Windows Analysis Report
SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx

Overview

General Information

Sample name: SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx
Analysis ID: 1431821
MD5: 7ecb32ab27106ae197b58938177bffe3
SHA1: 289ddfd262d770c15f1abdddae71a9159e5a40fc
SHA256: b9c43834feaf98843ffe7bcd5d25829fdc00544433ccf003a19011997540996d
Tags: xlsx
Infos:

Detection

Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Microsoft Office drops suspicious files
Office drops RTF file
Office viewer loads remote template
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Unable to load, office file is protected or invalid
Uses a known web browser user agent for HTTP communication
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://wheel.to/IOGg52 Avira URL Cloud: Label: phishing
Source: http://wheel.to/IOGg52 Avira URL Cloud: Label: phishing
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3F2CFC35.doc Avira: detection malicious, Label: HEUR/Rtf.Malformed
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat[1].doc Avira: detection malicious, Label: HEUR/Rtf.Malformed
Multi AV Scanner detection for domain / URL
Source: wheel.to Virustotal: Detection: 7% Perma Link
Source: http://23.95.60.77/morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat.doc Virustotal: Detection: 9% Perma Link
Source: https://wheel.to/IOGg52 Virustotal: Detection: 7% Perma Link
Source: http://wheel.to/IOGg52 Virustotal: Detection: 7% Perma Link
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx Virustotal: Detection: 11% Perma Link
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49781 version: TLS 1.2

