KERNEL32(00000000,MsiGetProductCodeW), ref: 2DE18473
GetProcAddress.KERNEL32(00000000,MsiProvideQualifiedComponentExW), ref: 2DE18481

Strings

{1E77DE88-BCAB-4C37-B9E5-073AF52DFD7A}, xrefs: 2DE18496, 2DE184D5, 2DE18504
mso14.dll, xrefs: 2DE18491, 2DE184D4, 2DE18503
msi.dll, xrefs: 2DE18435, 2DE1843A, 2DE18456
MsiProvideQualifiedComponentExW, xrefs: 2DE18475
MsiGetProductCodeW, xrefs: 2DE1846D

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressLibraryLoadProc$DirectorySystem
String ID: MsiGetProductCodeW$MsiProvideQualifiedComponentExW$msi.dll$mso14.dll${1E77DE88-BCAB-4C37-B9E5-073AF52DFD7A}
API String ID: 2381529825-3601640118
Opcode ID: a561deea7513b478ab3a10dadaa1a62ff6dfc47870307986edab1943f2b586c8
Instruction ID: a91da5b507411d3708a7b20a1b27f830a33c0404a843497ae4905b4efc26384c
Opcode Fuzzy Hash: a561deea7513b478ab3a10dadaa1a62ff6dfc47870307986edab1943f2b586c8
Instruction Fuzzy Hash: F94163B2904118ABDB109BA4CCC8ABE77BCEB48745F5044AAE246F7140EF358E84CF25

Function 2DE0BFE9 Relevance: 18.2, APIs: 12, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 2DE0C02A
ScreenToClient.USER32(?,?), ref: 2DE0C033
MoveWindow.USER32(?,?,?,?,00000001,00000000), ref: 2DE0C04C

Part of subcall function 2DE0BCEB: GetWindowRect.USER32(?,?), ref: 2DE0BD3B
Part of subcall function 2DE0BCEB: EnableWindow.USER32(?,00000001), ref: 2DE0BD49
Part of subcall function 2DE0BCEB: DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BD63
Part of subcall function 2DE0BCEB: EnableWindow.USER32(?,00000001), ref: 2DE0BD6D
Part of subcall function 2DE0BCEB: DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BD92
Part of subcall function 2DE0BCEB: DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BE1E
Part of subcall function 2DE0BCEB: DeferWindowPos.USER32(?,?,00000000,?,?,00000000,00000000,0000000D), ref: 2DE0BE3D

GetWindowRect.USER32(?,?), ref: 2DE0C0AB
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 2DE0C0DD
SendMessageA.USER32(?,00000441,00000000,00000000), ref: 2DE0C0ED
SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 2DE0C16A
BeginDeferWindowPos.USER32(0000000A), ref: 2DE0C16E
DeferWindowPos.USER32(00000000,?,00000000,?,?,?,?,0000000C), ref: 2DE0C18E
EndDeferWindowPos.USER32(?), ref: 2DE0C1B7
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 2DE0C1C6
RedrawWindow.USER32(?,00000000,00000000,00000585), ref: 2DE0C1D4

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Defer$MessageRectSend$EnableMove$BeginClientRedrawScreen
String ID:
API String ID: 245351979-0
Opcode ID: 392ea8f409f4386b18b170c153050fe4b01714af582ebd3f89f5033f5cffc7eb
Instruction ID: 295d596dd3f76bd9212eee26ef93498588e950c10c010ea7f913e2cbf4e7fe7c
Opcode Fuzzy Hash: 392ea8f409f4386b18b170c153050fe4b01714af582ebd3f89f5033f5cffc7eb
Instruction Fuzzy Hash: 37513E72600B05AFDB21DFA4CD85F9ABBF5FB08705F104919E696EA690C775E910CB04

Function 6C9005DE Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C900297: CreateFileW.KERNEL32(?,00000000,?,6C900687,?,?,00000000,?,6C900687,?,0000000C), ref: 6C9002B4

GetLastError.KERNEL32 ref: 6C9006F2
__dosmaperr.LIBCMT ref: 6C9006F9
GetFileType.KERNEL32(00000000), ref: 6C900705
GetLastError.KERNEL32 ref: 6C90070F
__dosmaperr.LIBCMT ref: 6C900718
CloseHandle.KERNEL32(00000000), ref: 6C900738
CloseHandle.KERNEL32(6C8F85C2), ref: 6C900885
GetLastError.KERNEL32 ref: 6C9008B7
__dosmaperr.LIBCMT ref: 6C9008BE

Strings

H, xrefs: 6C900843

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 6a6017600685a686db84439d27ffb70378f80faca1b11dd50f5d5bf23bc2e373
Instruction ID: 18e9ab0619ed906b306d51282b73ef8bb1a0db93082cb9fa3bd2522850f4810e
Opcode Fuzzy Hash: 6a6017600685a686db84439d27ffb70378f80faca1b11dd50f5d5bf23bc2e373
Instruction Fuzzy Hash: 2CA11332B181989FCF199F68C851BAD3BB5AB47328F28025DE815DB791CB358816CB51

Function 2DE0F729 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 171stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 2DE0F7D8
GetACP.KERNEL32(00000000,?,000000FF,?,000001FC), ref: 2DE0F7F2
MultiByteToWideChar.KERNEL32(00000000), ref: 2DE0F7F9
GetModuleHandleW.KERNEL32(mso.dll), ref: 2DE0F8C8
MessageBoxW.USER32(00000000,?,00000000), ref: 2DE0F923
CallNextHookEx.USER32(?,?,?), ref: 2DE0F93C

Strings

%ld - [%08lX:%08lX], xrefs: 2DE0F855
%ld - [%08lX], xrefs: 2DE0F87D
[%08lX], xrefs: 2DE0F8A2
mso.dll, xrefs: 2DE0F8C3

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ByteCallCharHandleHookMessageModuleMultiNextWidelstrlen
String ID: %ld - [%08lX:%08lX]$%ld - [%08lX]$[%08lX]$mso.dll
API String ID: 3435520019-1696869425
Opcode ID: 68f3c54ecd80c65536ec49c389a65933bee6bc23486708add81df32937fdc499
Instruction ID: 6632497b15fad154614427512545517cd3e14c49dc6dc6b80a62fbfdef9efb69
Opcode Fuzzy Hash: 68f3c54ecd80c65536ec49c389a65933bee6bc23486708add81df32937fdc499
Instruction Fuzzy Hash: 015112B2A00204AEE7059F74CC44FBA33B9EB84B06F108564F716F6292EE35CD55CB65

Function 2DE05300 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 155windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE05307

Part of subcall function 2DE050C9: GetModuleHandleW.KERNEL32(KERNEL32), ref: 2DE050CF
Part of subcall function 2DE050C9: GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 2DE050E9
Part of subcall function 2DE050C9: GetProcAddress.KERNEL32(00000000,GetSystemDEPPolicy), ref: 2DE050F3
Part of subcall function 2DE050C9: SetProcessDEPPolicy.KERNEL32(00000001), ref: 2DE05106

malloc.MSVCR90 ref: 2DE0533A
malloc.MSVCR90 ref: 2DE0534B
LoadStringW.USER32(000089E8,00000100), ref: 2DE05378
LoadStringW.USER32(000089E9,00000100), ref: 2DE05394
CoBuildVersion.OLE32 ref: 2DE0539E
CoRegisterClassObject.OLE32(2DE01870,00000000,00000004,00000001,?,00000000), ref: 2DE0542A

Part of subcall function 2DE107A6: malloc.MSVCR90 ref: 2DE107AD
Part of subcall function 2DE107A6: memset.MSVCR90 ref: 2DE107C5

CoRegisterClassObject.OLE32(2DE01880,00000000,00000004,00000001,?), ref: 2DE0548A
LoadIconA.USER32(000088B8), ref: 2DE054D3

Strings

P'-, xrefs: 2DE054E5

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Loadmalloc$AddressClassObjectProcRegisterString$BuildH_prolog3_catchHandleIconModulePolicyProcessVersionmemset
String ID: P'-
API String ID: 1755118194-2584166019
Opcode ID: 28f7e23118dc3acc643fd7b8ac87c173cb4aaf25c63295a351871c1544e6cff4
Instruction ID: e9248fa266bd0ab0321e40bbad4e779263de8f3c427335b518fade255b8144fc
Opcode Fuzzy Hash: 28f7e23118dc3acc643fd7b8ac87c173cb4aaf25c63295a351871c1544e6cff4
Instruction Fuzzy Hash: 1951A171604301EAEB019BB48884BBE77F9EB54702F114429E656F7281DF74CE45CB75

Function 2DE03FCE Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

MonitorFromWindow.USER32(?,00000002), ref: 2DE03FF3
GetMonitorInfoA.USER32(00000000,00000028), ref: 2DE04002
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 2DE04020
GetWindowRect.USER32(00000000,?), ref: 2DE0403A
GetWindowRect.USER32(?,?), ref: 2DE0404F
OffsetRect.USER32(?,?,?), ref: 2DE04071
OffsetRect.USER32(?,?,?), ref: 2DE04083
OffsetRect.USER32(?,?,?), ref: 2DE04095
SetWindowPos.USER32(?,00000000,?,00000000,00000000,00000000,00000015), ref: 2DE040F3

Strings

(, xrefs: 2DE03FE2

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Rect$Window$Offset$InfoMonitor$FromParametersSystem
String ID: (
API String ID: 4041948150-3887548279
Opcode ID: bcdddc2fbb7ce1fd213c2208a322fd5db06f06bde79b51b33d8f3d453df6a6b7
Instruction ID: 77c544383c1879327f06983830d1c02703d5717c1e0533ad171fb3cd03f375ce
Opcode Fuzzy Hash: bcdddc2fbb7ce1fd213c2208a322fd5db06f06bde79b51b33d8f3d453df6a6b7
Instruction Fuzzy Hash: D6411672900129AFDF01DEA8CD49EEEB7B9FF09312F018515F905FB140DA75AA05CAA1

Function 2DE07F1D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 2DE07F43

Strings

ToolbarWindow32, xrefs: 2DE07FA2

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Color
String ID: ToolbarWindow32
API String ID: 2811717613-4104838417
Opcode ID: 2ab60dcac5baf6bb9fae96b4d6f8d27d49f2f4fdf497751750df43edbe0d005e
Instruction ID: c797d141d1d3883edc3d9a7a90880dc866bc37ce7b681b71bf71d112a2fc20fe
Opcode Fuzzy Hash: 2ab60dcac5baf6bb9fae96b4d6f8d27d49f2f4fdf497751750df43edbe0d005e
Instruction Fuzzy Hash: 1F51D4B1D4438CAEEB119FA88C81BEEBFB9FF59744F40442DE185B7282C6750805CB25

Function 2DE16050 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 2DE16055
LoadCursorA.USER32(00000000,00007F02), ref: 2DE160C7
LoadCursorA.USER32(00000000,00007F00), ref: 2DE160D2
GetModuleHandleA.KERNEL32(USER32.DLL), ref: 2DE160E4
GetProcAddress.KERNEL32(00000000,SetScrollInfo), ref: 2DE160F8
GetProcAddress.KERNEL32(00000000,GetScrollInfo), ref: 2DE16103

Strings

USER32.DLL, xrefs: 2DE160DF
SetScrollInfo, xrefs: 2DE160F2
GetScrollInfo, xrefs: 2DE160FA

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressCursorLoadProc$HandleModuleVersion
String ID: GetScrollInfo$SetScrollInfo$USER32.DLL
API String ID: 3295075773-1004610577
Opcode ID: 1eba720bb6c36f43fd72991fa9cef78ea57288b4313243eb17b2792ac18ffcbb
Instruction ID: c47a7faa6d8b0227adf5dab4a68e6e4710002941c9648e46e0793025975227e8
Opcode Fuzzy Hash: 1eba720bb6c36f43fd72991fa9cef78ea57288b4313243eb17b2792ac18ffcbb
Instruction Fuzzy Hash: A611B4B1B147518FC7289F7A888052ABAE9FB89606341493EE58BF3B51DA34E805CF54

Function 2DE10444 Relevance: 15.2, APIs: 10, Instructions: 228stringCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 2DE10454
lstrlenW.KERNEL32(?,00000007,?), ref: 2DE105C3
lstrlenW.KERNEL32(?), ref: 2DE105D1
GetACP.KERNEL32(00000000,?,000000FF,?,?,00000000,00000000,-00000013,?), ref: 2DE1068B
WideCharToMultiByte.KERNEL32(00000000), ref: 2DE10694
GetACP.KERNEL32(00000000,?,000000FF,?,?,00000000,00000000), ref: 2DE106C0
WideCharToMultiByte.KERNEL32(00000000), ref: 2DE106C3

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$Read
String ID:
API String ID: 3283085596-0
Opcode ID: a68fe9bf361fa882e981f7bc5e13af20647d4b7a11db2f98ea1b66025d25eb58
Instruction ID: c8b53590c37ef724fd5d91c9f448a7f496b27f7cba7d678864240d19d94bf70f
Opcode Fuzzy Hash: a68fe9bf361fa882e981f7bc5e13af20647d4b7a11db2f98ea1b66025d25eb58
Instruction Fuzzy Hash: C2910976A00109EFCB05CF98C980EA9BBF5FF48314B258499E915BB251DB36EE41DF90

Function 2DE18822 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 67registrylibraryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion,00000000,00020019,?), ref: 2DE18862
RegQueryValueExW.ADVAPI32(?,CommonFilesDir,00000000,00000000,?,0000020A), ref: 2DE1888C
RegCloseKey.ADVAPI32(?), ref: 2DE188A2
LoadLibraryW.KERNEL32(?,\Microsoft Shared\office14\mso.dll,?,00000105), ref: 2DE188E1

