Edit tour

Windows Analysis Report
SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx

Overview

General Information

Sample name:	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx
Analysis ID:	1431821
MD5:	7ecb32ab27106ae197b58938177bffe3
SHA1:	289ddfd262d770c15f1abdddae71a9159e5a40fc
SHA256:	b9c43834feaf98843ffe7bcd5d25829fdc00544433ccf003a19011997540996d
Tags:	xlsx
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Microsoft Office drops suspicious files

Office drops RTF file

Office viewer loads remote template

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Unable to load, office file is protected or invalid

Uses a known web browser user agent for HTTP communication

Yara signature match

Classification

Process Tree

System is w10x64

EXCEL.EXE (PID: 7232 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

WINWORD.EXE (PID: 8048 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

splwow64.exe (PID: 7380 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

EXCEL.EXE (PID: 412 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx" MD5: 4A871771235598812032C822E6F68F19)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3F2CFC35.doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x18d7:$obj2: \objdata 0x18bf:$obj3: \objupdate 0x1897:$obj5: \objautlink
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat[1].doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x18d7:$obj2: \objdata 0x18bf:$obj3: \objupdate 0x1897:$obj5: \objautlink

Sigma Signatures

System Summary

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 76.76.21.21, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7232, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49752

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.4, DestinationIsIpv6: false, DestinationPort: 49752, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7232, Protocol: tcp, SourceIp: 76.76.21.21, SourceIsIpv6: false, SourcePort: 80

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 8048, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://wheel.to/IOGg52	Avira URL Cloud: Label: phishing
Source: http://wheel.to/IOGg52	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3F2CFC35.doc	Avira: detection malicious, Label: HEUR/Rtf.Malformed
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat[1].doc	Avira: detection malicious, Label: HEUR/Rtf.Malformed

Multi AV Scanner detection for domain / URL

Source: wheel.to	Virustotal: Detection: 7%	Perma Link
Source: http://23.95.60.77/morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat.doc	Virustotal: Detection: 9%	Perma Link
Source: https://wheel.to/IOGg52	Virustotal: Detection: 7%	Perma Link
Source: http://wheel.to/IOGg52	Virustotal: Detection: 7%	Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx

Virustotal: Detection: 11%

Perma Link

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49781 version: TLS 1.2

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Source: global traffic

DNS query: name: wheel.to

Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443

Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic	TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic	TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic	TCP traffic: 192.168.2.4:49756 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49756
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic	TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic	TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic	TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic	TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic	TCP traffic: 192.168.2.4:49757 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49757
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49761 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic	TCP traffic: 192.168.2.4:49761 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49761 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic	TCP traffic: 192.168.2.4:49761 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49761 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49761 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic	TCP traffic: 192.168.2.4:49761 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49761
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic	TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic	TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic	TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic	TCP traffic: 192.168.2.4:49762 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49762
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49766 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49766
Source: global traffic	TCP traffic: 192.168.2.4:49766 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49766 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49766
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49766 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 76.76.21.21:80
Source: global traffic	TCP traffic: 76.76.21.21:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 76.76.21.21:443 -> 192.168.2.4:49768
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 76.76.21.21:443
Source: global traffic	TCP traffic: 192.168.2.4:49770 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49770
Source: global traffic	TCP traffic: 192.168.2.4:49770 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49770 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 23.95.60.77:80 -> 192.168.2.4:49770
Source: global traffic	TCP traffic: 192.168.2.4:49770 -> 23.95.60.77:80
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49784
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49780
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49783
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49781
Source: global traffic	TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49786
Source: global traffic	TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49786
Source: global traffic	TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49787
Source: global traffic	TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49787
Source: global traffic	TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49788
Source: global traffic	TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49788
Source: global traffic	TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49789
Source: global traffic	TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49789
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49782
Source: global traffic	TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49790
Source: global traffic	TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49790 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49790
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49788
Source: global traffic	TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49788
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49786
Source: global traffic	TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49786
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49789
Source: global traffic	TCP traffic: 192.168.2.4:49788 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49788
Source: global traffic	TCP traffic: 192.168.2.4:49786 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49786
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49787
Source: global traffic	TCP traffic: 192.168.2.4:49789 -> 13.107.213.41:443
Source: global traffic	TCP traffic: 13.107.213.41:443 -> 192.168.2.4:49789
Source: global traffic	TCP traffic: 192.168.2.4:49787 -> 13.107.213.41:443