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: wheel.to
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 192.168.2.4:49766 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49766
Source: global traffic TCP traffic: 192.168.2.4:49766 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49766 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49766
Source: global traffic TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49766 -> 23.95.60.77:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic TCP traffic: 192.168.2.4:49770 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49770
Source: global traffic TCP traffic: 192.168.2.4:49770 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49770 -> 23.95.60.77:80
Source: global traffic TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49770
Source: global traffic TCP traffic: 192.168.2.4:49770 -> 23.95.60.77:80
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49786
Source: global traffic TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49786
Source: global traffic TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49787
Source: global traffic TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49787
Source: global traffic TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49788
Source: global traffic TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49788
Source: global traffic TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49789
Source: global traffic TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49789
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49790
Source: global traffic TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49790
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49788
Source: global traffic TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49788
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49786
Source: global traffic TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49786
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49789
Source: global traffic TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49788
Source: global traffic TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49786
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49787
Source: global traffic TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49789
Source: global traffic TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: excel.exe Memory has grown: Private usage: 2MB later: 70MB
Source: winword.exe Memory has grown: Private usage: 7MB later: 79MB
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 13.107.213.41 13.107.213.41
Source: Joe Sandbox View IP Address: 76.76.21.21 76.76.21.21
Source: Joe Sandbox View IP Address: 76.76.21.21 76.76.21.21
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /IOGg52 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: wheel.to
Source: global traffic HTTP traffic detected: GET /IOGg52 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: wheel.toConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat.doc HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: global traffic HTTP traffic detected: GET /IOGg52 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: wheel.to
Source: global traffic HTTP traffic detected: GET /rules/rule490016v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule170012v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324001v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule63067v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324002v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324006v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324003v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324004v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324005v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324007v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /IOGg52 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: wheel.toConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat.doc HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: 23.95.60.77
Source: global traffic DNS traffic detected: DNS query: wheel.to
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.0.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx, IOGg52.url.6.dr String found in binary or memory: http://wheel.to/IOGg52
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49781 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3F2CFC35.doc, type: DROPPED Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat[1].doc, type: DROPPED Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Excel sheet contains many unusual embedded objects
Source: SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx OLE: Microsoft Excel 2007+
Source: ~DF7D914B8C3AC74809.TMP.0.dr OLE: Microsoft Excel 2007+
Source: ~DFF90E6621A01F7A47.TMP.0.dr OLE: Microsoft Excel 2007+
Microsoft Office drops suspicious files
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\IOGg52.url Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\wheel.to.url Jump to behavior
Document contains embedded VBA macros
Source: SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx OLE indicator, VBA macros: true
Source: iso690.xsl.6.dr OLE indicator, VBA macros: true
Source: ieee2006officeonline.xsl.6.dr OLE indicator, VBA macros: true
Source: mlaseventheditionofficeonline.xsl.6.dr OLE indicator, VBA macros: true
Source: gosttitle.xsl.6.dr OLE indicator, VBA macros: true
Source: gb.xsl.6.dr OLE indicator, VBA macros: true
Source: sist02.xsl.6.dr OLE indicator, VBA macros: true
Source: iso690nmerical.xsl.6.dr OLE indicator, VBA macros: true
Source: CatalogCacheMetaData.xml.6.dr OLE indicator, VBA macros: true
Source: harvardanglia2008officeonline.xsl.6.dr OLE indicator, VBA macros: true
Source: APASixthEditionOfficeOnline.xsl.6.dr OLE indicator, VBA macros: true
Source: turabian.xsl.6.dr OLE indicator, VBA macros: true
Source: gostname.xsl.6.dr OLE indicator, VBA macros: true
Source: chicago.xsl.6.dr OLE indicator, VBA macros: true
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~DF7D914B8C3AC74809.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DFF90E6621A01F7A47.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690.xsl.6.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ieee2006officeonline.xsl.6.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: mlaseventheditionofficeonline.xsl.6.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gosttitle.xsl.6.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gb.xsl.6.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: sist02.xsl.6.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690nmerical.xsl.6.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: CatalogCacheMetaData.xml.6.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{396CDDC9-7EA9-42FD-A939-742396F648D6}.tmp.6.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: harvardanglia2008officeonline.xsl.6.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: APASixthEditionOfficeOnline.xsl.6.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: turabian.xsl.6.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gostname.xsl.6.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chicago.xsl.6.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Unable to load, office file is protected or invalid
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Window title found: microsoft excel okexcel cannot open the file 'securiteinfo.com.msexcel.cve_2017_0199.ddoc.exploit.32374.20351.xlsx' because the file format or file extension is not valid. verify that the file has not been corrupted and that the file extension matches the format of the file.
Yara signature match
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3F2CFC35.doc, type: DROPPED Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat[1].doc, type: DROPPED Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: classification engine Classification label: mal100.expl.evad.winXLSX@6/276@1/3
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File created: C:\Users\user\Desktop\~$SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\{50E308F2-ECBD-471E-8FF8-CBF644AA111E} - OProcSessId.dat Jump to behavior
Source: Equations.dotx.6.dr OLE indicator, Word Document stream: true
Source: Insight design set.dotx.6.dr OLE indicator, Word Document stream: true
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr OLE indicator, Word Document stream: true
Source: Element design set.dotx.6.dr OLE indicator, Word Document stream: true
Source: ~WRD0000.tmp.6.dr OLE indicator, Word Document stream: true
Source: SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx OLE indicator, Workbook stream: true
Source: A2B30000.0.dr OLE indicator, Workbook stream: true
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx Virustotal: Detection: 11%
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3EE60F5C-9BAD-4CD8-8E21-AD2D001D06EB}\InprocServer32 Jump to behavior
Source: Templates.LNK.6.dr LNK file: ..\..\Templates
Source: Window Recorder Window detected: More than 3 window changes detected
Source: A2B30000.0.dr Initial sample: OLE zip file path = xl/embeddings/oleObject1.bin
Source: A2B30000.0.dr Initial sample: OLE zip file path = xl/drawings/drawing2.xml
Source: A2B30000.0.dr Initial sample: OLE zip file path = xl/drawings/vmlDrawing2.vml
Source: A2B30000.0.dr Initial sample: OLE zip file path = xl/media/image2.emf
Source: A2B30000.0.dr Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: A2B30000.0.dr Initial sample: OLE zip file path = xl/drawings/_rels/vmlDrawing2.vml.rels
Source: A2B30000.0.dr Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: Equations.dotx.6.dr Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.6.dr Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.6.dr Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.6.dr Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.6.dr Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.6.dr Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.6.dr Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.6.dr Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.6.dr Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.6.dr Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.6.dr Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.6.dr Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.6.dr Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.6.dr Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.6.dr Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.6.dr Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.6.dr Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.6.dr Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.6.dr Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.6.dr Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.6.dr Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.6.dr Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.6.dr Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.6.dr Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.6.dr Initial sample: OLE zip file path = docProps/custom.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr Initial sample: OLE zip file path = docProps/custom.xml
Source: Element design set.dotx.6.dr Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.6.dr Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.6.dr Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.6.dr Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.6.dr Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.6.dr Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.6.dr Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.6.dr Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.6.dr Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.6.dr Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.6.dr Initial sample: OLE zip file path = docProps/custom.xml
Source: ~WRD0000.tmp.6.dr Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0000.tmp.6.dr Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0000.tmp.6.dr Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0000.tmp.6.dr Initial sample: OLE zip file path = word/glossary/styles.xml
Source: ~WRD0000.tmp.6.dr Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0000.tmp.6.dr Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll Jump to behavior
Source: ~DF7D914B8C3AC74809.TMP.0.dr Initial sample: OLE indicators vbamacros = False
Source: SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx Initial sample: OLE indicators encrypted = True