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 2DE18846
\Microsoft Shared\office14\mso.dll, xrefs: 2DE188D0
mso.dll, xrefs: 2DE188ED
CommonFilesDir, xrefs: 2DE18881

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CloseLibraryLoadOpenQueryValue
String ID: CommonFilesDir$Software\Microsoft\Windows\CurrentVersion$\Microsoft Shared\office14\mso.dll$mso.dll
API String ID: 3751545530-1101215619
Opcode ID: c8d833a188daccb41fc1b09bb0f4e7fe9d4bef7075bbbddee5e7968869715a63
Instruction ID: 370d49b2195adcbbf26a1951422e1d59c8951ebf9aa13338ddd935fd53c0911b
Opcode Fuzzy Hash: c8d833a188daccb41fc1b09bb0f4e7fe9d4bef7075bbbddee5e7968869715a63
Instruction Fuzzy Hash: E1217F31A4522DABC721EA64CCCDEEEB7B8EB14742F4000A5E55AF6251DE709E84CB94

Function 2DE0381E Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 55libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 2DE03837
GetFileAttributesW.KERNEL32(???.???), ref: 2DE03842
GetModuleHandleA.KERNEL32(Unicows.dll), ref: 2DE0384D
GetProcAddress.KERNEL32(00000000,?), ref: 2DE03875
GetVersion.KERNEL32 ref: 2DE03888
GetProcAddress.KERNEL32(00000000,?), ref: 2DE038A8

Strings

Unicows.dll, xrefs: 2DE03848
???.???, xrefs: 2DE0383D

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressProcVersion$AttributesFileHandleModule
String ID: ???.???$Unicows.dll
API String ID: 3183861727-2162356649
Opcode ID: e8e219809b013d43b3d314c81efa147e24bc2402a84ff571fa5e9cc5c0b92630
Instruction ID: fa81cac4052d2628061e5d0508ff01a45a3444face8aa59a4143dbbbde494ed5
Opcode Fuzzy Hash: e8e219809b013d43b3d314c81efa147e24bc2402a84ff571fa5e9cc5c0b92630
Instruction Fuzzy Hash: DB119132600206EFD7019FE9C848B69B7F8EF04756B1040A5F845FB251DB78E910CB24

Function 6C8E1920 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,6C8DCF5A,6C8DCF5C,00000000,00000000,528C51E4,?,?,?,6C8DCF5A,00000000,?,6C8D3AA5,6C8DCF5A,0000000C), ref: 6C8E19A9
MultiByteToWideChar.KERNEL32(00000000,00000000,6C8DCF5A,?,00000000,00000000,?,6C8DCF5A,00000000,?,6C8D3AA5,6C8DCF5A), ref: 6C8E1A24
SysAllocString.OLEAUT32(00000000), ref: 6C8E1A2F
_com_issue_error.COMSUPP ref: 6C8E1A58
_com_issue_error.COMSUPP ref: 6C8E1A62
GetLastError.KERNEL32(80070057,528C51E4,?,?,?,6C8DCF5A,00000000,?,6C8D3AA5,6C8DCF5A,0000000C,?,6C8DCF5A), ref: 6C8E1A67
_com_issue_error.COMSUPP ref: 6C8E1A7A
GetLastError.KERNEL32(00000000,?,?,?,6C8DCF5A,00000000,?,6C8D3AA5,6C8DCF5A,0000000C,?,6C8DCF5A), ref: 6C8E1A90
_com_issue_error.COMSUPP ref: 6C8E1AA3

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: bc889f977c46543d857ae41a73b0726673fe47b70cb55173c2ea68ba6725fb13
Instruction ID: 756918b99bd01fdcd0480f26254200bdf5cdb07947fb73846d2168516d27266a
Opcode Fuzzy Hash: bc889f977c46543d857ae41a73b0726673fe47b70cb55173c2ea68ba6725fb13
Instruction Fuzzy Hash: 7E412872B042199BCB20DF68CA40BEEBBB8AB4E754F20463DE515E7B41D734D544CBA0

Function 6C8E5646 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6C8E5765
___TypeMatch.LIBVCRUNTIME ref: 6C8E5873
_UnwindNestedFrames.LIBCMT ref: 6C8E59C5
CallUnexpected.LIBVCRUNTIME ref: 6C8E59E0

Strings

csm, xrefs: 6C8E56F0
csm, xrefs: 6C8E5683
csm, xrefs: 6C8E579C

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 2bfab5c363702beb46ae8b9f1aa2629cd3561b294ad2a863858529e096e841d1
Instruction ID: 503aa5d7e4449b3d82d9ab5354676608193e9b0df341705cb21837b33d0edfa1
Opcode Fuzzy Hash: 2bfab5c363702beb46ae8b9f1aa2629cd3561b294ad2a863858529e096e841d1
Instruction Fuzzy Hash: 62B1AE31800319EFCF24DFA5DA809DEB7B5FF0E318B14496AE8146BA11C731EA65CB91

Function 2DE0C374 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 226windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE0C37B
DrawFocusRect.USER32(?,?), ref: 2DE0C3D9
PatBlt.GDI32(?,?,?,?,?,00FF0062), ref: 2DE0C421

Strings

..., xrefs: 2DE0C45F

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: DrawFocusH_prolog3_catchRect
String ID: ...
API String ID: 1217028765-440645147
Opcode ID: bcabece07dfa2d26e0098002f728779582adff982a86f0164d042d6ce9e659aa
Instruction ID: 923dcaa54c14ee2e312f531f88915f41705df3fbee8760594fb78c26d6aa5b86
Opcode Fuzzy Hash: bcabece07dfa2d26e0098002f728779582adff982a86f0164d042d6ce9e659aa
Instruction Fuzzy Hash: 48914670904249DFDB15CFA4C994AAEBBB5FF28305F21415CEA46B7291DF30AE09CB60

Function 2DE185D0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77registryCOMMON

Download Yara Rule

APIs

memset.MSVCR90 ref: 2DE18605
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion,00000000,00020019,000000FF), ref: 2DE18659
RegQueryValueExW.ADVAPI32(000000FF,CommonFilesDir,00000000,00000000,?,0000020A), ref: 2DE1867E

Part of subcall function 2DE18540: LoadLibraryW.KERNEL32(?), ref: 2DE185BC

RegCloseKey.ADVAPI32(000000FF), ref: 2DE186CA

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 2DE1864F
Microsoft Shared\office14\, xrefs: 2DE1861A
CommonFilesDir, xrefs: 2DE18673

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CloseLibraryLoadOpenQueryValuememset
String ID: CommonFilesDir$Microsoft Shared\office14\$Software\Microsoft\Windows\CurrentVersion
API String ID: 79794857-3032397660
Opcode ID: 36f6e2e8efc4a1afc073490d849ddbc5e79cd0c02741d218dd8b772c7fc5326f
Instruction ID: 3179c54ee98db966a47d3ae70f41689afa1a0afbf442958fca9fbd6fd9890271
Opcode Fuzzy Hash: 36f6e2e8efc4a1afc073490d849ddbc5e79cd0c02741d218dd8b772c7fc5326f
Instruction Fuzzy Hash: 9C217C71A0422CAFDB22DB64CC80EEAB7BCEB08754F4001A5A559F6191DA30DF85CFA4

Function 2DE0FB74 Relevance: 12.2, APIs: 8, Instructions: 194stringthreadCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,?,80000000), ref: 2DE0FBFE
lstrlenA.KERNEL32(00000000,?,80000000), ref: 2DE0FC06
LoadStringW.USER32(?,?,?,00000200), ref: 2DE0FC79
GetACP.KERNEL32(00000000,00000201,000000FF,?,00000201,00000201,?,?,80000000), ref: 2DE0FCEA
MultiByteToWideChar.KERNEL32(00000000), ref: 2DE0FCF1
GetCurrentThreadId.KERNEL32 ref: 2DE0FCF7
SetWindowsHookExW.USER32(000000FF,2DE0F729,00000000,00000000), ref: 2DE0FD06
UnhookWindowsHookEx.USER32(00000000), ref: 2DE0FD70

Part of subcall function 2DE0F61C: GetModuleHandleW.KERNEL32(mso.dll,?,2DE0FBDC,?,00000201,?,?,80000000), ref: 2DE0F624

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: HookWindowslstrlen$ByteCharCurrentHandleLoadModuleMultiStringThreadUnhookWide
String ID:
API String ID: 4184960637-0
Opcode ID: 065262e888bcc708b1f284206782184192a233539428be98c1ed4cef9a25e176
Instruction ID: 9e26e9592c1b3ef935f090cda8942afb7a38772dde86cd67278933ade216867e
Opcode Fuzzy Hash: 065262e888bcc708b1f284206782184192a233539428be98c1ed4cef9a25e176
Instruction Fuzzy Hash: 9A616F72A00205EFCB01DFA4C985A6EBBB4FF08756F10452AFA16F7290CB34D964CB95

Function 2DE172DD Relevance: 12.1, APIs: 8, Instructions: 108COMMON

Download Yara Rule

APIs

??_V@YAXPAX@Z.MSVCR90(?,?,?,?,?,2DE15264,?,000000FF,?,?,?,2DE0A56B,?,?), ref: 2DE172FC
??_U@YAPAXI@Z.MSVCR90(?,?,?,?,?,2DE15264,?,000000FF,?,?,?,2DE0A56B,?,?), ref: 2DE1731A
memset.MSVCR90 ref: 2DE17326
memset.MSVCR90 ref: 2DE1734F
??_U@YAPAXI@Z.MSVCR90(?,?,?,?,?,2DE15264,?,000000FF,?,?,?,2DE0A56B,?,?), ref: 2DE1739F
memcpy.MSVCR90(00000000,?,?,?,?,?,?,?,2DE15264,?,000000FF,?,?,?,2DE0A56B,?), ref: 2DE173B1
memset.MSVCR90 ref: 2DE173C7
??_V@YAXPAX@Z.MSVCR90(?,?,00000000,?,00000000,?,?,?,?,?,?,?,2DE15264,?,000000FF), ref: 2DE173CF

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: cab2f0a68c08a215e292c57bf758677830bf06002173c9b7a8a0609d3745db6e
Instruction ID: 01e67216fbd168e9696475533a605f4c877463738e65f529f3b1af394df0e4cf
Opcode Fuzzy Hash: cab2f0a68c08a215e292c57bf758677830bf06002173c9b7a8a0609d3745db6e
Instruction Fuzzy Hash: 0131C5B1704700DBD721AF69CCC2E1EB7D5EB44A54B21C92DEA6AFB640DA30EC44CB40

Function 2DE13210 Relevance: 12.1, APIs: 8, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE13217
CloseHandle.KERNEL32(?,00000004,2DE04F48,00000004,2DE04F78), ref: 2DE13234
Mailbox.LIBCMT ref: 2DE13266
Mailbox.LIBCMT ref: 2DE13277
Mailbox.LIBCMT ref: 2DE13288
Mailbox.LIBCMT ref: 2DE13299
Mailbox.LIBCMT ref: 2DE132AA
??3@YAXPAX@Z.MSVCR90(00000000,00000004,2DE04F48,00000004,2DE04F78), ref: 2DE132DE

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Mailbox$??3@CloseH_prolog3Handle
String ID:
API String ID: 1655960846-0
Opcode ID: f279f09d6a0b4f1a54489b2b22a88a0736dae57d32d307f9707cba6c43cbac02
Instruction ID: f50f39fb23b1299c94324f8a5f5e8def76818ed0c64aaa32ecb0b1b37edad16d
Opcode Fuzzy Hash: f279f09d6a0b4f1a54489b2b22a88a0736dae57d32d307f9707cba6c43cbac02
Instruction Fuzzy Hash: A92136747047029BCB24AFA18491A6DBBE2FF64304F52092DC3DA77681CE71ED88CB91

Function 2DE0F952 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

isdigit.MSVCR90 ref: 2DE0F9B4
isdigit.MSVCR90 ref: 2DE0FB18

Strings

z, xrefs: 2DE0FAD9

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: isdigit
String ID: z
API String ID: 2326231117-1657960367
Opcode ID: ac17b01145ba7ca2fbfc3fa967c8219a4834eb07b47c83a8880dca6859013e69
Instruction ID: ecc6e3a7f133e5940974b534aaebc0fa7f412d777ee8df15538e836b9cb1db30
Opcode Fuzzy Hash: ac17b01145ba7ca2fbfc3fa967c8219a4834eb07b47c83a8880dca6859013e69
Instruction Fuzzy Hash: B471A271D0061AEFCF01DFA4C840AAEB7B4FF8431AF608556E952BB280DB349A61CF51

Function 2DE0657A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 166windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 2DE06584

Part of subcall function 2DE1127F: __EH_prolog3_catch.LIBCMT ref: 2DE11286

Part of subcall function 2DE0646A: GetWindowRect.USER32(?,?), ref: 2DE0647F
Part of subcall function 2DE0646A: ScreenToClient.USER32(?,?), ref: 2DE0648C
Part of subcall function 2DE0646A: MoveWindow.USER32(?,?,?,?,00000001,00000000), ref: 2DE064A2
Part of subcall function 2DE0646A: SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 2DE064D5
Part of subcall function 2DE0646A: MoveWindow.USER32(?,00000000,?,?,?,00000001), ref: 2DE064EA
Part of subcall function 2DE0646A: SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 2DE064F8
Part of subcall function 2DE0646A: RedrawWindow.USER32(?,00000000,00000000,00000585), ref: 2DE06508