Source: excel.exe	Memory has grown: Private usage: 2MB later: 70MB
Source: winword.exe	Memory has grown: Private usage: 7MB later: 79MB

Source: Joe Sandbox View	IP Address: 13.107.213.41 13.107.213.41
Source: Joe Sandbox View	IP Address: 76.76.21.21 76.76.21.21
Source: Joe Sandbox View	IP Address: 76.76.21.21 76.76.21.21

Source: Joe Sandbox View

ASN Name: AMAZON-02US AMAZON-02US

Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /IOGg52 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: wheel.to
Source: global traffic	HTTP traffic detected: GET /IOGg52 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: wheel.toConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat.doc HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: 23.95.60.77

Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.60.77

Source: global traffic	HTTP traffic detected: GET /IOGg52 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: wheel.to
Source: global traffic	HTTP traffic detected: GET /rules/rule490016v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule170012v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule324001v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule63067v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule324002v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule324006v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule324003v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule324004v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule324005v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule324007v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /IOGg52 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: wheel.toConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat.doc HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: 23.95.60.77

Source: global traffic

DNS traffic detected: DNS query: wheel.to

Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx, IOGg52.url.6.dr	String found in binary or memory: http://wheel.to/IOGg52

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.41:443 -> 192.168.2.4:49781 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3F2CFC35.doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat[1].doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen

Excel sheet contains many unusual embedded objects

Source: SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	OLE: Microsoft Excel 2007+
Source: ~DF7D914B8C3AC74809.TMP.0.dr	OLE: Microsoft Excel 2007+
Source: ~DFF90E6621A01F7A47.TMP.0.dr	OLE: Microsoft Excel 2007+

Microsoft Office drops suspicious files

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\IOGg52.url			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\wheel.to.url			Jump to behavior

Source: SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	OLE indicator, VBA macros: true
Source: iso690.xsl.6.dr	OLE indicator, VBA macros: true
Source: ieee2006officeonline.xsl.6.dr	OLE indicator, VBA macros: true
Source: mlaseventheditionofficeonline.xsl.6.dr	OLE indicator, VBA macros: true
Source: gosttitle.xsl.6.dr	OLE indicator, VBA macros: true
Source: gb.xsl.6.dr	OLE indicator, VBA macros: true
Source: sist02.xsl.6.dr	OLE indicator, VBA macros: true
Source: iso690nmerical.xsl.6.dr	OLE indicator, VBA macros: true
Source: CatalogCacheMetaData.xml.6.dr	OLE indicator, VBA macros: true
Source: harvardanglia2008officeonline.xsl.6.dr	OLE indicator, VBA macros: true
Source: APASixthEditionOfficeOnline.xsl.6.dr	OLE indicator, VBA macros: true
Source: turabian.xsl.6.dr	OLE indicator, VBA macros: true
Source: gostname.xsl.6.dr	OLE indicator, VBA macros: true
Source: chicago.xsl.6.dr	OLE indicator, VBA macros: true

Source: ~DF7D914B8C3AC74809.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DFF90E6621A01F7A47.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690.xsl.6.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ieee2006officeonline.xsl.6.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: mlaseventheditionofficeonline.xsl.6.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gosttitle.xsl.6.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gb.xsl.6.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: sist02.xsl.6.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690nmerical.xsl.6.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: CatalogCacheMetaData.xml.6.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{396CDDC9-7EA9-42FD-A939-742396F648D6}.tmp.6.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: harvardanglia2008officeonline.xsl.6.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: APASixthEditionOfficeOnline.xsl.6.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: turabian.xsl.6.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gostname.xsl.6.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chicago.xsl.6.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Window title found: microsoft excel okexcel cannot open the file 'securiteinfo.com.msexcel.cve_2017_0199.ddoc.exploit.32374.20351.xlsx' because the file format or file extension is not valid. verify that the file has not been corrupted and that the file extension matches the format of the file.

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3F2CFC35.doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat[1].doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.