Persistence and Installation Behavior
barindex
Office drops RTF file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File dump: morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat[1].doc.0.dr Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE File dump: 3F2CFC35.doc.6.dr Jump to dropped file
Office viewer loads remote template
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Section loaded: netapi32.dll and davhlpr.dll loaded Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx Stream path 'Workbook' entropy: 7.93173431157 (max. 8.0)
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\splwow64.exe Window / User API: threadDelayed 1065 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\splwow64.exe Last function: Thread delayed
Source: C:\Windows\splwow64.exe Last function: Thread delayed
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information queried: ProcessInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1431821 Sample: SecuriteInfo.com.MSExcel.CV... Startdate: 25/04/2024 Architecture: WINDOWS Score: 100 28 wheel.to 2->28 30 templatesmetadata.office.net 2->30 32 2 other IPs or domains 2->32 40 Multi AV Scanner detection for domain / URL 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus detection for URL or domain 2->44 46 5 other signatures 2->46 8 EXCEL.EXE 144 92 2->8         started        12 EXCEL.EXE 2->12         started        signatures3 process4 dnsIp5 34 wheel.to 76.76.21.21, 443, 49752, 49753 AMAZON-02US United States 8->34 36 part-0013.t-0009.t-msedge.net 13.107.213.41, 443, 49780, 49781 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 8->36 38 23.95.60.77, 49754, 49766, 49770 AS-COLOCROSSINGUS United States 8->38 20 morningworkingforg...ulsheisgreat[1].doc, Rich 8->20 dropped 14 WINWORD.EXE 164 483 8->14         started        file6 process7 file8 22 C:\Users\user\AppData\...\wheel.to.url, MS 14->22 dropped 24 C:\Users\user\AppData\Roaming\...\IOGg52.url, MS 14->24 dropped 26 C:\Users\user\AppData\Local\...\3F2CFC35.doc, Rich 14->26 dropped 48 Office viewer loads remote template 14->48 50 Microsoft Office drops suspicious files 14->50 18 splwow64.exe 14->18         started        signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.213.41
 part-0013.t-0009.t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
23.95.60.77
 unknown United States
36352 AS-COLOCROSSINGUS false
76.76.21.21
 wheel.to United States
16509 AMAZON-02US true

Contacted Domains

Name IP Active
wheel.to 76.76.21.21 true
part-0013.t-0009.t-msedge.net 13.107.213.41 true
windowsupdatebg.s.llnwi.net 69.164.42.0 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://23.95.60.77/morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat.doc false
  • 10%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
https://wheel.to/IOGg52 false
  • 8%, Virustotal, Browse
  • Avira URL Cloud: phishing
 unknown
http://wheel.to/IOGg52 false
  • 8%, Virustotal, Browse
  • Avira URL Cloud: phishing
 unknown