GetDlgItem.USER32(00000001,000088C2), ref: 2DE065CD

Part of subcall function 2DE04745: _wcsicmp.MSVCR90 ref: 2DE04757

EnableWindow.USER32(?,00000000), ref: 2DE06778
SetWindowTextW.USER32(?,?), ref: 2DE0679E
SetFocus.USER32(?), ref: 2DE067BA

Strings

IPM.Conflict.Message, xrefs: 2DE065E4

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$MessageMoveSend$ClientEnableFocusH_prolog3_catchH_prolog3_catch_ItemRectRedrawScreenText_wcsicmp
String ID: IPM.Conflict.Message
API String ID: 3324545711-3689180561
Opcode ID: 89563ce0b3311e031b671a500e1268eac639902acf466ff22f93cf609b6259ac
Instruction ID: b3752bfa17b56596601b3db8dcab7f0adfb8ff7e85b8668bb76bba10a4b40695
Opcode Fuzzy Hash: 89563ce0b3311e031b671a500e1268eac639902acf466ff22f93cf609b6259ac
Instruction Fuzzy Hash: F7518370E4825A9BDB11DB54CD81BAD73A4EF20302F4541A8AA49BF285DE34AF45CF91

Function 2DE071EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE071F3
memset.MSVCR90 ref: 2DE07206

Part of subcall function 2DE052D6: GetProcAddress.KERNEL32(00000000,00000142), ref: 2DE052F4

GetWindowRect.USER32(?,?), ref: 2DE072E8
PostMessageA.USER32(00000001,00000111,0000891C,00000000), ref: 2DE07357
SetCursor.USER32(?), ref: 2DE07360

Strings

D, xrefs: 2DE07296

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressCursorH_prolog3MessagePostProcRectWindowmemset
String ID: D
API String ID: 308528978-2746444292
Opcode ID: 96d0d382f976984e268bdff0539b49b3f1270286629b71aa9eb46c8836169717
Instruction ID: 634d7ecd115178018482c171c355e894373862168e1187e81785f10fcec3337e
Opcode Fuzzy Hash: 96d0d382f976984e268bdff0539b49b3f1270286629b71aa9eb46c8836169717
Instruction Fuzzy Hash: FD415070A04605DFDB11EFA0C889FAEBBB9FF44706F20451CE65ABB291DB35A905CB11

Function 6C8E4DE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6C8E4E17
___except_validate_context_record.LIBVCRUNTIME ref: 6C8E4E1F
_ValidateLocalCookies.LIBCMT ref: 6C8E4EA8
__IsNonwritableInCurrentImage.LIBCMT ref: 6C8E4ED3
_ValidateLocalCookies.LIBCMT ref: 6C8E4F28

Strings

csm, xrefs: 6C8E4EBD

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: bd981ace971ecf3a411b894a973b3c030490cefc78a1d0fd5bd573ba25962dd3
Instruction ID: f2eb5d60866becd2814c63a9c687c4881cec84c9212b291cea1272048b927853
Opcode Fuzzy Hash: bd981ace971ecf3a411b894a973b3c030490cefc78a1d0fd5bd573ba25962dd3
Instruction Fuzzy Hash: EF417534A002099FCF20CFADC944ADE7BB5AFCA328F14C969D9189BB51D731D915CB91

Function 2DE13EC3 Relevance: 10.6, APIs: 7, Instructions: 112windowCOMMON

Download Yara Rule

APIs

Part of subcall function 2DE15D40: GetFocus.USER32 ref: 2DE15D44
Part of subcall function 2DE15D40: GetParent.USER32(00000000), ref: 2DE15D6C
Part of subcall function 2DE15D40: GetWindowLongA.USER32(?,000000F0), ref: 2DE15D87
Part of subcall function 2DE15D40: GetParent.USER32(?), ref: 2DE15D95
Part of subcall function 2DE15D40: GetDesktopWindow.USER32 ref: 2DE15D99
Part of subcall function 2DE15D40: SendMessageA.USER32(00000000,0000014F,00000000,00000000), ref: 2DE15DAD

Part of subcall function 2DE15923: __EH_prolog3.LIBCMT ref: 2DE1592A
Part of subcall function 2DE15923: GetLastError.KERNEL32(00000004,2DE10854,00000004,2DE109B6,00000000,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE1592F

GetMenu.USER32(?), ref: 2DE13F12
GetMenu.USER32(?), ref: 2DE13F27
GetMenuItemCount.USER32(00000000), ref: 2DE13F30
GetSubMenu.USER32(00000000,00000000), ref: 2DE13F41
GetMenuItemCount.USER32(?), ref: 2DE13F65
GetMenuItemID.USER32(?,?), ref: 2DE13F7F
GetMenuItemID.USER32(?,00000000), ref: 2DE13FA2

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Menu$Item$CountParentWindow$DesktopErrorFocusH_prolog3LastLongMessageSend
String ID:
API String ID: 666752450-0
Opcode ID: 9be9fc55af222156d3f25f59f4677193daa099dbe6c32b64145a41323d57a954
Instruction ID: d26a778a9b28378a9b9412e49421c64afadef5f417993a0c201165685ec7c745
Opcode Fuzzy Hash: 9be9fc55af222156d3f25f59f4677193daa099dbe6c32b64145a41323d57a954
Instruction Fuzzy Hash: 17417971A04208ABCF019F68CC809EEBBB6FF48314F20856AE951F6251DB31DD41DF60

Function 2DE15A21 Relevance: 10.6, APIs: 7, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 2DE15923: __EH_prolog3.LIBCMT ref: 2DE1592A
Part of subcall function 2DE15923: GetLastError.KERNEL32(00000004,2DE10854,00000004,2DE109B6,00000000,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE1592F

_msize.MSVCR90 ref: 2DE15A7F
_msize.MSVCR90 ref: 2DE15A99
free.MSVCR90 ref: 2DE15AA1
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCR90 ref: 2DE15AB1
malloc.MSVCR90 ref: 2DE15ABF
malloc.MSVCR90 ref: 2DE15AD2
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCR90 ref: 2DE15ADB

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ?_set_new_handler@@_msizemalloc$ErrorH_prolog3Lastfree
String ID:
API String ID: 3808399026-0
Opcode ID: a9b4a528f875a6e218f063e785ad0623a17c94ad4a478d07bee21cb377004e87
Instruction ID: fcf538b6cc03881a03c65b434e03e0854ad692f342596e42acc1d1a290db2e0b
Opcode Fuzzy Hash: a9b4a528f875a6e218f063e785ad0623a17c94ad4a478d07bee21cb377004e87
Instruction Fuzzy Hash: 84215E71B48B059FEB10ABB5D880B6AB7F8FF00655B21852AD645F3680EF35ED04CB64

Function 2DE15F07 Relevance: 10.6, APIs: 7, Instructions: 75stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 2DE15F24
IsWindowUnicode.USER32(?), ref: 2DE15F2D
SetWindowTextW.USER32(?,?), ref: 2DE15F66

Part of subcall function 2DE15CD7: IsWindowUnicode.USER32(?), ref: 2DE15CE0
Part of subcall function 2DE15CD7: GetWindowTextW.USER32(?,00000100,?), ref: 2DE15CF3

lstrcmpW.KERNEL32(?,?,?,?,00000100,?,00000000), ref: 2DE15F5A
lstrcmpA.KERNEL32(?,00000000,?,?,00000100,?,00000001,?,00000000), ref: 2DE15FA1
SetWindowTextA.USER32(?,00000000), ref: 2DE15FAD
free.MSVCR90 ref: 2DE15FB4

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Text$Unicodelstrcmp$freelstrlen
String ID:
API String ID: 1265395221-0
Opcode ID: 786049158eaa192aea86022bd4c83b0f3c1c87c26f6fc3538a559443fe02bcca
Instruction ID: 87922f438859e4ced7c0ebfa7fd4c1cdc410c9255412a9d22884fd765a7b883f
Opcode Fuzzy Hash: 786049158eaa192aea86022bd4c83b0f3c1c87c26f6fc3538a559443fe02bcca
Instruction Fuzzy Hash: 121130B2705108ABDB119AA4CCC4EBFB3BCEB08B45B00456AF642F6241DF38DE44C665

Function 6C8F2B5E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,528C51E4,?,6C8F2C6B,?,?,00000000,00000000), ref: 6C8F2C1F

Strings

api-ms-, xrefs: 6C8F2BB5
ext-ms-, xrefs: 6C8F2BC9

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: cf3a35656ce2901ec22b742315da6f61fb974a65747785bd2cb9092fb531ba5e
Instruction ID: 688a73315bd12e11e1441e28152e3578675e73c6214d5e0e476294163fc66f2d
Opcode Fuzzy Hash: cf3a35656ce2901ec22b742315da6f61fb974a65747785bd2cb9092fb531ba5e
Instruction Fuzzy Hash: 54213B3170A661F7CB319F69DD58A4B37789B537B4F210A14ED25EB680D734EA02CA90

Function 2DE0646A Relevance: 10.6, APIs: 7, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 2DE0647F
ScreenToClient.USER32(?,?), ref: 2DE0648C
MoveWindow.USER32(?,?,?,?,00000001,00000000), ref: 2DE064A2
SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 2DE064D5
MoveWindow.USER32(?,00000000,?,?,?,00000001), ref: 2DE064EA
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 2DE064F8
RedrawWindow.USER32(?,00000000,00000000,00000585), ref: 2DE06508

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$MessageMoveSend$ClientRectRedrawScreen
String ID:
API String ID: 4152145988-0
Opcode ID: 04a9ca4bb46a16451840b574f6294cfb57172a5967cbfa26b447275fba0050d6
Instruction ID: b5ac50140a410b60ad33f8386210b9b37e20caadc3da37fb2d49580a715190a1
Opcode Fuzzy Hash: 04a9ca4bb46a16451840b574f6294cfb57172a5967cbfa26b447275fba0050d6
Instruction Fuzzy Hash: 18114232200654BFDB215FA5CC49F5B7FB9FB48B41F048418F646BA1A0CBB6E510DB54

Function 6C8E08DC Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 61libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(RPCRT4.dll), ref: 6C8E08F4
GetProcAddress.KERNEL32(000000FF,?), ref: 6C8E0974

Strings

RPCRT4.dll, xrefs: 6C8E08EF
all2, xrefs: 6C8E091D
lientC, xrefs: 6C8E0942
NdrC, xrefs: 6C8E090D

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NdrC$RPCRT4.dll$all2$lientC
API String ID: 1646373207-1156160658
Opcode ID: 7e4113a07029494f8ad52ec0521a36e49a0def259925514dd37d70b8cb5c877d
Instruction ID: c91804c25a85e8ea23aa3fc6dc10386cbe4a5fc1bd324d9039a7f068072e85d6
Opcode Fuzzy Hash: 7e4113a07029494f8ad52ec0521a36e49a0def259925514dd37d70b8cb5c877d
Instruction Fuzzy Hash: AE211F75E04258DFDB10DFA4C946BDD7BB8AB4E204F1089AAD51AF6640E7309B48DF21

Function 2DE141D3 Relevance: 10.6, APIs: 7, Instructions: 60COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(2DE00000,?,00000005,00000000,?,00000000,?,?,?,2DE14967,?,?,00000000,?,?), ref: 2DE141EC
LoadResource.KERNEL32(2DE00000,00000000,?,2DE14967,?,?,00000000,?,?,?,2DE07D54,?,?,?,00000000,?), ref: 2DE141FA
LockResource.KERNEL32(00000000,?,2DE14967,?,?,00000000,?,?,?,2DE07D54,?,?,?,00000000,?,?), ref: 2DE14208
SizeofResource.KERNEL32(2DE00000,00000000,?,2DE14967,?,?,00000000,?,?,?,2DE07D54,?,?,?,00000000,?), ref: 2DE14217
malloc.MSVCR90 ref: 2DE1422D
memcpy.MSVCR90(00000000,?,00000000,2DE14967,?,?,00000000,?,?,?,2DE07D54,?,?,?,00000000,?), ref: 2DE14240
FreeResource.KERNEL32(?,?,2DE14967,?,?,00000000,?,?,?,2DE07D54,?,?,?,00000000,?,?), ref: 2DE1424B

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Resource$FindFreeLoadLockSizeofmallocmemcpy
String ID:
API String ID: 2295636306-0
Opcode ID: 48227763c1cff33241410102a9e0115e82b0c1e9edc6b40d3a9e5449d4db98a2
Instruction ID: f8a201167685b9d33afba2d9e38b5c3827bf90187039fb53aa4c1ea71aba8f6d
Opcode Fuzzy Hash: 48227763c1cff33241410102a9e0115e82b0c1e9edc6b40d3a9e5449d4db98a2
Instruction Fuzzy Hash: 8211FE7660060AABDB015FE5C848BAA7BF8EF49696B104065F905F6300EE75DD40CB74

Function 2DE0B7D5 Relevance: 10.5, APIs: 7, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE0B7DC
~_Task_impl.LIBCPMT ref: 2DE0B7F9

Part of subcall function 2DE15440: __EH_prolog3.LIBCMT ref: 2DE15447

~_Task_impl.LIBCPMT ref: 2DE0B808

Part of subcall function 2DE154BD: __EH_prolog3.LIBCMT ref: 2DE154C4

~_Task_impl.LIBCPMT ref: 2DE0B817
~_Task_impl.LIBCPMT ref: 2DE0B826
~_Task_impl.LIBCPMT ref: 2DE0B835

Part of subcall function 2DE153F3: __EH_prolog3.LIBCMT ref: 2DE153FA

~_Task_impl.LIBCPMT ref: 2DE0B844

Part of subcall function 2DE04873: ??_V@YAXPAX@Z.MSVCR90(?,?,2DE04B1B), ref: 2DE04883