Source: Equations.dotx.6.dr	OLE indicator, Word Document stream: true
Source: Insight design set.dotx.6.dr	OLE indicator, Word Document stream: true
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	OLE indicator, Word Document stream: true
Source: Element design set.dotx.6.dr	OLE indicator, Word Document stream: true
Source: ~WRD0000.tmp.6.dr	OLE indicator, Word Document stream: true

Source: SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	OLE indicator, Workbook stream: true
Source: A2B30000.0.dr	OLE indicator, Workbook stream: true

Source: A2B30000.0.dr	Initial sample: OLE zip file path = xl/embeddings/oleObject1.bin
Source: A2B30000.0.dr	Initial sample: OLE zip file path = xl/drawings/drawing2.xml
Source: A2B30000.0.dr	Initial sample: OLE zip file path = xl/drawings/vmlDrawing2.vml
Source: A2B30000.0.dr	Initial sample: OLE zip file path = xl/media/image2.emf
Source: A2B30000.0.dr	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: A2B30000.0.dr	Initial sample: OLE zip file path = xl/drawings/_rels/vmlDrawing2.vml.rels
Source: A2B30000.0.dr	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: Equations.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.6.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.6.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.6.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.6.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.6.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.6.dr	Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.6.dr	Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.6.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.6.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.6.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.6.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.6.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.6.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Element design set.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.6.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.6.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.6.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.6.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.6.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.6.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: ~WRD0000.tmp.6.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0000.tmp.6.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0000.tmp.6.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0000.tmp.6.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: ~WRD0000.tmp.6.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0000.tmp.6.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File dump: morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat[1].doc.0.dr			Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	File dump: 3F2CFC35.doc.6.dr			Jump to dropped file

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	13 Exploitation for Client Execution	1 Scripting	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	1 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	11%	ReversingLabs	Document-Excel.Trojan.Heuristic
SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	11%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3F2CFC35.doc	100%	Avira	HEUR/Rtf.Malformed
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat[1].doc	100%	Avira	HEUR/Rtf.Malformed

Source	Detection	Scanner	Link
wheel.to	8%	Virustotal	Browse
part-0013.t-0009.t-msedge.net	0%	Virustotal	Browse
windowsupdatebg.s.llnwi.net	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://wheel.to/IOGg52	100%	Avira URL Cloud	phishing
http://23.95.60.77/morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat.doc	0%	Avira URL Cloud	safe
http://wheel.to/IOGg52	100%	Avira URL Cloud	phishing
http://23.95.60.77/morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat.doc	10%	Virustotal		Browse
https://wheel.to/IOGg52	8%	Virustotal		Browse
http://wheel.to/IOGg52	8%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
wheel.to	76.76.21.21	true	true	8%, Virustotal, Browse	unknown
part-0013.t-0009.t-msedge.net	13.107.213.41	true	false	0%, Virustotal, Browse	unknown
windowsupdatebg.s.llnwi.net	69.164.42.0	true	false	0%, Virustotal, Browse	unknown

Name	Malicious	Antivirus Detection	Reputation
http://23.95.60.77/morningworkingforgetbackwithentireprocessgetmebacktomesheisverydetailedinprojectgetunderstand___sheisverybeautifulsheisgreat.doc	false	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://wheel.to/IOGg52	false	8%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://wheel.to/IOGg52	false	8%, Virustotal, Browse Avira URL Cloud: phishing	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.213.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.95.60.77	unknown	United States	36352	AS-COLOCROSSINGUS	false
76.76.21.21	wheel.to	United States	16509	AMAZON-02US	true