Part of subcall function 2DE08409: __EH_prolog3.LIBCMT ref: 2DE08410

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Task_impl$H_prolog3
String ID:
API String ID: 1204490572-0
Opcode ID: 42fdf4db1f5d96ef5b0637e4c9123a91e82bf00f202e36c817deb2d8951b791f
Instruction ID: f871b9a218d52c0f83e817faefbdcacda5ea4abe6513e976151fc633c50e5947
Opcode Fuzzy Hash: 42fdf4db1f5d96ef5b0637e4c9123a91e82bf00f202e36c817deb2d8951b791f
Instruction Fuzzy Hash: 58111930509684DAD715EBA4C1557DDBBE0AF35301F95488DCA9A33281DFB86B08D763

Function 2DE0D55E Relevance: 10.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

malloc.MSVCR90 ref: 2DE0D57E
malloc.MSVCR90 ref: 2DE0D592
malloc.MSVCR90 ref: 2DE0D5EC
memcpy.MSVCR90(?,?,?,?,2DE0DE55,?,?), ref: 2DE0D60A
free.MSVCR90 ref: 2DE0D612
malloc.MSVCR90 ref: 2DE0D627
memcpy.MSVCR90(00000000,000000FF,?,2DE0DE55,?,?), ref: 2DE0D649
free.MSVCR90 ref: 2DE0D651

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5661ad0a6e5cfc74636c64c71a1a3c6b9fffe8cc6fc472692e95c15f62cccbaa
Instruction ID: d6d4f02f5280555b0b18b1130327dd0fbfa5368a3c4b8e22ba8db3a39bbf7455
Opcode Fuzzy Hash: 5661ad0a6e5cfc74636c64c71a1a3c6b9fffe8cc6fc472692e95c15f62cccbaa
Instruction Fuzzy Hash: B7418DB1600705AFEB14CF69D88096AB7E9FF44259750C82EE95EFB740EA31EA00CB50

Function 6C8F5384 Relevance: 9.3, APIs: 6, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947473c5617171b67c174788b91eb13c36315589e3d28765aa240787322e1b3b
Instruction ID: cfb473e2bf0c79e87d71682837bb5626e3e1938dfe8f8503324b24d0da3eaa67
Opcode Fuzzy Hash: 947473c5617171b67c174788b91eb13c36315589e3d28765aa240787322e1b3b
Instruction Fuzzy Hash: 53B10770A043499FDB21DF9CC580BAEBBB1BF8A358F208958D5349BB81C7749947CB60

Function 6C8E1712 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 6C8E175B
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 6C8E17C6
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6C8E17E3
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 6C8E1822
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6C8E1881
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6C8E18A4

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: e4031d0e6505bb6944d581e75d5fda48b57a81501535d779767bf10b195240c8
Instruction ID: 47792181d4a082caf1558a40e5a6ec72a26d385c3dec9ba4e50fc43c725e3d79
Opcode Fuzzy Hash: e4031d0e6505bb6944d581e75d5fda48b57a81501535d779767bf10b195240c8
Instruction Fuzzy Hash: CA51917260122AAFEF204F95CD44FEF3BBAEF4A744F214929F924A6551E734D814CB90

Function 2DE11AAA Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE11AB1
GetPropA.USER32(?,00000000), ref: 2DE11AC1

Part of subcall function 2DE15923: __EH_prolog3.LIBCMT ref: 2DE1592A
Part of subcall function 2DE15923: GetLastError.KERNEL32(00000004,2DE10854,00000004,2DE109B6,00000000,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE1592F

CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 2DE11B58

Part of subcall function 2DE11492: GetWindowLongA.USER32(?,000000F0), ref: 2DE114A6
Part of subcall function 2DE11492: GetWindowRect.USER32(?,?), ref: 2DE114BA
Part of subcall function 2DE11492: IsWindowEnabled.USER32(?), ref: 2DE114DF

SetWindowLongA.USER32(?,000000FC,?), ref: 2DE11B77
RemovePropA.USER32(?,00000000), ref: 2DE11B86

Part of subcall function 2DE10D23: GetWindowRect.USER32(?,?), ref: 2DE10D2C
Part of subcall function 2DE10D23: GetWindowLongA.USER32(?,000000F0), ref: 2DE10D37

CallWindowProcA.USER32(?,?,?,?,00000000), ref: 2DE11BE3

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Long$CallProcPropRect$EnabledErrorH_prolog3H_prolog3_catchLastRemove
String ID:
API String ID: 1391589453-0
Opcode ID: ffad048c8b34a72d7a6c69f4442e6b2fde040e45d61777dcfabd33ee11cab945
Instruction ID: 96506f3b843138997fd9f60d06af548f1c76365dbfa81683476a650b1af7e867
Opcode Fuzzy Hash: ffad048c8b34a72d7a6c69f4442e6b2fde040e45d61777dcfabd33ee11cab945
Instruction Fuzzy Hash: 94416972A04209EBCF058FA4C944AEE7BB4FF08715F014519FA15BB290DB39DE44DBA1

Function 2DE084B0 Relevance: 9.1, APIs: 6, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 2DE084B7

Part of subcall function 2DE08374: SendMessageA.USER32(00000000,00000031,00000000,00000000), ref: 2DE0837D

GetObjectA.GDI32(?,0000003C,?), ref: 2DE084DA
GetDC.USER32(00000000), ref: 2DE084E2

Part of subcall function 2DE08338: CreateFontIndirectA.GDI32(?), ref: 2DE08341

Part of subcall function 2DE14F4C: SelectObject.GDI32(?,00000000), ref: 2DE14F70
Part of subcall function 2DE14F4C: SelectObject.GDI32(?,00000000), ref: 2DE14F86

GetTextMetricsA.GDI32(?,?), ref: 2DE08528
GetTextMetricsA.GDI32(?), ref: 2DE08555
ReleaseDC.USER32(00000000,?), ref: 2DE0856F

Part of subcall function 2DE14ED4: __EH_prolog3.LIBCMT ref: 2DE14EDB
Part of subcall function 2DE14ED4: DeleteDC.GDI32(00000000), ref: 2DE14EFB

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Object$MetricsSelectText$CreateDeleteFontH_prolog3H_prolog3_IndirectMessageReleaseSend
String ID:
API String ID: 275216013-0
Opcode ID: 6f85af226e3e9eb24055429f268d7bf1b4e6bf0b06176b899814b474779f6fb9
Instruction ID: b30ef81324e946df8c211b8d22f9bc6ecd6266c7dc84ea51ba510d75a7b9a020
Opcode Fuzzy Hash: 6f85af226e3e9eb24055429f268d7bf1b4e6bf0b06176b899814b474779f6fb9
Instruction Fuzzy Hash: F621EA71D042089BDB15EBE0C855BDDB7B9FF64701F528128E126BB2A4DF345E09CB50

Function 6C8E52D8 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6C8E51E9,6C8E22B5,6C8E1EC9,?,6C8E2101,?,00000001,?,?,00000001,?,6C911EC0,0000000C,6C8E21FA), ref: 6C8E52E6
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6C8E52F4
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6C8E530D
SetLastError.KERNEL32(00000000,6C8E2101,?,00000001,?,?,00000001,?,6C911EC0,0000000C,6C8E21FA,?,00000001,?), ref: 6C8E535F

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a7c8b112924b2aa0fa1298826fe7935de4cd47b30cb4e9d4817ca39196be6dcb
Instruction ID: 67f7c79b4e6674462c54849eba8138052d344b259a15c539b8f5fa060a9941da
Opcode Fuzzy Hash: a7c8b112924b2aa0fa1298826fe7935de4cd47b30cb4e9d4817ca39196be6dcb
Instruction Fuzzy Hash: 3B01B53274D71D9E973016BA6E4664A3764EB0F77C734077EE22087DD0EFA14805D990

Function 2DE042F4 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

memset.MSVCR90 ref: 2DE0430C

Part of subcall function 2DE041B0: SetLastError.KERNEL32(?), ref: 2DE042E5

GetLastError.KERNEL32 ref: 2DE04371
CloseHandle.KERNEL32(?), ref: 2DE0437C
SetLastError.KERNEL32(00000000), ref: 2DE04383

Strings

print, xrefs: 2DE04321
<, xrefs: 2DE04305

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ErrorLast$CloseHandlememset
String ID: <$print
API String ID: 637397322-3177634819
Opcode ID: 18d370b77e54d34ebe53159cfae541cdeb08ff4bf82062987019277edca8232a
Instruction ID: fcf8abda46fda7240f698b63cce29f223ea9272e953617a6dbfc18840b0ab5e2
Opcode Fuzzy Hash: 18d370b77e54d34ebe53159cfae541cdeb08ff4bf82062987019277edca8232a
Instruction Fuzzy Hash: F2110776900209EFCB01DFA8D985ACEBBF8FF48741F105115FA05F7240EA359A40CB94

Function 2DE15D40 Relevance: 9.1, APIs: 6, Instructions: 51windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 2DE15D44
GetParent.USER32(00000000), ref: 2DE15D6C

Part of subcall function 2DE15C0F: GetWindowLongA.USER32(?,000000F0), ref: 2DE15C2E
Part of subcall function 2DE15C0F: GetClassNameA.USER32(?,?,0000000A), ref: 2DE15C43
Part of subcall function 2DE15C0F: lstrcmpiA.KERNEL32(?,combobox), ref: 2DE15C52

GetWindowLongA.USER32(?,000000F0), ref: 2DE15D87
GetParent.USER32(?), ref: 2DE15D95
GetDesktopWindow.USER32 ref: 2DE15D99
SendMessageA.USER32(00000000,0000014F,00000000,00000000), ref: 2DE15DAD

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$LongParent$ClassDesktopFocusMessageNameSendlstrcmpi
String ID:
API String ID: 2818563221-0
Opcode ID: 1a3ad4a00d918fdb247f9d954a4a716af5aff6d572be12d0044c2225596d024f
Instruction ID: a9e3dff40b9d7885f04898d4581539cacfa45017e541848d1718740af7ea2004
Opcode Fuzzy Hash: 1a3ad4a00d918fdb247f9d954a4a716af5aff6d572be12d0044c2225596d024f
Instruction Fuzzy Hash: A901813330129227D7112A65DD8CBBF26FEAB81A55F510129FF06FA280DF69DC419264

Function 2DE186E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Office\14.0\Common\FilesPaths,00000000,00020019,?,?,00000000), ref: 2DE18736
RegQueryValueExW.ADVAPI32(?,mso.dll,00000000,00000000,?,00000208,?,00000000), ref: 2DE18757
RegCloseKey.ADVAPI32(?,?,00000000), ref: 2DE1876B

Strings

Software\Microsoft\Office\14.0\Common\FilesPaths, xrefs: 2DE1871A
mso.dll, xrefs: 2DE1874C

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Software\Microsoft\Office\14.0\Common\FilesPaths$mso.dll
API String ID: 3677997916-1420724145
Opcode ID: f60ce6fccb4e41d6652ac2e8efa62d5778fec80625394eea3dd066dfe61d73ae
Instruction ID: 6e084b46f3e811a975964d34db1a303380612177b0176f1329720a750f69ae28
Opcode Fuzzy Hash: f60ce6fccb4e41d6652ac2e8efa62d5778fec80625394eea3dd066dfe61d73ae
Instruction Fuzzy Hash: 2C215B71A4011DAADB10DF64CCC8BEAB7B8EB64345F0046A6A21AF2150DE708E90DBA0

Function 6C8E6382 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,?,?,?,6C8E6445,6C8E500A,?,?,00000000,?,6C8E64F7,00000002,FlsGetValue,6C906D98), ref: 6C8E6413

Strings

api-ms-, xrefs: 6C8E63D3

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 42b66682f1f154d58d526ced92cba26035bb1f8cb7ac4320695baef49c50b17c
Instruction ID: 66915d7ac3e53f5cf78192822b41aa98a8abba9ac046521018d9c8873f90907e
Opcode Fuzzy Hash: 42b66682f1f154d58d526ced92cba26035bb1f8cb7ac4320695baef49c50b17c
Instruction Fuzzy Hash: 5C11A731B49629A7DF325A698D4078F33B49F1B778F250A24EA14EB681D760E9008AD1

Function 6C8E6E26 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,528C51E4,?,?,00000000,6C903507,000000FF,?,6C8E6DB6,?,?,6C8E6D8A,00000000), ref: 6C8E6E5B
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6C8E6E6D
FreeLibrary.KERNEL32(00000000,?,00000000,6C903507,000000FF,?,6C8E6DB6,?,?,6C8E6D8A,00000000), ref: 6C8E6E8F

Strings

mscoree.dll, xrefs: 6C8E6E54
CorExitProcess, xrefs: 6C8E6E65

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 309bd2f8ecd0f033c3f5e627d8912b0d7481c4dcd0ae5b5dee575592929616d7
Instruction ID: aff7f97e327a09b86bc895ffac06d3a311c58ee15ed13281eb15e099f43961fd
Opcode Fuzzy Hash: 309bd2f8ecd0f033c3f5e627d8912b0d7481c4dcd0ae5b5dee575592929616d7
Instruction Fuzzy Hash: 62018F31B08619EFDB118F50CD05BAE7BB8FB59655F200A2DE921E6A80DB34E900CE40

Function 2DE05BEE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_stricmp.MSVCR90(?,IPM.Conflict.Message), ref: 2DE05C06
_stricmp.MSVCR90(?,IPM.Conflict.Folder), ref: 2DE05C16
_stricmp.MSVCR90(?,?), ref: 2DE05C2A

Strings

IPM.Conflict.Folder, xrefs: 2DE05C0E
IPM.Conflict.Message, xrefs: 2DE05BFE

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: _stricmp
String ID: IPM.Conflict.Folder$IPM.Conflict.Message
API String ID: 2884411883-576266925
Opcode ID: 564cbe624c09ca8c227525b9305e26052e260498469267e899f1e8d5fbd803a5
Instruction ID: c97715b8df6266089f91de3113929b6bae2433a7a4c94a12d4d54910a65067c8
Opcode Fuzzy Hash: 564cbe624c09ca8c227525b9305e26052e260498469267e899f1e8d5fbd803a5
Instruction Fuzzy Hash: E4F0123361421E6EDB059E54EC41AA537D4DB052B3F108036FA04FA0A1DF31E520DB94

Function 2DE0D31D Relevance: 7.6, APIs: 6, Instructions: 146stringCOMMON

Download Yara Rule

APIs

malloc.MSVCR90 ref: 2DE0D3D2
free.MSVCR90 ref: 2DE0D3F3
lstrlenA.KERNEL32(?,?,?), ref: 2DE0D43E
malloc.MSVCR90 ref: 2DE0D44B
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000001), ref: 2DE0D466
free.MSVCR90 ref: 2DE0D46F

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: freemalloc$ByteCharMultiWidelstrlen
String ID:
API String ID: 4100972401-0
Opcode ID: 102c381f2fc540e0f038b68253f69bba324e2bed05107579eaea646f6cd13b81
Instruction ID: 26a3426ecc2a8f34f61077ba64bc92ea1fb9ce682320a2d090f25e135ba90bad
Opcode Fuzzy Hash: 102c381f2fc540e0f038b68253f69bba324e2bed05107579eaea646f6cd13b81
Instruction Fuzzy Hash: 0941BF71500205EFCB16CF64CC84AAE7BB9FF84752F20465AF552F6281EB76E950CB60

Function 2DE08126 Relevance: 7.6, APIs: 5, Instructions: 120windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE0812D

Part of subcall function 2DE06995: LoadCursorA.USER32(00000000,?), ref: 2DE069A0
Part of subcall function 2DE06995: SetCursor.USER32(00000000), ref: 2DE069A7

MessageBoxW.USER32(00000005,?,?,00000134), ref: 2DE0820B
GetWindowRect.USER32(00000003,?), ref: 2DE08260
PostMessageA.USER32(00000003,00000111,0000891C,00000000), ref: 2DE082BA
SetCursor.USER32(?), ref: 2DE082F2

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Cursor$Message$H_prolog3_catchLoadPostRectWindow
String ID:
API String ID: 4269587068-0
Opcode ID: eede814cac093db274cd42a96288956f70f4508ceef63e869826cbc2612dfb86
Instruction ID: edbaf0299842b7f1dcc832f9f4eff0489452ccf26f7a0b469851212eb6380468
Opcode Fuzzy Hash: eede814cac093db274cd42a96288956f70f4508ceef63e869826cbc2612dfb86
Instruction Fuzzy Hash: 69518D70904649EFDB01EBE0C989BAEBBB5FF14305F50445CE25AB7291DF74AA05CB21

Function 2DE06E33 Relevance: 7.6, APIs: 5, Instructions: 85windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE06E3A

Part of subcall function 2DE06995: LoadCursorA.USER32(00000000,?), ref: 2DE069A0
Part of subcall function 2DE06995: SetCursor.USER32(00000000), ref: 2DE069A7

SetCursor.USER32(?), ref: 2DE06E9B
SetCursor.USER32(?), ref: 2DE06EC4
GetWindowRect.USER32(?,?), ref: 2DE06ED5
PostMessageA.USER32(?,00000111,0000891C,00000000), ref: 2DE06F25

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Cursor$H_prolog3LoadMessagePostRectWindow
String ID:
API String ID: 4037273543-0
Opcode ID: 156ed51494b0159286956f793ebb0e94bf0f997a6d6818c495b087d76b2e3195
Instruction ID: 86eb4a21c072395de83c148fb0e06717df5be47f85e98d512a6da6a8f2c24c40
Opcode Fuzzy Hash: 156ed51494b0159286956f793ebb0e94bf0f997a6d6818c495b087d76b2e3195
Instruction Fuzzy Hash: 82317C70604645EFCB019FA0C988AAEBBF5FF58706F01445CE256BB2A1DF75AA05CB11

Function 2DE08A57 Relevance: 7.6, APIs: 5, Instructions: 85fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE08A5E
??_U@YAPAXI@Z.MSVCR90(00001000), ref: 2DE08ACD

Part of subcall function 2DE13812: Mailbox.LIBCMT ref: 2DE159AE

WriteFile.KERNEL32(000000FF,?,?,2DE0224C,00000000), ref: 2DE08B01
CloseHandle.KERNEL32(000000FF), ref: 2DE08B2F
??_V@YAXPAX@Z.MSVCR90(?), ref: 2DE08B3C

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CloseFileH_prolog3_catchHandleMailboxWrite
String ID:
API String ID: 1130278343-0
Opcode ID: 065bb4f6139d51091db4575a76bd8ca3d7e67ee927b7c07f13cce97f0ccf0df5
Instruction ID: 8334981f4ead742b9e58342f37ae7b1a3e668adbd2ec2c5f321c2e3d955baca1
Opcode Fuzzy Hash: 065bb4f6139d51091db4575a76bd8ca3d7e67ee927b7c07f13cce97f0ccf0df5
Instruction Fuzzy Hash: 163169B5900109EFDF05AFA4CC85EAEBBB8FF18765F108119F625B6290CB358E00CB60

Function 2DE0D4A0 Relevance: 7.6, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

free.MSVCR90 ref: 2DE0D4CA
free.MSVCR90 ref: 2DE0D4D9
free.MSVCR90 ref: 2DE0D51D
free.MSVCR90 ref: 2DE0D537
free.MSVCR90 ref: 2DE0D546
free.MSVCR90 ref: 2DE0D54C

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3a960de938612066f142219ca59dfcf8434106141cde5a3ec68a2566a8e3164c
Instruction ID: b1fedd88a8861667a14835a3b2191d6bc744d4d315d07332eda2730f4a389a20
Opcode Fuzzy Hash: 3a960de938612066f142219ca59dfcf8434106141cde5a3ec68a2566a8e3164c
Instruction Fuzzy Hash: 23218372A00109EFDF058F54D880A6DBBB5FF4036AF208066ED04BA651DF72E990DB90

Function 2DE04391 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 2DE0444B

Part of subcall function 2DE042F4: memset.MSVCR90 ref: 2DE0430C

GetLastError.KERNEL32 ref: 2DE0441B

Strings

m2ub, xrefs: 2DE043EC
l2ub, xrefs: 2DE043D3
k2ub, xrefs: 2DE043BA

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ErrorLast$memset
String ID: k2ub$l2ub$m2ub
API String ID: 4054172246-710509214
Opcode ID: 168d225024a1194765b8a9f4d278713f5513f8ca819256893d0824a40027fd85
Instruction ID: 32d4356d281ed8dcb7d7dc82b16cd82833e8e83e67c045396158fe5e85a35737
Opcode Fuzzy Hash: 168d225024a1194765b8a9f4d278713f5513f8ca819256893d0824a40027fd85
Instruction Fuzzy Hash: 2A212F7290051CFBCB02AFA5CE44EDEBBB9EFA4652F128061F611B7120DB758E52DB50

Function 2DE12319 Relevance: 7.6, APIs: 5, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 2DE15923: __EH_prolog3.LIBCMT ref: 2DE1592A
Part of subcall function 2DE15923: GetLastError.KERNEL32(00000004,2DE10854,00000004,2DE109B6,00000000,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE1592F

CallNextHookEx.USER32(?,?,?,?), ref: 2DE12336
CallNextHookEx.USER32(?,00000003,?,?), ref: 2DE1237D
UnhookWindowsHookEx.USER32(?), ref: 2DE12388
GetCurrentThreadId.KERNEL32 ref: 2DE1239D
SetWindowsHookExA.USER32(00000004,Function_00011CD5,00000000,00000000), ref: 2DE123AD

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Hook$CallNextWindows$CurrentErrorH_prolog3LastThreadUnhook
String ID:
API String ID: 2915796353-0
Opcode ID: 35c89ffeb11118563167a88b60114744a4bbe5544c6afa1e357258ae295a485a
Instruction ID: c28a60bc6b8884df7cd784d2ba1559001dc12b6a8d6cd3893b405f497c109756
Opcode Fuzzy Hash: 35c89ffeb11118563167a88b60114744a4bbe5544c6afa1e357258ae295a485a
Instruction Fuzzy Hash: 6D116A72200306EFDB128F60CD89B5A7BB4FF08756F009428FA47AA661CB75E950CF14

Function 2DE12A2D Relevance: 7.5, APIs: 5, Instructions: 48windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,?,?), ref: 2DE12A5A
GetFocus.USER32 ref: 2DE12A6C
GetParent.USER32(?), ref: 2DE12A7A
SetFocus.USER32(?,00000000), ref: 2DE12A95
EnableWindow.USER32(?,?), ref: 2DE12AAB

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: EnableFocus$ItemMenuParentWindow
String ID:
API String ID: 783553715-0
Opcode ID: 9f8541068dd6dc94525ba4672cc3b61b7697c0c0e761181a845f1e7ddec6c45b
Instruction ID: 88973a2d0e5b55169448c28d145a71a65d5d1818f7eed4389f02d1b716188759
Opcode Fuzzy Hash: 9f8541068dd6dc94525ba4672cc3b61b7697c0c0e761181a845f1e7ddec6c45b
Instruction Fuzzy Hash: 1D018E31200A00AFCB255F60CD0AB59BBF8FF00751F018629F606B66A0CB75E894CB94

Function 2DE0510C Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

CoRevokeClassObject.OLE32 ref: 2DE05124
CoRevokeClassObject.OLE32(00000000), ref: 2DE05136
FreeLibrary.KERNEL32(00000000), ref: 2DE0515B
free.MSVCR90 ref: 2DE05170
free.MSVCR90 ref: 2DE05178

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ClassObjectRevokefree$FreeLibrary
String ID:
API String ID: 850073815-0
Opcode ID: 7e6b68fcfdf87aecec1eb33ad95c1fedb728d29ff7b08cbed3d06c4ece7a0601
Instruction ID: e10b1629123d77f3fbe548045d75b7d453761553dcd82b06fb345d40e292ef08
Opcode Fuzzy Hash: 7e6b68fcfdf87aecec1eb33ad95c1fedb728d29ff7b08cbed3d06c4ece7a0601
Instruction Fuzzy Hash: 440156772107029BE7019B24C840BA2B3F9FF44716F610419E516F7290EFB9E820CFA4

Function 2DE15C6C Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

IsWindowUnicode.USER32(?), ref: 2DE15C79
malloc.MSVCR90 ref: 2DE15C8B
GetWindowTextW.USER32(?,00000000,?), ref: 2DE15C9D
GetWindowTextA.USER32(?,00000001,?), ref: 2DE15CBA
free.MSVCR90 ref: 2DE15CC7

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Text$Unicodefreemalloc
String ID:
API String ID: 1936483696-0
Opcode ID: f43f1784aa5fde6112ff4cb00560f6a6fe0d05d3d38744361f640d88e9ac19f3
Instruction ID: 6e5b87129a65b528b8e9c7a55a91cad700c91ad396529bc23994327376e3a3a8
Opcode Fuzzy Hash: f43f1784aa5fde6112ff4cb00560f6a6fe0d05d3d38744361f640d88e9ac19f3
Instruction Fuzzy Hash: AEF04F36605219BB8B120EA18C48E9B7F79FF45B657008115F905AA210DA36D911DAA4

Function 2DE15CD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

IsWindowUnicode.USER32(?), ref: 2DE15CE0
GetWindowTextW.USER32(?,00000100,?), ref: 2DE15CF3
malloc.MSVCR90 ref: 2DE15D06
GetWindowTextA.USER32(?,00000000,?), ref: 2DE15D19
free.MSVCR90 ref: 2DE15D30

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Text$Unicodefreemalloc
String ID:
API String ID: 1936483696-0
Opcode ID: 23b2954ff4199587148b1173ab37ec70c897069216bfba93d2a17cc605535660
Instruction ID: d7483974c5e49b9004eec7edfc8ef93c524ba96cb70139aa195c049263fa7e0a
Opcode Fuzzy Hash: 23b2954ff4199587148b1173ab37ec70c897069216bfba93d2a17cc605535660
Instruction Fuzzy Hash: 08F01236604249BFCF011FA5DC48E9B3FB9EB497A57008429F916E6210DB36C911DB64

Function 2DE04896 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

??_V@YAXPAX@Z.MSVCR90(?), ref: 2DE049C3

Part of subcall function 2DE0F52B: malloc.MSVCR90 ref: 2DE0F531

memmove.MSVCR90(?,?,?), ref: 2DE04991
memmove.MSVCR90(?,8007000E,?), ref: 2DE049A6

Strings

jsr9, xrefs: 2DE048D5

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: memmove$malloc
String ID: jsr9
API String ID: 3263852767-1633979662
Opcode ID: a3486c3d2975eaa75eb20887dc8753533e0c63cf0bf5078e67d4f5d0abe642be
Instruction ID: 6e192201dfb37d2482f8a0568231fc8ff6e71942eca15cd59e15a66f7f9b6c00
Opcode Fuzzy Hash: a3486c3d2975eaa75eb20887dc8753533e0c63cf0bf5078e67d4f5d0abe642be
Instruction Fuzzy Hash: 58419F71A00605EBCB11CF59CA8095EBBF9FF90355B61C92EE59AFB610DB70EA41CB40