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431821
Start date and time:	2024-04-25 20:43:29 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx
Detection:	MAL
Classification:	mal100.expl.evad.winXLSX@6/276@1/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.213.41	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM
13.107.213.41	http://www.serviceadg.com	Get hash	malicious	Unknown	Browse	fr.linkedin.com/company/service-adg
23.95.60.77	PURCHASE ORDER LIST GREEN VALLY CORP PDF.bat	Get hash	malicious	GuLoader	Browse	23.95.60.77/rCesEMZzXCbmuxRAJxwefbC103.bin
	768.xla.xlsx	Get hash	malicious	Unknown	Browse	23.95.60.77/morninggreatformonkeykingtounderstandtheyfeelingtheloveandsxentirethingswhichneverbreakupallthingsfromtheheart___shemygirlmywifesheismy.doc
	Comprobante.xlam.xlsx	Get hash	malicious	GuLoader	Browse	23.95.60.77/qVXzm4.bin
76.76.21.21	http://beinggiant.com	Get hash	malicious	Unknown	Browse	beinggiant.com/
	http://win11-react.cf	Get hash	malicious	Unknown	Browse	win11-react.cf/
	Ziraat_Bankasi_Swift_Mesaji.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.destra-robotics.com/mi62/?iP=X7sx3i1Ab434oFeTDVtB3kGRQipHFuX+UTAC0dv+6NDVZAWmcjus4IA+C0kGOebkZnQ9&8pSDv=D2M8ARg8vVq
	Artwork02.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.destra-robotics.com/mi62/?ItY=X7sx3i1Ab434oFeTDVtB3kGRQipHFuX+UTAC0dv+6NDVZAWmcjus4IA+C0kGOebkZnQ9&2doHs=CVVXAr1
	JLQaqTFNY1.exe	Get hash	malicious	FormBook	Browse	www.dreadfullstack.com/m42i/?c8Rx=7nmLJX2PVJ&Z0DtHJC=Jf7bYnKYKQSD/52hqOLoUwjLIXWlaqP60BxocvJ9K62wAX0oNIdtnpVSteaW5gpKzmMM
	http://fulcat-great-fhhg.com	Get hash	malicious	Unknown	Browse	fulcat-great-fhhg.com/
	triage_dropped_file.exe	Get hash	malicious	FormBook	Browse	www.creaminpasteleria.com/tu0h/?7n=eCfBMGL7emdVc1/Z6Ze20091N00hvJYU2vnd6IKTdBbdTleiPfcGWn+F/Q1la8de24nO&Sj=9rXH
	HAN1zw41rv.exe	Get hash	malicious	FormBook	Browse	www.phat.party/g4df/?vZa4I0=dQ59erbNAkRh3b75Sk4rOJLbywWsnFtsG0yewk/E12+3itcVqYBfHLUFXESHH8eohK3r&2dah=SV4HW
	Swift Copy_44000.exe	Get hash	malicious	FormBook	Browse	www.mineriasinmercurio.com/e8ia/?6lpPFF=W+7QGxa6/YJJ8vOf3pRbxspY8wiP2DnlT2j2aRAg7f1DhM2EO0SKZOf4cf8Zc/S5YLxq&z6a=u0GHtXSheTdPL

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
windowsupdatebg.s.llnwi.net	http://185.172.128.63/v8sjh3hs8/index.php	Get hash	malicious	Unknown	Browse	69.164.42.0
	KMj8h32vWy.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	69.164.42.0
	http://womenofgoodworks-my.sharepoint.com/:b:/g/personal/tia_womenofgoodworks_org/EVICmRtg-CVNtsngkb8KQlgBH2LYVfumjH5s-SFbeQjN_Q	Get hash	malicious	HTMLPhisher	Browse	68.142.107.4
	New DHL Shipment Document Arrival Notice.pdf.exe	Get hash	malicious	AgentTesla	Browse	68.142.107.4
	GHY7L7VaOL.exe	Get hash	malicious	Unknown	Browse	68.142.107.4
	https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html	Get hash	malicious	TechSupportScam	Browse	68.142.107.4
	4BfhCycV4B.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	69.164.42.0
	https://caringhearts.foundation/wp-includes/widgets/ogk25/ogk/index.php&c=E,1,PBioTuoqxXxVmzOkxu8MYhWQ9ZbRNVLGpsstSuC0GQ2jNcQlIpYbU0K6d3lwsaeoT17vAF7VpKXs0qg9O-hGnfKxM3skSa-Jn2VJH7kX1A,,&typo=1	Get hash	malicious	Unknown	Browse	68.142.107.4
	https://caringhearts.foundation/wp-includes/widgets/ogk25/ogk/index.php&c=E,1,PBioTuoqxXxVmzOkxu8MYhWQ9ZbRNVLGpsstSuC0GQ2jNcQlIpYbU0K6d3lwsaeoT17vAF7VpKXs0qg9O-hGnfKxM3skSa-Jn2VJH7kX1A,,&typo=1	Get hash	malicious	Unknown	Browse	69.164.46.128
	CR-FEDEX_TN-775537409198_Doc.vbs	Get hash	malicious	Unknown	Browse	69.164.46.0
part-0013.t-0009.t-msedge.net	https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	http://www.mh3solaroh.com/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	[EXTERNAL] New file received.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://1drv.ms/o/s!AmFI0faGJpjZhESzK-ltQ-Z_UHmf?e=0OfhLS	Get hash	malicious	Unknown	Browse	13.107.213.41
	http://confirmartucuentamsnaquimx.hstn.me/login.live.com_login_verify_credentials_outlook.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://pub-839300a9c6054ed7b1c425122a9dd984.r2.dev/doc.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	https://u44058082.ct.sendgrid.net/ls/click?upn=u001.wjMLvmoK1OC9dTKy5UL4VbqcIJmZWkGKJypB0ZF6j6rXk8HVnxe0g2af-2BenroUoONz6EEWthgE-2Bi2vVRUosKTZRVQ5v63hCdxrdKCztVooIv51imK8tr-2Bb3beAsH6u-2FNluJlUKmd7nST-2B9m-2Bl2Rgv4y6uHLimO0TjhZzZ-2F-2BDlllJQne3tT99z6x4W12pJpddTL-2BoJ2-2Bdo6961pFN3dV2Rg-3D-3DeWGT_h-2FW4DSvZGhKY-2FmU3Rq-2F3L-2FXo2OZSHdaVvlpgAgHQWDXPYB9CNYi-2FcvonFCbsEhjt9RP-2BQa7dTwbMJOOaP3JRnMW6mQAitl6qAb1EkaAR-2BmnZDE6Bi3ooqtCrrMW-2F3TPNMK3AVi1YKIdTOZivmUJGaXdrtbqCykfnTTkN9KMRy80rdRqf6LWUCYWGeeaXb-2BD6jokMbr-2FaJKvKMHDNWAfHyhaE6QO9pw7souFUseKb40g-3D	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	KxgGGaiW3E.exe	Get hash	malicious	Quasar	Browse	13.107.213.41
	EXTERNAL Bonnie St Dryden is inviting you to collaborate on One_docx(Apr 23) DOC3848493.msg	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
wheel.to	P.O.27000446.docx.doc	Get hash	malicious	Remcos	Browse	76.76.21.21