Function 2DE14385 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE1438C
GetWindowLongA.USER32(?,000000F0), ref: 2DE143BB
GetParent.USER32(?), ref: 2DE143CB

Strings

0, xrefs: 2DE14391

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: H_prolog3_catchLongParentWindow
String ID: 0
API String ID: 944585138-4108050209
Opcode ID: 6b51049e77c5a2b1e6da7dd6e4f6b296ee358181ea833fd8f6afe21c6304d70a
Instruction ID: e9e01260f8d2c0dd0c0dad1adbd453b757f0624aea5a49ffb55767f54dd5c776
Opcode Fuzzy Hash: 6b51049e77c5a2b1e6da7dd6e4f6b296ee358181ea833fd8f6afe21c6304d70a
Instruction Fuzzy Hash: A3214271A0420ADBCF02EFA0C580B9E7BB0BF14314F218159EA16BB290DB75EE45CB91

Function 2DE04B08 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 2DE04873: ??_V@YAXPAX@Z.MSVCR90(?,?,2DE04B1B), ref: 2DE04883

GetACP.KERNEL32 ref: 2DE04B25
WideCharToMultiByte.KERNEL32(?,?,?,000000FF,00000000,00000000,00000000,00000000), ref: 2DE04B44
WideCharToMultiByte.KERNEL32(?,?,?,000000FF,?,00000001,00000000,00000000), ref: 2DE04B8A

Strings

dk29, xrefs: 2DE04B5F

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: dk29
API String ID: 626452242-1677150192
Opcode ID: 11c2cbd667b4cf0c70a0a35ab4e3ba7df2591af1eaef450e96d98d3f3a7229af
Instruction ID: 3b3a2af78c5c2a758df7fdcd4d5bab2e279977188fe99c955053a26d8ca23841
Opcode Fuzzy Hash: 11c2cbd667b4cf0c70a0a35ab4e3ba7df2591af1eaef450e96d98d3f3a7229af
Instruction Fuzzy Hash: B3113A72904118BBCF119F96CD44DDF7FBDEF85765B10825AF924B6160DA318A00DF60

Function 2DE0FFF9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2DE10000
GetModuleHandleW.KERNEL32(mso.dll,0000001C,2DE100FB,00000000,?,?,00000000,00000000,?,?,2DE0FD52,?,00000000,?,?,?), ref: 2DE10075

Part of subcall function 2DE04CF2: LoadStringW.USER32(?,?,?,00000100), ref: 2DE04D3C

Strings

mso.dll, xrefs: 2DE10070

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: H_prolog3_catchHandleLoadModuleString
String ID: mso.dll
API String ID: 2579502969-1671880577
Opcode ID: 5436407f10b8e63190d7fc7ff4490c1d8da8ace9c57a40dc70de2d196e56ba3f
Instruction ID: 889d5d27780fe0916f7260d7ff1ceb7c582232b4988a3270ad43a65f9f92a5c6
Opcode Fuzzy Hash: 5436407f10b8e63190d7fc7ff4490c1d8da8ace9c57a40dc70de2d196e56ba3f
Instruction Fuzzy Hash: 2111AC32A04149EACB01DFA0C905BDE3BB0EF24761F268114F961B7290CF38DE10DBA1

Function 2DE08ED9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 2DE08EEB
SystemTimeToFileTime.KERNEL32(?,?), ref: 2DE08EF9

Strings

@, xrefs: 2DE08EE4
@, xrefs: 2DE08F19

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Time$System$File
String ID: @$@
API String ID: 2838179519-149943524
Opcode ID: 6cf0c7d42f7a0f5d63c12c7d778d2b5ed957bf44b43d72727b4d61d67ed7a8d8
Instruction ID: 69efd7ca8a87e14b0ed6d0119b97ff52ca28bed46dc92cc84d8642b9caf7b633
Opcode Fuzzy Hash: 6cf0c7d42f7a0f5d63c12c7d778d2b5ed957bf44b43d72727b4d61d67ed7a8d8
Instruction Fuzzy Hash: 7911E271A11229ABDB00DFA4C889FDEBBB8FF08651F004459FA55F7240DB74E900CBA4

Function 2DE05264 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00000000,00007F00), ref: 2DE0529A
LoadCursorA.USER32(00000000,00007F00), ref: 2DE052A5
GetStockObject.GDI32(00000000), ref: 2DE052AF

Strings

Cnfnot_ClassFactory, xrefs: 2DE052BF

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Load$CursorIconObjectStock
String ID: Cnfnot_ClassFactory
API String ID: 3711576554-2905417136
Opcode ID: 12298d52779bf7885af703f20a8aa1c4a096525a430f2ac7f231a9465213ffe2
Instruction ID: 4b6ea87d5abe8fa19cea1f4ba34deefdda2b006f51061f19b668fb8050268535
Opcode Fuzzy Hash: 12298d52779bf7885af703f20a8aa1c4a096525a430f2ac7f231a9465213ffe2
Instruction Fuzzy Hash: FF011A72C05218AFCB059FEA88846EEFAFCEF59612B10416BD501F7214D6788500CFA4

Function 2DE15C0F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36stringCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 2DE15C2E
GetClassNameA.USER32(?,?,0000000A), ref: 2DE15C43
lstrcmpiA.KERNEL32(?,combobox), ref: 2DE15C52

Strings

combobox, xrefs: 2DE15C49

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ClassLongNameWindowlstrcmpi
String ID: combobox
API String ID: 2054663530-2240613097
Opcode ID: 24e7308367cef179a738491327c7cdfbe4fbd040d14787d67a9d9650722ba2b1
Instruction ID: 5eab60a80366cd03ed63695aa5b60ebd6a6c005035ddc7147f26fb50dec9e2f0
Opcode Fuzzy Hash: 24e7308367cef179a738491327c7cdfbe4fbd040d14787d67a9d9650722ba2b1
Instruction Fuzzy Hash: 48F09032A15129ABCB01EFA4CC45FBE73F8EB09A52B404915F413FB180DB38EA05C799

Function 6C8F389F Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(528C51E4,00000000,00000000,?), ref: 6C8F3902

Part of subcall function 6C8F9E65: WideCharToMultiByte.KERNEL32(00000000,00000000,6C8E66A1,?,6C8E6732,00000016,6C8EEE89,0000FDE9,?,?,00000008,?,00000003,6C912580,00000024,6C8EEE89), ref: 6C8F9F11

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6C8F3B5D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6C8F3BA5
GetLastError.KERNEL32 ref: 6C8F3C48

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 6af723fb12bf04ad4f7bb67a8875f4b4564badd2dc5a33cde84b03704c64abe1
Instruction ID: ef43057a3b87706c37102e9e60860871ad562f3aacb5c6e56d3862140c8a6542
Opcode Fuzzy Hash: 6af723fb12bf04ad4f7bb67a8875f4b4564badd2dc5a33cde84b03704c64abe1
Instruction Fuzzy Hash: DCD18AB5E04258AFCF21CFA8C9809EDBBB4FF49354F24492AE865E7741D730A942CB51

Function 2DE05DB3 Relevance: 6.3, APIs: 4, Instructions: 295COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 2DE05DBD
??_V@YAXPAX@Z.MSVCR90 ref: 2DE06097

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: H_prolog3_catch_
String ID:
API String ID: 1329019490-0
Opcode ID: 7360c6e30741ed6b5eb31e508070f5b12bd1e179eac239ab21476f343b717299
Instruction ID: 7f42ca27ae2b62e7484bff029b029217e6590823b0b58a4b13a545285ab1e62b
Opcode Fuzzy Hash: 7360c6e30741ed6b5eb31e508070f5b12bd1e179eac239ab21476f343b717299
Instruction Fuzzy Hash: BAC18B709082A89BDB65DBA4CD88BADB7B1EF24305F2141D8E259771A1DF349F84CF21

Function 6C8E53EF Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6C8E54B6
___AdjustPointer.LIBCMT ref: 6C8E54D9
___AdjustPointer.LIBCMT ref: 6C8E5575

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9257d1621bb0751cd862e4fd31310406f2f9a989b7c9923925f4bfc74e253ae0
Instruction ID: b7ed8f2dff8231e7340c0c7a5bb5db15518345f6df8ab9ac9cc4e2fd957ab8c3
Opcode Fuzzy Hash: 9257d1621bb0751cd862e4fd31310406f2f9a989b7c9923925f4bfc74e253ae0
Instruction Fuzzy Hash: E751D1B2606706AFDB358F98CA40BAA77B5EF4F319F200D2DD91647A90D731E841CB50

Function 6C8F6ABA Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7303fbe36ea327d128f4b038bfbf65970523db64ddd13426118725476800c869
Instruction ID: 1d9b75dfb460a5b1850d5d3118d5f5de169ca54a9e0f37300efd4fcc73a437a6
Opcode Fuzzy Hash: 7303fbe36ea327d128f4b038bfbf65970523db64ddd13426118725476800c869
Instruction Fuzzy Hash: 9641F471A00608BFD7249F78CA45B9EBBA9FB89754F104A39E121DBB80D771E5068790

Function 6C8FA0B1 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6C8F9E65: WideCharToMultiByte.KERNEL32(00000000,00000000,6C8E66A1,?,6C8E6732,00000016,6C8EEE89,0000FDE9,?,?,00000008,?,00000003,6C912580,00000024,6C8EEE89), ref: 6C8F9F11

GetLastError.KERNEL32 ref: 6C8FA115
__dosmaperr.LIBCMT ref: 6C8FA11C
GetLastError.KERNEL32(?,?,?,?), ref: 6C8FA156
__dosmaperr.LIBCMT ref: 6C8FA15D

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 8336a423ae6d250c2e2008bb35c6ae4307023f1527a4567751b9252e783df40d
Instruction ID: 099595fa6fc7ef70c72ebba3d15c414ccfc57b7c4b43183826d0354d89dbf63d
Opcode Fuzzy Hash: 8336a423ae6d250c2e2008bb35c6ae4307023f1527a4567751b9252e783df40d
Instruction Fuzzy Hash: 7321CB31604209AFD7309F6ACA808DB77B9FF453B87054D29E935D7A40D731EC428790

Function 2DE12240 Relevance: 6.1, APIs: 4, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(2DE00000,00000000,2DE00000,?,000000F0), ref: 2DE1227A
LockResource.KERNEL32(00000000), ref: 2DE12288
SendDlgItemMessageA.USER32(00000001,?,?,00000000,00000000), ref: 2DE122D8
FreeResource.KERNEL32(?), ref: 2DE122F0

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Resource$FreeItemLoadLockMessageSend
String ID:
API String ID: 3233515012-0
Opcode ID: 54da911226e47677987d5c6859ecad6d1b87d98b962e3868688c034d0c492007
Instruction ID: f0192012aa7517954cac57fad6016d4dd89499323d05f548ad05468c3b23549f
Opcode Fuzzy Hash: 54da911226e47677987d5c6859ecad6d1b87d98b962e3868688c034d0c492007
Instruction Fuzzy Hash: 46217172600114BFDB119F98CC85ABE77ECEB05355B90C026FA86F7240DA75DE41EBA4

Function 6C8EEED9 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4b36e52201d0b8c762c638dd5f5c9d25d0eb0067c5259e48fa6c9cc3d15aac
Instruction ID: c00cf421491467611821c28f5d632ec0774aab896f9fa64188704cb55fd0d2bd
Opcode Fuzzy Hash: 3e4b36e52201d0b8c762c638dd5f5c9d25d0eb0067c5259e48fa6c9cc3d15aac
Instruction Fuzzy Hash: 40218431608209BFDB309FA9DE8089A7B69FF4B3687054D64F958D7A50D731EC5487E0

Function 6C8FB060 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6C8FB068

Part of subcall function 6C8F9E65: WideCharToMultiByte.KERNEL32(00000000,00000000,6C8E66A1,?,6C8E6732,00000016,6C8EEE89,0000FDE9,?,?,00000008,?,00000003,6C912580,00000024,6C8EEE89), ref: 6C8F9F11

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6C8FB0A0
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6C8FB0C0

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: ffc728a8d37d0827cd62f510431c1ee325fd69ad62d924f53835d4eb06e6b99a
Instruction ID: cd0bcbd076bdd10e91cbfac5ad5e9f6a6c5a22cd161111c232e4b91c7296aae2
Opcode Fuzzy Hash: ffc728a8d37d0827cd62f510431c1ee325fd69ad62d924f53835d4eb06e6b99a
Instruction Fuzzy Hash: 261182A1709519FFA73116BA9E88CBF697DDF861D83100939F42191600EF649D0646B9

Function 2DE04B96 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 2DE04873: ??_V@YAXPAX@Z.MSVCR90(?,?,2DE04B1B), ref: 2DE04883

MultiByteToWideChar.KERNEL32(?,00000000,?,000000FF,00000000,00000000), ref: 2DE04BF9
MultiByteToWideChar.KERNEL32(?,00000000,?,000000FF,?,?), ref: 2DE04C39

Strings

ek29, xrefs: 2DE04C13
pq8e, xrefs: 2DE04BD3

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: ek29$pq8e
API String ID: 626452242-1107266725
Opcode ID: ce4bb88f205e0af481b9bfe892d5e043abb8357571322b4b005d7a6b3fe14bf0
Instruction ID: be86faf887ee6353c6523344bb696ce9baeb0910394add7470d99ebaf3857a78
Opcode Fuzzy Hash: ce4bb88f205e0af481b9bfe892d5e043abb8357571322b4b005d7a6b3fe14bf0
Instruction Fuzzy Hash: F511AFB2904118BFDF01AF95CDC0CAE7FBDFF052A6B208126F619B2150EA318E51DB60

Function 2DE04F8C Relevance: 6.1, APIs: 4, Instructions: 66timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?,?), ref: 2DE04FAA
FileTimeToSystemTime.KERNEL32(?,?), ref: 2DE04FB8
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,?), ref: 2DE04FD0
GetTimeFormatW.KERNEL32(00000400,?,?,00000000,00000000,?), ref: 2DE05018

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Time$File$Format$DateLocalSystem
String ID:
API String ID: 4010208002-0
Opcode ID: 55d76e91ffc06cb61a2d4dba41318085536051da4817d29b16013b24dcfb9706
Instruction ID: f38912fda9bd5f074ee0737b4064089315bde1cc702859d34c9f6b714a09bcab
Opcode Fuzzy Hash: 55d76e91ffc06cb61a2d4dba41318085536051da4817d29b16013b24dcfb9706
Instruction Fuzzy Hash: 511160776102096BDB10CBA4CD45FEB77BDEF49B0AF018021EA06F7281DA709941C7E0

Function 2DE1199D Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON

Download Yara Rule

APIs

IsWindowEnabled.USER32(00000000), ref: 2DE119AD
EnableWindow.USER32(00000000,00000001), ref: 2DE119DA

Part of subcall function 2DE13955: IsWindow.USER32(?), ref: 2DE1397E
Part of subcall function 2DE13955: EnableWindow.USER32(?,00000001), ref: 2DE13990
Part of subcall function 2DE13955: ??_V@YAXPAX@Z.MSVCR90(?,00000000,00000000,?,2DE119D5,?,?,?,2DE11DC9,?,?,00000034,2DE07728,?,?,?), ref: 2DE139A8

GetWindowLongA.USER32(00000000,000000F0), ref: 2DE119E5
SendMessageA.USER32(?,0000036E,?,?), ref: 2DE11A2A

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Enable$EnabledLongMessageSend
String ID:
API String ID: 2621221260-0
Opcode ID: bb32262985773ac4c274de814cd8d7655f76918331de0e9f2c0d111f52b75e43
Instruction ID: ed0aa6e6f5bd644c96fbd842ebb37869c49961a97d3258602a31e6ba4ec09716
Opcode Fuzzy Hash: bb32262985773ac4c274de814cd8d7655f76918331de0e9f2c0d111f52b75e43
Instruction Fuzzy Hash: CB11E131714A05AFDF124F64C845BAE7AF5EB40A95F10812AE22AFA250EF32DD40CB00

Function 2DE11920 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 2DE1192E
GetTopWindow.USER32(00000000), ref: 2DE1196D
GetWindow.USER32(00000000,00000002), ref: 2DE1198B

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: b729a9e4a16570d845ed4569ce66a9d6bb9f616785952e555f7525a1062118bb
Instruction ID: fec8727d7d8e7ba6ea117a30a31bb2514799f35f5b82e6184f2dab452ec24182
Opcode Fuzzy Hash: b729a9e4a16570d845ed4569ce66a9d6bb9f616785952e555f7525a1062118bb
Instruction Fuzzy Hash: 6801E53620411ABBCF135F909C04F9E3B6AFF183D1F018010FA29B5160CB36CA61EBA5

Function 2DE1137C Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(2DE00000,?,00000005,?,?,?,2DE11500,2DE1E6DC), ref: 2DE113A3
LoadResource.KERNEL32(2DE00000,00000000,?,?,?,2DE11500,2DE1E6DC), ref: 2DE113AF
LockResource.KERNEL32(?,?,?,?,2DE11500,2DE1E6DC), ref: 2DE113C0
FreeResource.KERNEL32(?,?,?,?,2DE11500,2DE1E6DC), ref: 2DE113DF

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: a8efbe4908ec1c30af3138e6126bc090e3f7a193e84cd5ac370c438b2d57004a
Instruction ID: a83c390b76d7d32bf5f5ba7546a353102d56c1239423eb3a03057b618e331e4a
Opcode Fuzzy Hash: a8efbe4908ec1c30af3138e6126bc090e3f7a193e84cd5ac370c438b2d57004a
Instruction Fuzzy Hash: 10012633305D509FC7032BA288C8A7A33F8AF4561E703416DEA42FB605EB76CD428794

Function 2DE111CF Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(000088C4,?), ref: 2DE111DA
GetTopWindow.USER32(00000000), ref: 2DE111ED

Part of subcall function 2DE111CF: GetWindow.USER32(00000000,00000002), ref: 2DE11234

GetTopWindow.USER32(000088C4), ref: 2DE1121D

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 0ed834fd8d47b5b5f2f938f65daeef79185cd43fddb9785e295095d7fe1ff936
Instruction ID: 78caea8ff3a2c42641585fb84a70031ac7c1f5089cf3231b375ab8e39500d269
Opcode Fuzzy Hash: 0ed834fd8d47b5b5f2f938f65daeef79185cd43fddb9785e295095d7fe1ff936
Instruction Fuzzy Hash: 60014B36305626A7CB132E618C00F9E3AA9AF157D5F018020FE04F5111EF35DE51E6E9

Function 2DE11A35 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 2DE11A66
GetForegroundWindow.USER32(00000000,?,?,2DE11DE0,?,?,00000034,2DE07728,?,?,?), ref: 2DE11A78
IsWindowEnabled.USER32(?), ref: 2DE11A8B
SetForegroundWindow.USER32(?), ref: 2DE11A98

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Foreground$ActiveEnabledLastPopup
String ID:
API String ID: 3209796547-0
Opcode ID: fec151bf59149b915f30028da6df567905d8e51527dcf3a3a4c1db77088edd60
Instruction ID: 4237eff81fc594085150e6e58ff0ff235704687a9804344f421f4b2d54d88b24
Opcode Fuzzy Hash: fec151bf59149b915f30028da6df567905d8e51527dcf3a3a4c1db77088edd60
Instruction Fuzzy Hash: 3CF0A432B09B01EFDF115B60E80866A7BE8AF00756B01C124E625F4050CFB9CD48CB90

Function 2DE1416D Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE14174
DeleteObject.GDI32(?), ref: 2DE14197
DeleteObject.GDI32(?), ref: 2DE141A4
DeleteObject.GDI32(?), ref: 2DE141B1

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: DeleteObject$H_prolog3
String ID:
API String ID: 2471701793-0
Opcode ID: 5755b9e2f4bf303a9d8c68cd99a4ca2b5906f1947a79675eecd3f6a190e20cb5
Instruction ID: 38ace634ff8e6bf6bb9e00150678546841b3af3d9f301dc73749b2e9d0ecd5db
Opcode Fuzzy Hash: 5755b9e2f4bf303a9d8c68cd99a4ca2b5906f1947a79675eecd3f6a190e20cb5
Instruction Fuzzy Hash: B6F03C71B00710CBCB10EFA9888051EF6F5BF68614B610A2DE29AF7750CF70ED408A45

Function 2DE15923 Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE1592A
GetLastError.KERNEL32(00000004,2DE10854,00000004,2DE109B6,00000000,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE1592F
TlsGetValue.KERNEL32(0000000D,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE15955
SetLastError.KERNEL32(00000000,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE15984

Part of subcall function 2DE15E13: TlsAlloc.KERNEL32(00000000,?,2DE15946,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE15E1B
Part of subcall function 2DE15E13: GetVersion.KERNEL32(?,2DE15946,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE15E1F
Part of subcall function 2DE15E13: TlsAlloc.KERNEL32(?,2DE15946,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE15E32

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AllocErrorLast$H_prolog3ValueVersion
String ID:
API String ID: 2925315393-0
Opcode ID: 313e1bb0cc4c6370f46f50a6be960fbc810c3b6ece0fc85aff8293679f3325a7
Instruction ID: f5c9f16dda4a944d973ccb3fadc4225e0d58409ec143351d6e5ce2369c46e43b
Opcode Fuzzy Hash: 313e1bb0cc4c6370f46f50a6be960fbc810c3b6ece0fc85aff8293679f3325a7
Instruction Fuzzy Hash: 93F03072B142118FC745ABB88845B7D26F0AB18F75B510715EA3AFB3C0DF68CE409A56

Function 2DE0845B Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 2DE08462
SendMessageA.USER32(?,00000443,00000000,00000000), ref: 2DE0847F
SendMessageA.USER32(?,0000043B,00000000,00000000), ref: 2DE0848B
SendMessageA.USER32(?,00000445,00000000,00000000), ref: 2DE084A8

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: MessageSend$Color
String ID:
API String ID: 3922397608-0
Opcode ID: e1f3708014c83522ad4db5db84b6bfd067d8a4279d37c00a3d55301fab7e63e7
Instruction ID: 412843cd4cedd6ee6d8f9951360010306d7e914bd1480d890d6077efd6b5ec9f
Opcode Fuzzy Hash: e1f3708014c83522ad4db5db84b6bfd067d8a4279d37c00a3d55301fab7e63e7
Instruction Fuzzy Hash: ADF0A771500558B6DA215F12CC08F6B3E6CEBC5FA3F00803AB72879050C6714541CAA5

Function 2DE109DE Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

IsWindowUnicode.USER32(?), ref: 2DE109F9
DefWindowProcW.USER32(?,?,?,?), ref: 2DE10A0F
DefWindowProcA.USER32(?,?,?,?), ref: 2DE10A17
CallWindowProcA.USER32(?,?,?,?,?), ref: 2DE10A2C

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Window$Proc$CallUnicode
String ID:
API String ID: 3117573011-0
Opcode ID: 6712436b275561412faa981374861e3c3c1730d9292a5f24fae0e1f0567602e9
Instruction ID: 5ebc51056c884d8a66915a40fdacbe896c621bd537ce56ead9cfa337ac5e82ae
Opcode Fuzzy Hash: 6712436b275561412faa981374861e3c3c1730d9292a5f24fae0e1f0567602e9
Instruction Fuzzy Hash: 06F0BD36200609EFDF129FA5C808E9A7FB9FF087917108418FA56FA521DB36DD24EB54

Function 2DE158AB Relevance: 6.0, APIs: 4, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE158B2
free.MSVCR90 ref: 2DE158CB
TlsGetValue.KERNEL32(00000004,2DE12DCD,?,?,2DE159B3,00000001,2DE1263C,?,?,?,?,?,?,?,?,?), ref: 2DE158DC
TlsSetValue.KERNEL32(00000000,?,?,2DE159B3,00000001,2DE1263C,?,?,?,?,?,?,?,?,?,?), ref: 2DE158EE

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: Value$H_prolog3free
String ID:
API String ID: 3023147540-0
Opcode ID: 3a6368561deb6a86a7c663d617aaf33a15f012b6fb48627a54ab9144929f8cbd
Instruction ID: 248b74dc4971cf6dc8d4a5a4727e44a570cf6467323109d7d320a3340f61b2ff
Opcode Fuzzy Hash: 3a6368561deb6a86a7c663d617aaf33a15f012b6fb48627a54ab9144929f8cbd
Instruction Fuzzy Hash: 83F03771604741CBDB24EBA0C809BA97BF4BB10B15F518529E566B6290DFB4EE04CB18

Function 6C901BDC Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,6C8E14C0,6C8E899D,00000000,00000000,?,6C8FE1F8,00000000,00000001,00000000,?,?,6C8F3C9C,?,00000000,00000000), ref: 6C901BF3
GetLastError.KERNEL32(?,6C8FE1F8,00000000,00000001,00000000,?,?,6C8F3C9C,?,00000000,00000000,?,?,?,6C8F425A,?), ref: 6C901BFF

Part of subcall function 6C901BC5: CloseHandle.KERNEL32(FFFFFFFE,6C901C0F,?,6C8FE1F8,00000000,00000001,00000000,?,?,6C8F3C9C,?,00000000,00000000,?,?), ref: 6C901BD5

___initconout.LIBCMT ref: 6C901C0F

Part of subcall function 6C901B87: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6C901BB6,6C8FE1E5,?,?,6C8F3C9C,?,00000000,00000000,?), ref: 6C901B9A

WriteConsoleW.KERNEL32(00000000,6C8E14C0,6C8E899D,00000000,?,6C8FE1F8,00000000,00000001,00000000,?,?,6C8F3C9C,?,00000000,00000000,?), ref: 6C901C24

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 95cc652dccfcac65a12e863cec067dc8de9d4f328d25e40813601fbf0f3a0c88
Instruction ID: b309c99814f12a2892f102d2b34e5215ab7abdc7616bf639a6fb284e7b11d512
Opcode Fuzzy Hash: 95cc652dccfcac65a12e863cec067dc8de9d4f328d25e40813601fbf0f3a0c88
Instruction Fuzzy Hash: 0AF01C36708125BBCF121F91DC05A8D3F7AFB2A7A8B15411CFA19A5920D732C820DF95

Function 2DE16019 Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

Part of subcall function 2DE15FCC: KiUserCallbackDispatcher.NTDLL(00000002), ref: 2DE15FDE
Part of subcall function 2DE15FCC: GetSystemMetrics.USER32(00000003), ref: 2DE15FE8

GetDC.USER32(00000000), ref: 2DE16025
GetDeviceCaps.GDI32(00000000,00000058), ref: 2DE16036
GetDeviceCaps.GDI32(00000000,0000005A), ref: 2DE1603E
ReleaseDC.USER32(00000000,00000000), ref: 2DE16046