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6271f898ce5be7dd52b0fc260d0662b3	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/yjyo8q/bWFyaWEud29qY2llY2hvd3NraUBjby5tb25tb3V0aC5uai51cw==	Get hash	malicious	HTMLPhisher	Browse	76.76.21.21
	http://wsj.pm	Get hash	malicious	NetSupport RAT	Browse	76.76.21.21
	https://itniy4gbb.cc.rs6.net/tn.jsp?f=001DpCT81a7BIE926OduG6KmKkwKebSAbUZq28C52DoY-FfQJyM_2Gq3l18V1j7KWwJQTfGlQ_HSq0vC8xqJqFST9z0CwmpWgUieBjKckdJcSODJ_3vu5MzvaSoOGbGY9SjpWQtg9-aAXm1e6VV91z84Q2_wlyDMR98&c=i37ZFF5Dy2QSFqOfb2TVpr5vkMFqaR6DdoQbIhzcRV7G2oFwX8NEvA==&ch=2ErEiCYnoykaXa1uoD0AgTD1vOpSqc6zh3ef32Gb4XR_ut8_qvmzHA==&c=&ch=&__=/mrlZp0zmTKgGvsPpx0JUyCMjGZr4J6/Z2dvbnphbGV6c2FsYXNAc2FuaXRhcy5lcw==	Get hash	malicious	HTMLPhisher	Browse	76.76.21.21
	http://learningstudio.ai	Get hash	malicious	Unknown	Browse	76.76.21.21
	FW_ FHAS Inc_ - Private and Confidential.msg	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	76.76.21.21
	https://stake.libertariancounterpoint.com/+6N67YCBGYSfgUDfzZBWz4mBQM+X0RyGi80NjJ/FF4eJwViQ	Get hash	malicious	Unknown	Browse	76.76.21.21
	https://funcallback.com	Get hash	malicious	Unknown	Browse	76.76.21.21
	Payment MT103.xls	Get hash	malicious	Unknown	Browse	76.76.21.21
	PO#0023298413.xls	Get hash	malicious	Unknown	Browse	76.76.21.21
	Ref_Order04.xls	Get hash	malicious	Unknown	Browse	76.76.21.21
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	RisePro Stealer	Browse	76.76.21.21 13.107.213.41
	file.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer, zgRAT	Browse	76.76.21.21 13.107.213.41
	SecuriteInfo.com.Win32.Evo-gen.19638.13648.exe	Get hash	malicious	DBatLoader	Browse	76.76.21.21 13.107.213.41
	file.exe	Get hash	malicious	LummaC	Browse	76.76.21.21 13.107.213.41
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	76.76.21.21 13.107.213.41
	file.exe	Get hash	malicious	LummaC	Browse	76.76.21.21 13.107.213.41
	Iu4csQ2rwX.msi	Get hash	malicious	AsyncRAT	Browse	76.76.21.21 13.107.213.41
	o7b91j8vnJ.exe	Get hash	malicious	LummaC	Browse	76.76.21.21 13.107.213.41
	SHEOrder-10524.exe	Get hash	malicious	Remcos, DBatLoader	Browse	76.76.21.21 13.107.213.41
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	76.76.21.21 13.107.213.41
37f463bf4616ecd445d4a1937da06e19	SecuriteInfo.com.Win32.Malware-gen.9746.16728.exe	Get hash	malicious	FormBook, GuLoader	Browse	76.76.21.21
	ProconGO1121082800.LnK.lnk	Get hash	malicious	Unknown	Browse	76.76.21.21
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	76.76.21.21
	Version.125.7599.75.js	Get hash	malicious	SocGholish	Browse	76.76.21.21
	Database4.exe	Get hash	malicious	Unknown	Browse	76.76.21.21
	lzShU2RYJa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	76.76.21.21
	XV9q6mY4DI.exe	Get hash	malicious	Babuk, Djvu	Browse	76.76.21.21
	n8XBpFdVFU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	76.76.21.21
	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	76.76.21.21
	Swift Payment.bat	Get hash	malicious	AgentTesla, GuLoader	Browse	76.76.21.21

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.456121169893329
Encrypted:	false
SSDEEP:	6:kKp8y5iJFN+SkQlPlEGYRMY9z+s3Ql2DUevat:BnkPlE99SCQl2DUevat
MD5:	5F22C42D899E17294B9144FEEF5B63C3
SHA1:	EA2C1598ADF2786A760C70721CECC19B0708E7D9
SHA-256:	C2B9F71726D5DE58E7E1FDCE8A5AE33CE43B1D9A65440B5F3E679C486C30ABD2
SHA-512:	363D3CF9B29A63C95C058CC57E0C9F0CF4EC24ED60A3ACE30ADB9E5BAE60E27D0765F0F84559C4233A954BC3DE303A7EBA271BCBA877A400BF9E6028F54DFDBA
Malicious:	false
Reputation:	low
Preview:	p...... ...........@...(...............................................W...@... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectbronze.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectgalaxy.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectgold.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectlava.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectocean.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectrainbowglitter.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectrosegold.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectsilver.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\oart.json

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1945AD77.emf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\22D76EB3.emf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\2B484FC0.emf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3F2CFC35.doc

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\417F0BCE.emf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5C77AD9D.emf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\6A86F118.emf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B7132EE6.emf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\CC328CC1.emf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\FC46390C.emf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{396CDDC9-7EA9-42FD-A939-742396F648D6}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{1F86639B-C3D5-48FB-9979-754EEE70E8F1}.tmp

Windows Analysis Report
SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Apr 25 09:57:26 2024, Security: 1
Entropy (8bit):	6.933508040631662
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx
File size:	51'200 bytes
MD5:	7ecb32ab27106ae197b58938177bffe3
SHA1:	289ddfd262d770c15f1abdddae71a9159e5a40fc
SHA256:	b9c43834feaf98843ffe7bcd5d25829fdc00544433ccf003a19011997540996d
SHA512:	d220e1a510651e9532ba79ce8c196b97de3ff2ba13dbcb340867741706bbc2ca0aceb83e5ade76bb3fd854d051334ad6f50971b0c1852a754546bc2fda066c55
SSDEEP:	1536:j68FlIKAiHHlAU9snxfiOkIaKn7+4At7m:j68Fl/ArjxiOBaYn
TLSH:	3433CF15B345E818D152A9BA8DD9C0DFA22ABC51EE57C70B3580777F58393C28A07B1F
File Content Preview:	........................>......................................................................................................................................................................................................................................

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16T00:00:00Z
Last Saved Time:	2024-04-25T08:56:57Z
Creating Application:	Microsoft Excel
Security:	0

Document Code Page:	1252
Thumbnail Scaling Desired:	false
Company:
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x M @ . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 78 4d a3 40 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x M s . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 78 4d c5 73 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x M . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 78 4d 95 15 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x M l . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 78 4d 6c 81 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00