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: CapsDevice$CallbackDispatcherMetricsReleaseSystemUser
String ID:
API String ID: 1894321826-0
Opcode ID: ed19f3a8a7568dd4d60e5bd3a194388b818b3a0316d68a6f1a556f99a2e371a5
Instruction ID: 553c4bdd1fff6e8aea2a5325422da035ac18e58c8707a684d20b922f92c956bb
Opcode Fuzzy Hash: ed19f3a8a7568dd4d60e5bd3a194388b818b3a0316d68a6f1a556f99a2e371a5
Instruction Fuzzy Hash: 74E04F726407146AD21017728C48F4BAFECEB58A63F004422F609EB2C1CA7988008EA0

Function 6C8D8AA6 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 341COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 6C8D8B58
_strcspn.LIBCMT ref: 6C8D8B9B

Strings

@, xrefs: 6C8D8D25

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: 45ff1ea02da4861ac947a869f1c2c77c226706a496360b41299ae03b691388b4
Instruction ID: 2cab782ab3cfe4054665caf90b1351f9244d5190bb462f25f79e4eb1d28b885d
Opcode Fuzzy Hash: 45ff1ea02da4861ac947a869f1c2c77c226706a496360b41299ae03b691388b4
Instruction Fuzzy Hash: 39E1257190024DDFDF14DFA8DA90AEDBBB5FF09308F12486AE815AB660DB30A955CF50

Function 6C8E59EB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6C8E5A10

Strings

MOC, xrefs: 6C8E5A22
RCC, xrefs: 6C8E5A2A

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ec1dbb2166079a454f3f48ebb7bc228227eac3d16b51d990e4cf5245dbbbe4d9
Instruction ID: 73de47d5019957da928d8546db45a4e75c998d780900052b135b568dfdb02d72
Opcode Fuzzy Hash: ec1dbb2166079a454f3f48ebb7bc228227eac3d16b51d990e4cf5245dbbbe4d9
Instruction Fuzzy Hash: DB415831A00209EFCF15DF98CE81AEE7BB5BF8E308F244969F91467651D3359950DB50

Function 2DE06FBB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE06FC2
memset.MSVCR90 ref: 2DE06FD5

Part of subcall function 2DE052D6: GetProcAddress.KERNEL32(00000000,00000142), ref: 2DE052F4

Strings

D, xrefs: 2DE07047

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressH_prolog3Procmemset
String ID: D
API String ID: 2467443255-2746444292
Opcode ID: c50c3fe2fbca24ef6d2e30d2d293ab88aa1bbfa10507a061da2d1030a258762c
Instruction ID: 3a9c6c71b7a73342d50ca9b557e526051739088e0d00c0d9f9f0e05f7d1a5fc7
Opcode Fuzzy Hash: c50c3fe2fbca24ef6d2e30d2d293ab88aa1bbfa10507a061da2d1030a258762c
Instruction Fuzzy Hash: FB316CB1A04605EBDB10EFA0C885A9E7BB9FF84745F208518E659BB290DF35ED01CB11

Function 6C8E8D88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C8F5AAD: MultiByteToWideChar.KERNEL32(6C8FAE39,00000100,E8458D00,00000000,00000000,00000020,?,6C8F8002,00000000,00000000,00000100,00000020,00000000,00000000,E8458D00,00000100), ref: 6C8F5B1D

GetLastError.KERNEL32(?,?,?,?,?,?,?,6C8E8FCF,00000000,?,00000000,2463616368652E646174), ref: 6C8E8DEC
__dosmaperr.LIBCMT ref: 6C8E8DF3

Strings

2463616368652E646174, xrefs: 6C8E8D8D

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: 2463616368652E646174
API String ID: 2434981716-3036274828
Opcode ID: 84938ab8dc6ae9330b15720c10605fe75f3f0137180ac88b91faa620407ce00b
Instruction ID: a08be2abaeb443f35200762f458d7a65bbfde0a4644c83e1e08b229ad70d7fb9
Opcode Fuzzy Hash: 84938ab8dc6ae9330b15720c10605fe75f3f0137180ac88b91faa620407ce00b
Instruction Fuzzy Hash: 2921AB31604615BFD7315F2E8E0094F77A5EF9B3A5B154A1AE82497A90E770E8118790

Function 2DE117FB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 2DE15923: __EH_prolog3.LIBCMT ref: 2DE1592A
Part of subcall function 2DE15923: GetLastError.KERNEL32(00000004,2DE10854,00000004,2DE109B6,00000000,?,?,?,2DE10E48,00000004,2DE04F59), ref: 2DE1592F

GetClassInfoA.USER32(-00000068,?), ref: 2DE1185A

Part of subcall function 2DE04609: _vsnprintf.MSVCR90 ref: 2DE0463A

Strings

Afx:%x:%x:%x:%x, xrefs: 2DE1183F
Afx:%x, xrefs: 2DE11825

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: ClassErrorH_prolog3InfoLast_vsnprintf
String ID: Afx:%x$Afx:%x:%x:%x:%x
API String ID: 3801848739-1102061830
Opcode ID: 5cda9b0a7c72ecb1f9619b295853e0c3c7125269b2711f997083b6715b1dff32
Instruction ID: ce794fe46332818bfdc4c536d4e11fed8198e1b0adb0a543ba67ab41ce5d34f2
Opcode Fuzzy Hash: 5cda9b0a7c72ecb1f9619b295853e0c3c7125269b2711f997083b6715b1dff32
Instruction Fuzzy Hash: A52121B1E00209ABCB01DF95D840BEE7BF9EF59655F04802AF915F2201EB75DA50CBA5

Function 2DE0AD2B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2DE0AD32
SetRectEmpty.USER32(?), ref: 2DE0ADEB

Strings

X$-, xrefs: 2DE0ADC3

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: EmptyH_prolog3Rect
String ID: X$-
API String ID: 1443337074-1787739716
Opcode ID: 9152f942eca8f583369fd8cb702b94d0e5284345be57e5738ea352421ee21b01
Instruction ID: 230fc07bf141b474d574ac46816416a1e246d67377fabd3dbe831035d7e122bd
Opcode Fuzzy Hash: 9152f942eca8f583369fd8cb702b94d0e5284345be57e5738ea352421ee21b01
Instruction Fuzzy Hash: EE21D3B0805B40CFC321CFAAC18465AFBF4BF65705F508A4ED19AA7A60CBB5A648CB55

Function 6C8D392D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6C8D3939
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6C8D398C

Part of subcall function 6C8E0EDD: _Yarn.LIBCPMT ref: 6C8E0EFC
Part of subcall function 6C8E0EDD: _Yarn.LIBCPMT ref: 6C8E0F20

Strings

bad locale name, xrefs: 6C8D3995

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 30c26b19ff347429d12275a6599a655557cd0315d15f93469c90574fea308540
Instruction ID: 292a42c840cae3e2c85ca8facab59e5f1637839630a3cb522e38a90d515680ef
Opcode Fuzzy Hash: 30c26b19ff347429d12275a6599a655557cd0315d15f93469c90574fea308540
Instruction Fuzzy Hash: 15F0CD30505149EBDB18DB9CCA65BEC7371AF4520DF250968D1022AB92CF35BF54EB25

Function 2DE0F61C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(mso.dll,?,2DE0FBDC,?,00000201,?,?,80000000), ref: 2DE0F624
MessageBoxW.USER32(00000000,7FFFFEF8,80000008,00000000), ref: 2DE0F681

Strings

mso.dll, xrefs: 2DE0F61F

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: HandleMessageModule
String ID: mso.dll
API String ID: 2216695990-1671880577
Opcode ID: 8e45b0e745f1a8061f8f225e02fd858c7839db9153886311a60a073155b07bbb
Instruction ID: d0f851e8aab955daaa466e203f5171b14a45a552adbc087ad9cebd2e24ed3510
Opcode Fuzzy Hash: 8e45b0e745f1a8061f8f225e02fd858c7839db9153886311a60a073155b07bbb
Instruction Fuzzy Hash: 31F0B43219410ABBE3449AB4CC06FA537ECE724B46F048110F146F62D0DE6DD594CB76

Function 6C8E12E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6C8E12F3
std::_Lockit::~_Lockit.LIBCPMT ref: 6C8E1331

Strings

outlook-web.ddns.net, xrefs: 6C8E12EC

Memory Dump Source

Source File: 00000007.00000002.2232601084.000000006C8D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2232579160.000000006C8D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232632846.000000006C904000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232657417.000000006C914000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232681716.000000006C93C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2232702929.000000006C93D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_MSWordServices.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: outlook-web.ddns.net
API String ID: 593203224-2894021055
Opcode ID: 5194702f17f0ef2d75552974635466a53989dcefc40f6e661027ce3c5331d194
Instruction ID: 44bf2bccd086bdd494015e98e179b275bac667e138ca9b64d709497016b0cdf4
Opcode Fuzzy Hash: 5194702f17f0ef2d75552974635466a53989dcefc40f6e661027ce3c5331d194
Instruction Fuzzy Hash: 5EF0BE726001909ECB60EB5DCA40A99BBE5EBCB754B254A78C42AD7702EB30E942C781

Function 2DE135E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCR90(?,p(-,?,?,2DE13669,p(-,?,00000000,?,2DE157B6,00000000,?,?,?,2DE02870,?), ref: 2DE13607

Strings

p(-, xrefs: 2DE135ED
p(-, xrefs: 2DE135EC

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID:
String ID: p(-$p(-
API String ID: 0-773738704
Opcode ID: cc3a28099630c4a92c833c90afcec42e4b710eff09a216eab597794e02bd7e12
Instruction ID: eac8867002c6476c7256e3ccf449a015698073b16dcffed580ea3734e6da1714
Opcode Fuzzy Hash: cc3a28099630c4a92c833c90afcec42e4b710eff09a216eab597794e02bd7e12
Instruction Fuzzy Hash: 19E06D7A2047069AC721CF4AD000B42FBE8EFA5760F51842AD6D8A3600CB70F8808BA0

Function 2DE052D7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 2DE03F46: LoadLibraryA.KERNEL32(?,2DE19D60,00000010), ref: 2DE03F75

GetProcAddress.KERNEL32(00000000,00000142), ref: 2DE052F4

Strings

4-, xrefs: 2DE052D7
olmapi32.dll, xrefs: 2DE052DF

Memory Dump Source

Source File: 00000007.00000002.2232503245.000000002DE01000.00000020.00000001.01000000.00000005.sdmp, Offset: 2DE00000, based on PE: true

Associated: 00000007.00000002.2232487004.000000002DE00000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232526714.000000002DE1E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232544368.000000002DE22000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2232560837.000000002DE23000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2de00000_MSWordServices.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: 4-$olmapi32.dll
API String ID: 2574300362-675466117
Opcode ID: 8ccf418b054d2ad8586eb34c0dcd90fb179f0bb6e35669667af19ac5602818c3
Instruction ID: fdf3de23cda28f83e7e81ee7a96c9e15eaa9415382723889029e1f57285b39c2
Opcode Fuzzy Hash: 8ccf418b054d2ad8586eb34c0dcd90fb179f0bb6e35669667af19ac5602818c3
Instruction Fuzzy Hash: 75C08CF690E2411ECB102F6059CA7CC3AF0FB2AF03F000545F286F8656CEA8C444CA07

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report msws.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSWordServices.e_1aa99ae589ec8d5fef1ee322d61b9f8c687c47cd_1ac15c9b_0eee42af-d448-4f6b-ba43-425a8d78e38b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1243.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1310.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER135F.tmp.xml

C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files.cab

C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\2e15b4a5edec4957a683758e4becfe67$dpx$.tmp\64537d8fc3380a4bb24ba512ffb97757.tmp

C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\2e15b4a5edec4957a683758e4becfe67$dpx$.tmp\840ab06c8b2f5b449385041b6c507ff7.tmp

C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\MSWordServices.exe (copy)

C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\files\OLMAPI32.dll (copy)

C:\Users\user\AppData\Local\Temp\MW-7ee27cdf-ebd4-42c2-9cd8-711a0386958b\msiwrapper.ini

C:\Windows\Installer\6ef47a.msi

C:\Windows\Installer\MSIF9BA.tmp

C:\Windows\Installer\SourceHash{E22E6085-4A70-49E4-B1C5-4305B74C3132}

C:\Windows\Installer\inprogressinstallinfo.ipi

C:\Windows\Logs\DPX\setupact.log

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

C:\Windows\Temp\~DF5E036ED87243F5CB.TMP

C:\Windows\Temp\~DFA3A48E71AD02AFAB.TMP

\Device\ConDrv

Windows Analysis Report
msws.msi

Function 6C8D4F22 Relevance: 169.2, APIs: 48, Strings: 47, Instructions: 2972
filesleepCOMMONLIBRARYCODE

Function 6C8DEA93 Relevance: 155.5, APIs: 25, Strings: 63, Instructions: 1459
registryCOMMONLIBRARYCODE

Function 6C8DCB90 Relevance: 65.6, APIs: 30, Strings: 7, Instructions: 882
COMMONLIBRARYCODE

Function 6C8DE49B Relevance: 54.3, APIs: 16, Strings: 15, Instructions: 73
libraryloaderCOMMONLIBRARYCODE

Function 2DE174DE Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 61
memorylibraryloaderCOMMON

Function 6C8D7E9F Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67
processCOMMONLIBRARYCODE

Function 6C8DFB96 Relevance: 30.2, APIs: 5, Strings: 12, Instructions: 457
registryCOMMON

Function 2DE03C77 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 111
libraryCOMMONLIBRARYCODE

Function 6C8EDA0B Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 284
COMMONLIBRARYCODE

Function 6C8E08DC Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 61
libraryloaderCOMMONLIBRARYCODE

Function 2DE050C9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 29
libraryloaderCOMMON

Function 6C8E1FF8 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre