Edit tour

Windows Analysis Report
Royal Mail Inland Claim Form V1.3.xlsm

Overview

General Information

Sample name:	Royal Mail Inland Claim Form V1.3.xlsm
Analysis ID:	1632044
MD5:	f9d16b1f5f8124c76a57cb35ec189088
SHA1:	5342f13f9be7e6a990b65b845688b972a5f9dc6a
SHA256:	33a26b8911b3aaa0373d8f4b941b91892bd165c9f9a56f38c83bec7917bcd3e1
Tags:	xlsmuser-abuse_ch
Infos:

Detection

Score:	52
Range:	0 - 100
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Document contains an embedded VBA macro with suspicious strings

Detected non-DNS traffic on DNS port

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains an embedded VBA which might only executes on specific systems (country or language check)

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Classification

Process Tree

System is w11x64_office

EXCEL.EXE (PID: 2848 cmdline: "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: F9F7B6C42211B06E7AC3E4B60AA8FB77)

splwow64.exe (PID: 6176 cmdline: C:\Windows\splwow64.exe 12288 MD5: AF4A7EBF6114EE9E6FBCC910EC3C96E6)

EXCEL.EXE (PID: 1252 cmdline: "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\Royal Mail Inland Claim Form V1.3.xlsm" MD5: F9F7B6C42211B06E7AC3E4B60AA8FB77)

cleanup

Sigma Signatures

System Summary

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 13.107.246.67, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 2848, Protocol: tcp, SourceIp: 192.168.2.24, SourceIsIpv6: false, SourcePort: 63951

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.24, DestinationIsIpv6: false, DestinationPort: 63951, EventID: 3, Image: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 2848, Protocol: tcp, SourceIp: 13.107.246.67, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE, ProcessId: 2848, TargetFilename: C:\Users\user\Desktop\~$Royal Mail Inland Claim Form V1.3.xlsm

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: Screenshot id: 2	Joe Sandbox AI: Screenshot id: 2 contains prominent button: 'continue'
Source: Screenshot id: 3	Joe Sandbox AI: Screenshot id: 3 contains prominent button: 'continue'
Source: Screenshot id: 10	Joe Sandbox AI: Screenshot id: 10 contains prominent button: 'continue'

Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

Directory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files\Microsoft Office\root\vfs\System\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 13.107.246.67:443 -> 192.168.2.24:63952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.67:443 -> 192.168.2.24:63951 version: TLS 1.2

Source: global traffic

DNS query: name: otelrules.svc.static.microsoft

Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443

Source: global traffic	TCP traffic: 192.168.2.24:57141 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 1.1.1.1:53 -> 192.168.2.24:57141
Source: global traffic	TCP traffic: 192.168.2.24:57141 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.24:57141 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 1.1.1.1:53 -> 192.168.2.24:57141
Source: global traffic	TCP traffic: 192.168.2.24:63938 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 1.1.1.1:53 -> 192.168.2.24:63938
Source: global traffic	TCP traffic: 192.168.2.24:63938 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.24:63938 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 1.1.1.1:53 -> 192.168.2.24:63938
Source: global traffic	TCP traffic: 1.1.1.1:53 -> 192.168.2.24:57141
Source: global traffic	TCP traffic: 192.168.2.24:57141 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 1.1.1.1:53 -> 192.168.2.24:57141
Source: global traffic	TCP traffic: 192.168.2.24:57141 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 1.1.1.1:53 -> 192.168.2.24:63938
Source: global traffic	TCP traffic: 192.168.2.24:63938 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.24:63938 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 1.1.1.1:53 -> 192.168.2.24:63938
Source: global traffic	TCP traffic: 192.168.2.24:63938 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63951
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63952
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63951
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63952
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63952
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63952
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63952
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63952
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63951
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63951
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63951
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63951
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63952
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63952
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63952
Source: global traffic	TCP traffic: 192.168.2.24:63952 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63952
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63951
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63951
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63951
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63951
Source: global traffic	TCP traffic: 192.168.2.24:63951 -> 13.107.246.67:443
Source: global traffic	TCP traffic: 13.107.246.67:443 -> 192.168.2.24:63951

Source: global traffic	TCP traffic: 192.168.2.24:57141 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.24:63938 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 13.107.246.67 13.107.246.67

Source: Joe Sandbox View

JA3 fingerprint: 258a5a1e95b8a911872bae9081526644

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /rules/rule170146v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.18129; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120201v19s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.18129; Pro)Host: otelrules.svc.static.microsoft

Source: global traffic

DNS traffic detected: DNS query: otelrules.svc.static.microsoft

Source: Primary1741370215491905600_0EE3EFB0-A6F1-4351-A3EB-3FF26CC45DFF.log.18.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626/en-US/en-CH.en-US/Metadata
Source: Primary1741370090067167200_A2BC7F7D-C10F-4FB9-8C9C-0E06D4C27602.log.0.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40/flatfontassets.pkg

Source: unknown	Network traffic detected: HTTP traffic on port 63951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63952

Source: unknown	HTTPS traffic detected: 13.107.246.67:443 -> 192.168.2.24:63952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.67:443 -> 192.168.2.24:63951 version: TLS 1.2

System Summary

Document contains an embedded VBA macro with suspicious strings

Source: Royal Mail Inland Claim Form V1.3.xlsm	OLE, VBA macro line: Sheets("CONTROL").Range("F22").Value = Environ("USERNAME")
Source: 32160000.0.dr	OLE, VBA macro line: Sheets("CONTROL").Range("F22").Value = Environ("USERNAME")

Source: Royal Mail Inland Claim Form V1.3.xlsm	OLE, VBA macro line: Private Sub Workbook_Open()
Source: 32160000.0.dr	OLE, VBA macro line: Private Sub Workbook_Open()

Source: Royal Mail Inland Claim Form V1.3.xlsm	OLE indicator, VBA macros: true
Source: ~DFA7EE61036CE425FA.TMP.0.dr	OLE indicator, VBA macros: true
Source: 32160000.0.dr	OLE indicator, VBA macros: true
Source: ~DFC708928A9F743D2A.TMP.18.dr	OLE indicator, VBA macros: true
Source: ~DF7387C9515645B4B0.TMP.18.dr	OLE indicator, VBA macros: true

Source: ~DFB4BC96AE9E6228B2.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DF3A3F41CBA993218B.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DFA7EE61036CE425FA.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DF648CC526AB4166A1.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DF362117FD176B7F1A.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DFC708928A9F743D2A.TMP.18.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DF7387C9515645B4B0.TMP.18.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal52.expl.evad.winXLSM@4/24@1/1

Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Royal Mail Inland Claim Form V1.3.xlsm

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{A2BC7F7D-C10F-4FB9-8C9C-0E06D4C27602} - OProcSessId.dat

Jump to behavior

Source: Royal Mail Inland Claim Form V1.3.xlsm	OLE indicator, Workbook stream: true
Source: 32160000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknown	Process created: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\Royal Mail Inland Claim Form V1.3.xlsm"
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\CLSID\{AC9F2F90-E877-11CE-9F68-00AA00574A4F}\InprocServer32

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/worksheets/sheet5.xml
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/worksheets/sheet6.xml
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/worksheets/sheet7.xml
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/worksheets/sheet8.xml
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/drawings/_rels/drawing4.xml.rels
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/media/image1.png
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/drawings/_rels/drawing5.xml.rels
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/drawings/drawing2.xml
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/media/image2.png
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/media/image3.png
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet8.xml.rels
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/drawings/drawing3.xml
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/media/image4.png
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/drawings/drawing4.xml
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/media/image5.png
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/drawings/drawing5.xml
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/media/image6.png
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet3.xml.rels
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet4.xml.rels
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet5.xml.rels
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet6.xml.rels
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet7.xml.rels
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/drawings/_rels/drawing2.xml.rels
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/drawings/_rels/drawing3.xml.rels
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings6.bin
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = docProps/custom.xml
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings5.bin
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings4.bin
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings7.bin
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/comments1.xml
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings8.bin
Source: Royal Mail Inland Claim Form V1.3.xlsm	Initial sample: OLE zip file path = xl/calcChain.xml
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/worksheets/sheet5.xml
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/worksheets/sheet6.xml
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/worksheets/sheet7.xml
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/worksheets/sheet8.xml
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/drawings/_rels/drawing4.xml.rels
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/media/image1.png
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/drawings/_rels/drawing5.xml.rels
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/drawings/drawing2.xml
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/media/image2.png
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/media/image3.png
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet8.xml.rels
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/drawings/drawing3.xml
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/media/image4.png
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/drawings/drawing4.xml
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/media/image5.png
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/drawings/drawing5.xml
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/media/image6.png
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet3.xml.rels
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet4.xml.rels
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet5.xml.rels
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet6.xml.rels
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet7.xml.rels
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/drawings/_rels/drawing2.xml.rels
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/drawings/_rels/drawing3.xml.rels
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/printerSettings/printerSettings6.bin
Source: 32160000.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/printerSettings/printerSettings5.bin
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/printerSettings/printerSettings4.bin
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/printerSettings/printerSettings7.bin
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/comments1.xml
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/printerSettings/printerSettings8.bin
Source: 32160000.0.dr	Initial sample: OLE zip file path = xl/calcChain.xml

Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

Directory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files\Microsoft Office\root\vfs\System\MSVCR100.dll

Jump to behavior

Source: ~DFB4BC96AE9E6228B2.TMP.0.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: ~DFA7EE61036CE425FA.TMP.0.dr	Stream path 'VBA/RibbonX_Code' : Culture = Application.International(xlUICultureTag) sShe
Source: ~DFC708928A9F743D2A.TMP.18.dr	Stream path 'VBA/RibbonX_Code' : Culture = Application.International(xlUICultureTag) sShe
Source: ~DF7387C9515645B4B0.TMP.18.dr	Stream path 'VBA/RibbonX_Code' : Culture = Application.International(xlUICultureTag) sShe

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 1606

Jump to behavior

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Source: 32160000.0.dr

OLE indicator, VBA stomping: true

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	12 Scripting	Valid Accounts	3 Exploitation for Client Execution	1 Browser Extensions	1 Process Injection	3 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	12 Scripting	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Obfuscated Files or Information	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Royal Mail Inland Claim Form V1.3.xlsm	3%	Virustotal		Browse
Royal Mail Inland Claim Form V1.3.xlsm	3%	ReversingLabs

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false	high
a726.dscd.akamai.net	2.22.242.9	true	false	high
s-0005.dual-s-msedge.net	52.123.128.14	true	false	high
s-part-0039.t-0009.t-msedge.net	13.107.246.67	true	false	high
otelrules.svc.static.microsoft	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://otelrules.svc.static.microsoft/rules/rule170146v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule120201v19s19.xml	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
13.107.246.67	s-part-0039.t-0009.t-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1632044
Start date and time:	2025-03-07 18:53:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Royal Mail Inland Claim Form V1.3.xlsm
Detection:	MAL
Classification:	mal52.expl.evad.winXLSM@4/24@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xlsm Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active Picture Object Active Picture Object Active Picture Object Active Picture Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, sppsvc.exe, SystemSettingsBroker.exe, SIHClient.exe, appidcertstorecheck.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46, 52.109.68.129, 52.111.227.28, 20.42.73.31, 217.20.57.18, 2.22.242.106, 2.22.242.88, 2.22.242.96, 52.111.243.81, 40.79.167.8, 23.60.203.209, 2.22.242.9, 52.123.128.14, 20.190.160.66, 172.202.163.200
Excluded domains from analysis (whitelisted): us1.odcsm1.live.com.akadns.net, odc.officeapps.live.com, slscr.update.microsoft.com, res-1.cdn.office.net, eur.roaming1.live.com.akadns.net, onedscolprdeus21.eastus.cloudapp.azure.com, mobile.events.data.microsoft.com, roaming.officeapps.live.com, dual-s-0005-office.config.skype.com, login.live.com, teams-staticscdn.trafficmanager.net, frc-azsc-000.roaming.officeapps.live.com, officeclient.microsoft.com, c.pki.goog, wu-b-net.trafficmanager.net, osiprod-cus-bronze-azsc-000.centralus.cloudapp.azure.com, statics.teams.cdn.office.net, enrichment.osi.office.net, ecs.office.com, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, prod.configsvc1.live.com.akadns.net, onedscolprdaue02.australiaeast.cloudapp.azure.com, osiprod-frc-buff-azsc-000.francecentral.cloudapp.azure.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, res-stls-prod.edgesuite.net, cus-azsc-000.odc.officeapps.live.com, fe3cr.delivery.mp.microsoft.com, res-prod.trafficmanager.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtSetValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:55:52	API Interceptor	1632x Sleep call for process: splwow64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
13.107.246.67	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse
	desaremix.exe	Get hash	malicious	KillMBR	Browse
	AccountFactuur8472.xlsm	Get hash	malicious	KnowBe4	Browse
	RFQ-JC25-#595837.xlsx	Get hash	malicious	Unknown	Browse
	https://onedrive.live.com/redir?resid=5BFC62F3074C4120%21116&authkey=%21AOd_yBhC51KgUHc&page=View&wd=target%28Quick%20Notes.one%7C3c69d085-3af0-472e-a78d-4a68e797d5be%2FLOEB%7C8799eb25-cf12-4e70-a243-200cc3374b83%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse
	Model - 2024 - Azure Model Template 3.26.xlsm	Get hash	malicious	Unknown	Browse
	https://wallet.airqon.aero/	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	compressed.exe	Get hash	malicious	CobaltStrike	Browse
	https://outlook.office365.com/owa/?viewmodel=ReadMessageItemMW9A%3D&reserved=0	Get hash	malicious	Unknown	Browse
	https://wzxmoqsj.elementor.cloud/	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-0005.dual-s-msedge.net	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	52.123.128.14
	VALPESA7809034mex_2025.xls	Get hash	malicious	Unknown	Browse	52.123.129.14
	Confirmation number 0001592289.xls	Get hash	malicious	Unknown	Browse	52.123.129.14
	Confirmation number 0001592289.xls	Get hash	malicious	Unknown	Browse	52.123.128.14
	VALPESA7809034mex_2025.xls	Get hash	malicious	Unknown	Browse	52.123.129.14
	SWIFT COPY.xls	Get hash	malicious	Unknown	Browse	52.123.129.14
	Confirmation number 0001592289.xls	Get hash	malicious	Unknown	Browse	52.123.129.14
	VALPESA7809034mex_2025.xls	Get hash	malicious	Unknown	Browse	52.123.128.14
	SWIFT COPY.xls	Get hash	malicious	Unknown	Browse	52.123.128.14
a726.dscd.akamai.net	https://akronhousingorg.sharepoint.com/sites/akronhousing.org/_layouts/15/guestaccess.aspx?e=4%3ayoKuOs&at=9&share=ETxns0_uyAZOqbfnq1g451UBdlSB973uhVLb6tJxyt3tUQ	Get hash	malicious	Unknown	Browse	2.19.11.98
	Confirmation number 0001592289.xls	Get hash	malicious	Unknown	Browse	23.57.90.80
	VALPESA7809034mex_2025.xls	Get hash	malicious	Unknown	Browse	2.22.242.130
	SWIFT COPY.xls	Get hash	malicious	Unknown	Browse	2.22.242.114
	voice-recording-DBWONKGPCK-08-03-2025.htm	Get hash	malicious	HTMLPhisher	Browse	2.19.11.98
	Message.eml	Get hash	malicious	Unknown	Browse	2.22.242.112
	https://ciadetalentos-my.sharepoint.com/:f:/p/adriana_chaves/EqTZ0PzAjR5OoMm3nmR39gUBojA7JPoSfedlX-y9eIzOgQ?e=z1uDex	Get hash	malicious	Unknown	Browse	2.19.11.98
	05 BOIRON F 240700457 ORDEN 05 MAR 2025.xls	Get hash	malicious	Hidden Macro 4.0	Browse	2.22.242.112
	Quote 09052022-008_1.xlsx	Get hash	malicious	Unknown	Browse	2.22.242.122
	file.0xd10e5bd05bb0.0xd10e58feb750.DataSectionObject.CV.docm.docm	Get hash	malicious	Unknown	Browse	95.101.54.208
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	kDubrmi6B5.msi	Get hash	malicious	Metastealer	Browse	217.20.57.19
	Damage product 3.vbs	Get hash	malicious	AsyncRAT, Batch Injector, VenomRAT	Browse	217.20.57.34
	skf7iF4.bat	Get hash	malicious	Unknown	Browse	84.201.210.39
	ADFoyxP.exe	Get hash	malicious	KeyLogger, StormKitty, VenomRAT	Browse	84.201.210.39
	GGP_DOCUMENTO CITACION AUDIENCIA_GGP.svg	Get hash	malicious	AsyncRAT, DcRat	Browse	217.20.57.18
	HvEuiXibGt.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	217.20.57.35
	desaremix.exe	Get hash	malicious	KillMBR	Browse	217.20.57.35
	0891383_consultar4036.lNk.lnk	Get hash	malicious	Unknown	Browse	217.20.57.18
	Upd#U0430te.js	Get hash	malicious	Unknown	Browse	217.20.57.20
	QyA6MaTya1.exe	Get hash	malicious	LummaC Stealer	Browse	84.201.210.23
bg.microsoft.map.fastly.net	kDubrmi6B5.msi	Get hash	malicious	Metastealer	Browse	199.232.210.172
	Br6Dejo3eu.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.214.172
	Uy1xrVW6Fh.exe	Get hash	malicious	XWorm	Browse	199.232.214.172
	Damage product 3.vbs	Get hash	malicious	AsyncRAT, Batch Injector, VenomRAT	Browse	199.232.214.172
	a3mJZekUZC.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	ADFoyxP.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	Confirmation number 0001592289.xls	Get hash	malicious	Unknown	Browse	199.232.210.172
	SWIFT COPY.xls	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.214.172
	Update.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	52.109.28.47
	https://akronhousingorg.sharepoint.com/sites/akronhousing.org/_layouts/15/guestaccess.aspx?e=4%3ayoKuOs&at=9&share=ETxns0_uyAZOqbfnq1g451UBdlSB973uhVLb6tJxyt3tUQ	Get hash	malicious	Unknown	Browse	13.107.136.10
	ADFoyxP.exe	Get hash	malicious	Unknown	Browse	204.79.197.203
	VALPESA7809034mex_2025.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	Confirmation number 0001592289.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	SWIFT COPY.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://www.fedex.com/officebillingonline	Get hash	malicious	Unknown	Browse	52.189.16.172
	https://www.cake.me/s--6UFs8h4LqTXxVNSd0lsitA--/jay-stafford	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://www.cake.me/s--6UFs8h4LqTXxVNSd0lsitA--/jay-stafford	Get hash	malicious	Unknown	Browse	150.171.27.10

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
258a5a1e95b8a911872bae9081526644	Confirmation number 0001592289.xls	Get hash	malicious	Unknown	Browse	13.107.246.67
	VALPESA7809034mex_2025.xls	Get hash	malicious	Unknown	Browse	13.107.246.67
	SWIFT COPY.xls	Get hash	malicious	Unknown	Browse	13.107.246.67
	MITRE Enterprise ATTACK v16.1.xlsx	Get hash	malicious	Mimikatz	Browse	13.107.246.67
	05 BOIRON F 240700457 ORDEN 05 MAR 2025.xls	Get hash	malicious	Hidden Macro 4.0	Browse	13.107.246.67
	Quote 09052022-008_1.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.67
	AccountFactuur8472.xlsm	Get hash	malicious	KnowBe4	Browse	13.107.246.67
	RFQ-JC25-#595837.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.67
	Outstanding statement.xls	Get hash	malicious	Unknown	Browse	13.107.246.67
	SWIFT COPY.xls	Get hash	malicious	Unknown	Browse	13.107.246.67

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Additional\Additional1741370090085057700_A2BC7F7D-C10F-4FB9-8C9C-0E06D4C27602.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	8.112143835430977E-5
Encrypted:	false
SSDEEP:	3:Tuekk9NJtHFfs1XsExe/t:qeVJ8
MD5:	AFDEAC461EEC32D754D8E6017E845D21
SHA1:	5D0874C19B70638A0737696AEEE55BFCC80D7ED8
SHA-256:	3A96B02F6A09F6A6FAC2A44A5842FF9AEB17EB4D633E48ABF6ADDF6FB447C7E2
SHA-512:	CAB6B8F9FFDBD80210F42219BAC8F1124D6C0B6995C5128995F7F48CED8EF0F2159EA06A2CD09B1FDCD409719F94A7DB437C708D3B1FDA01FDC80141A4595FC7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Additional\Additional1741370090085706100_A2BC7F7D-C10F-4FB9-8C9C-0E06D4C27602.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Additional\Additional1741370215492847900_0EE3EFB0-A6F1-4351-A3EB-3FF26CC45DFF.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	8.112143835430977E-5
Encrypted:	false
SSDEEP:	3:Tuekk9NJtHFfs1XsExe/t:qeVJ8
MD5:	AFDEAC461EEC32D754D8E6017E845D21
SHA1:	5D0874C19B70638A0737696AEEE55BFCC80D7ED8
SHA-256:	3A96B02F6A09F6A6FAC2A44A5842FF9AEB17EB4D633E48ABF6ADDF6FB447C7E2
SHA-512:	CAB6B8F9FFDBD80210F42219BAC8F1124D6C0B6995C5128995F7F48CED8EF0F2159EA06A2CD09B1FDCD409719F94A7DB437C708D3B1FDA01FDC80141A4595FC7
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Additional\Additional1741370215493160300_0EE3EFB0-A6F1-4351-A3EB-3FF26CC45DFF.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Primary1741370090067167200_A2BC7F7D-C10F-4FB9-8C9C-0E06D4C27602.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	ASCII text, with very long lines (28739), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.22192265899885613
Encrypted:	false
SSDEEP:
MD5:	5EB92FCCBD5F871A10EC6963C58556DA
SHA1:	97546931762101AFF3508521275DFC66DCE64488
SHA-256:	21250D65BB762B177228C5A9416B408B9A82B01BF28A419335C9F3C4E0F5643D
SHA-512:	6738350A3C8402DFEAC715DFC451E265CCD8E3B0E45BD65E089E70FA9F71BC7427C7D9AF5799ECF7E518857770E28297C657B051F66E7573072462A9957E72CA
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..03/07/2025 17:54:50.083.EXCEL (0xB20).0x11E0.Microsoft Excel.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Experimentation.FeatureQueryBatched","Flags":33777005812056321,"InternalSequenceNumber":17,"Time":"2025-03-07T17:54:50.083Z","Data.Sequence":0,"Data.Count":128,"Data.Features":"[ { \"ID\" : 1, \"N\" : \"Microsoft.Office.Telemetry.TrackCPSWrites\", \"V\" : false, \"S\" : 1, \"P\" : 0, \"T\" : \"2025-03-07T17:54:49.5681265Z\", \"C\" : \"33\", \"Q\" : 0.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" : 1, \"N\" : \"Microsoft.Office.Telemetry.CPSMaxWrites\", \"V\" : 2, \"S\" : 1, \"P\" : 0, \"T\" : \"2025-03-07T17:54:49.5681265Z\", \"C\" : \"33\", \"Q\" : 0.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" : 1, \"N\" : \"Microsoft.Office.Word.UAEOnSafeModeEnabled\", \"V\" : true, \"S\" : 1, \"P\" : 0, \"T\" : \"2025-03-07T17:54:49.5681265Z\", \"C\" : \"\", \"Q\" : 7.0, \"M\" : 0, \"F\" : 5, \"G\" : \"Opt\" }, { \"ID\" : 1, \"N

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Primary1741370090067569100_A2BC7F7D-C10F-4FB9-8C9C-0E06D4C27602.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Primary1741370215491905600_0EE3EFB0-A6F1-4351-A3EB-3FF26CC45DFF.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	ASCII text, with very long lines (28874), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.20329534643128105
Encrypted:	false
SSDEEP:
MD5:	4B2840B44AF0252D8F5E6028727FA9F4
SHA1:	5649AF466D9E3DDFCC336BFCC01994243764B448
SHA-256:	4B9904E5959F98FF4F1E55F1BB399D813159010ACE372E34267FF1D68EE55F3E
SHA-512:	118310B1AD174CD3EC33204E6DA5E68AE008FA2C873B8E7921749A766F348A5EDEDB0A5517EBF631AA0719DF669CB1F6F2E3BACF28A2BDDEE3E73B36F8E4BA18
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..03/07/2025 17:56:55.507.EXCEL (0x4E4).0x1B54.Microsoft Excel.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Experimentation.FeatureQueryBatched","Flags":33777005812056321,"InternalSequenceNumber":19,"Time":"2025-03-07T17:56:55.507Z","Data.Sequence":0,"Data.Count":128,"Data.Features":"[ { \"ID\" : 1, \"N\" : \"Microsoft.Office.Telemetry.TrackCPSWrites\", \"V\" : false, \"S\" : 1, \"P\" : 0, \"T\" : \"2025-03-07T17:56:55.2885066Z\", \"C\" : \"33\", \"Q\" : 0.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" : 1, \"N\" : \"Microsoft.Office.Telemetry.CPSMaxWrites\", \"V\" : 2, \"S\" : 1, \"P\" : 0, \"T\" : \"2025-03-07T17:56:55.2885066Z\", \"C\" : \"33\", \"Q\" : 0.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" : 1, \"N\" : \"Microsoft.Office.Word.UAEOnSafeModeEnabled\", \"V\" : true, \"S\" : 1, \"P\" : 0, \"T\" : \"2025-03-07T17:56:55.2885066Z\", \"C\" : \"\", \"Q\" : 6.0, \"M\" : 0, \"F\" : 5, \"G\" : \"Opt\" }, { \"ID\" : 1, \"N

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Primary1741370215492347300_0EE3EFB0-A6F1-4351-A3EB-3FF26CC45DFF.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Excel8.0\MSForms.exd

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	230700
Entropy (8bit):	4.314020267947402
Encrypted:	false
SSDEEP:
MD5:	1E1B771EF8F957A8956696157757E019
SHA1:	6BF28FC00BB9750FF950383EBED5EA6AE45EA14B
SHA-256:	A51A37DEC78C46B92A7A77B8299ED5D2D612CA2396542CBAE8F2C945A56F9B1F
SHA-512:	568228A6B5AA43E858601C18F12E9B734122A29E9661A9D53EDF35C5ED645BB8177853C2155F2B1C89CB7ADC4D68E66BEFEE3F3D686AD7FBE196C71E57E98A73
Malicious:	false
Preview:	MSFT................Q................................%......$....... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0......*..\+...+..$,...,...,..P-...-......\|.......D/.../...0..p0...0..81...1...2..d2...2..,3...3...3..X4...4.. 5...5...5..L6...6...7..x7...7..@8...8...9..l9...9..4:...:...:..`;...;..(<...<...<..T=...=...>...>...>..H?...?...@..t@...@..<A...A...B..hB.......B..........L_...............r..4...........LX...............F..............<G...............s...............u..lL..............T...............P...........................(.......................................................

C:\Users\user\AppData\Local\Temp\~DF1A8AD45732C5A845.TMP

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF362117FD176B7F1A.TMP

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	410166
Entropy (8bit):	1.1426445330817094
Encrypted:	false
SSDEEP:
MD5:	658EDCB3F0BE117FD31D89241D9D08FF
SHA1:	EC55F48FFEFD848CEC41ED7F2F0E035FC3A592BA
SHA-256:	C25D17F2F7C099F7DFC2B459539A9227CB160F784E1DA38145AB4D6088350553
SHA-512:	DD0DB43CE1ADAAA889017E049646C9745B4C7663C859816A8A8F41648D69A3903256CF15158D7FF720B1D9005C6BF716A525FFE5F3582F3B0137ACF31A82F5DB
Malicious:	false
Preview:	......................>.......................................................r.......t.......v.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF3A3F41CBA993218B.TMP

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	491520
Entropy (8bit):	1.989373843456766
Encrypted:	false
SSDEEP:
MD5:	3460A32C24BC38851FB60B88B4303833
SHA1:	741AE2390D7BF8B62D4DCC62D1807DDE6536F676
SHA-256:	1F82696D1F70E0D997EE440BCF5D6A7AE7F7F32C0E6AF19BF8D1561D2D941F54
SHA-512:	5F7B08D830BB45036853822C0975235710EA2C1FB3F9692F6A15AA31E564B6A34240CA93C39EBA7A6346CFF8C302B96450650CC5AD16DFBEEA7162A0BB012788
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF648CC526AB4166A1.TMP

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.1464700112623651
Encrypted:	false
SSDEEP:
MD5:	72F5C05B7EA8DD6059BF59F50B22DF33
SHA1:	D5AF52E129E15E3A34772806F6C5FBF132E7408E
SHA-256:	1DC0C8D7304C177AD0E74D3D2F1002EB773F4B180685A7DF6BBE75CCC24B0164
SHA-512:	6FF1E2E6B99BD0A4ED7CA8A9E943551BCD73A0BEFCACE6F1B1106E88595C0846C9BB76CA99A33266FFEC2440CF6A440090F803ABBF28B208A6C7BC6310BEB39E
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF7387C9515645B4B0.TMP

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	3.884064834810101
Encrypted:	false
SSDEEP:
MD5:	54013078FE26A32069A569815AD18B37
SHA1:	75E644D6620767FFEA7EAC184C14B9FED92350F7
SHA-256:	52CE3CAFB46425369EDAA995AABD43FB2D89DC38AF0F1D1460019ED5656E4F2E
SHA-512:	28373758857F8975C573ADF854BB4FA236EAA14DE5661C179D1CD078021A2A1B5D70A6C241BC2EF22AB008E2E443B51E09ECC7B570E2875E6DBBCA140697CE28
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................'...........................$............... ...!..."...#...%.......&...(...:...)...*...+...,...-.../...7...0...1...2...3...4...5...6...8...A...9...;.......<...=...>...?...@...B...a...C...Q...E...F...G...H...I...J...K...L...M...N...O...P.......R...b...T...U...V...W...X...Y...Z...[...\...]...^..._...`...........c...d...e...f...................................................................................

C:\Users\user\AppData\Local\Temp\~DFA7EE61036CE425FA.TMP

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	3.8818359171090973
Encrypted:	false
SSDEEP:
MD5:	74F0BE2554B1B24AF664B1F42BA07CF2
SHA1:	901C61162E9CABCDC24D7D2F8D91F2A76B3ED803
SHA-256:	1D3D446C16A8DF17EF9BB740CAF1E182D6BC56F0D093E12BF2C4D7F2CB68252B
SHA-512:	29B69CB7315912E2AEC9F8EE2867FDC2EC4FE474DD2D13D49536A655060E92EA0FFE7BA7F430D0AB62CF15257CFAE666AD2379BF18086FF61792C8D63B63E596
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................'...........................$............... ...!..."...#...%.......&...(...:...)...*...+...,...-.../...7...0...1...2...3...4...5...6...8...A...9...;.......<...=...>...?...@...B...a...C...Q...E...F...G...H...I...J...K...L...M...N...O...P.......R...b...............................................................c...d...e...f...................................................................................

C:\Users\user\AppData\Local\Temp\~DFB4BC96AE9E6228B2.TMP

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.1850297286566964
Encrypted:	false
SSDEEP:
MD5:	EFB3B71DE05FAD61B49663373DA617BD
SHA1:	D8F1EA876497943387A94DA88015044BAE97DB7B
SHA-256:	1AAE512B0DE717F0976FD4D09BC89CD9E4F47627D9A89CC2F67C3AC37664E1D6
SHA-512:	363600F40A05AC6912C8C8AE15767DA05BF4DFE12A68CBBF641553B97B7B55E20172924579194BDDC93A262A8C94A908BE06948D1222AC97CCDB99D4B8394A7C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFC708928A9F743D2A.TMP

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	3.8824365778445524
Encrypted:	false
SSDEEP:
MD5:	8862E53A78524D24CEC4B7C05744ED87
SHA1:	77173E1944D87271D5EFCF765FB14839B1D1233D
SHA-256:	B7440EE8724475667BEFC4D19627CC0A86016A7A6BB1AD259EA6F3A3BC6FB132
SHA-512:	3E81D147E87A29DD9451E26DA5C429C3DD7938A02F0E5F92D3FE5283FFF872EE8EB19D3B3D1CECEBA922B321FD8C3619B897CC9C477EE7E3752C007B85629022
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................'...........................$............... ...!..."...#...%.......&...(...:...)...*...+...,...-.../...7...0...1...2...3...4...5...6...8...A...9...;.......<...=...>...?...@...B...a...C...Q...E...F...G...H...I...J...K...L...M...N...O...P.......R...b...............................................................c...d...e...f...................................................................................

C:\Users\user\AppData\Local\Temp\~DFD70EC483F49A2C64.TMP

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\32160000

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Microsoft Excel 2007+
Category:	modified
Size (bytes):	282606
Entropy (8bit):	7.765485343820964
Encrypted:	false
SSDEEP:
MD5:	5F58AD7E6D2618ECE1C371000050B8B5
SHA1:	C06891E1B986DE615135DFF4BE5BEAD1D6E4B5D1
SHA-256:	D3392132A431A9A271772C3A56DCC9F4D3D0E662C717F4D811261256C0DB6F5F
SHA-512:	8BA261F3B9732BBC859AB033D4C31E2A06B26CC021010F1ABBC96FDDAA87F415B09AE6F5E1DFC74B584FCCB270903888C8303EA314E4D0B5330F10BC42EA202E
Malicious:	false
Preview:	PK..........!.`,......i.......[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................WMs.0..w....k...m...9$..L.. ....k..........13....}..J.>.n.Fg+......\|.2..........5.0.[..,.....L..=m<`F........e.F`.<XZ..`D..a...1.~9.^q.l...1a....fb.cv......,...KTc&..J.HB....H.n6S..'...s..D.%@4:.A.cx..)1d\|/...W..$...........!...,...T...+Z.R.....>@....l.....T....0..\|......s..8H.-..XK.y.%..2.{+..hM(.+....yu.8...Sx...L*..:.{..cOt\|..=.q..._z...?.4..W..[G...(0n4....A..K..x.4..g..7v....;._..}...{.~.o..\|..t&9.<.H..

C:\Users\user\Desktop\32160000:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\Royal Mail Inland Claim Form V1.3.xlsm (copy)

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	282606
Entropy (8bit):	7.765485343820964
Encrypted:	false
SSDEEP:
MD5:	5F58AD7E6D2618ECE1C371000050B8B5
SHA1:	C06891E1B986DE615135DFF4BE5BEAD1D6E4B5D1
SHA-256:	D3392132A431A9A271772C3A56DCC9F4D3D0E662C717F4D811261256C0DB6F5F
SHA-512:	8BA261F3B9732BBC859AB033D4C31E2A06B26CC021010F1ABBC96FDDAA87F415B09AE6F5E1DFC74B584FCCB270903888C8303EA314E4D0B5330F10BC42EA202E
Malicious:	true
Preview:	PK..........!.`,......i.......[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................WMs.0..w....k...m...9$..L.. ....k..........13....}..J.>.n.Fg+......\|.2..........5.0.[..,.....L..=m<`F........e.F`.<XZ..`D..a...1.~9.^q.l...1a....fb.cv......,...KTc&..J.HB....H.n6S..'...s..D.%@4:.A.cx..)1d\|/...W..$...........!...,...T...+Z.R.....>@....l.....T....0..\|......s..8H.-..XK.y.%..2.{+..hM(.+....yu.8...Sx...L*..:.{..cOt\|..=.q..._z...?.4..W..[G...(0n4....A..K..x.4..g..7v....;._..}...{.~.o..\|..t&9.<.H..

C:\Users\user\Desktop\~$Royal Mail Inland Claim Form V1.3.xlsm

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4134958568691696
Encrypted:	false
SSDEEP:
MD5:	8B6F49EF043D1AF562C216108A13E0F2
SHA1:	0106337F6D46E83B30CA7C1563C3FC3AF4209AF3
SHA-256:	C80D5433620A06CF252C9489F9A46BA091A5DAA239AAC3A98DB918627DEFF314
SHA-512:	241592FDA43D686AF92D22B2B451C51E70B742A5C33FA94307613155906396A53501E05719DD568C3D3C8088B95B83D7E98393B3692EB4B01907FE8BD927E896
Malicious:	true
Preview:	.user ..M.a.o.g.a. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\~$0.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4134958568691696
Encrypted:	false
SSDEEP:
MD5:	8B6F49EF043D1AF562C216108A13E0F2
SHA1:	0106337F6D46E83B30CA7C1563C3FC3AF4209AF3
SHA-256:	C80D5433620A06CF252C9489F9A46BA091A5DAA239AAC3A98DB918627DEFF314
SHA-512:	241592FDA43D686AF92D22B2B451C51E70B742A5C33FA94307613155906396A53501E05719DD568C3D3C8088B95B83D7E98393B3692EB4B01907FE8BD927E896
Malicious:	false
Preview:	.user ..M.a.o.g.a. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	Microsoft Excel 2007+
Entropy (8bit):	7.760398953378891
TrID:	Excel Microsoft Office Open XML Format document with Macro (52504/1) 54.97% Excel Microsoft Office Open XML Format document (35004/1) 36.65% ZIP compressed archive (8000/1) 8.38%
File name:	Royal Mail Inland Claim Form V1.3.xlsm
File size:	288'925 bytes
MD5:	f9d16b1f5f8124c76a57cb35ec189088
SHA1:	5342f13f9be7e6a990b65b845688b972a5f9dc6a
SHA256:	33a26b8911b3aaa0373d8f4b941b91892bd165c9f9a56f38c83bec7917bcd3e1
SHA512:	21cfd78e7c9165676e57ca8934851b6c527fac1c52bae67b09dabca852f62662fbf649624bb23f678dc8623d6b5c298aba4007785a2caa4ece6ebbe1942de418
SSDEEP:	3072:K1lmOVJmyyIU02k27rD2SAphwxOw82KaD1e5LbOkghZyUEsxcGn/z2PqOjZoDKc:j2JmKU02k27rD2SAWKa0LmPD/2tWDKc
TLSH:	3C544B707608D671D3BC1D3D4C85099A27C6E88EE587072EB693E7DF63C53E0606EA4A
File Content Preview:	PK..........!.`,......i.......[Content_Types].xml ...(.........................................................................................................................................................................................................

File Icon


Icon Hash:	1d356664a4a09519

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "Royal Mail Inland Claim Form V1.3.xlsm"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Title:	Royal Mail Multi Claims Form - 11th April 2016
Author:	matthew.clapham@royalmail.com
Last Saved By:	Matt Clapham
Create Time:	2012-12-12T21:56:02Z
Last Saved Time:	2023-10-12T13:59:11Z
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Thumbnail Scaling Desired:	false
Company:	RMG
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	16.0300

Streams with VBA

VBA File Name: CALENDARFORM1, Stream Size: -1

General
Stream Path:	CALENDARFORM1
VBA File Name:	CALENDARFORM1
Stream Size:	-1
Data ASCII:
Data Raw:

VBA Code

Attribute VB_Name = "CALENDARFORM1"
Attribute VB_Base = "0{78DF55E3-E3FA-4BB6-A4C8-ECF27D58D424}{922567EE-D3F9-4FA1-AABF-F305F38DE12A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub Calendar_Click()
On Error GoTo DD
Sheets("GET STARTED").Range("C30").Value = Format(CALENDARFORM1.Calendar, "MM/DD/YYYY")
CALENDARFORM1.Hide
Exit Sub
DD:
MsgBox ("An error has occured, please input the First Date of Posting manually (DD/MM/YYYY), thank you!")
End Sub

VBA File Name: UserForm1, Stream Size: -1

General
Stream Path:	UserForm1
VBA File Name:	UserForm1
Stream Size:	-1
Data ASCII:
Data Raw:

VBA Code

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{E9FC1950-5955-4540-8EE9-20E8FF97B64C}{A37438F2-14D5-45FA-AED1-0BE85459E511}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub Image1_Click()
UserForm1.Hide

End Sub

VBA File Name: CALENDARFORM1, Stream Size: 1828

General
Stream Path:	VBA/CALENDARFORM1
VBA File Name:	CALENDARFORM1
Stream Size:	1828
Data ASCII:	. . . . . . . . . . . . . . L . . . . . . 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . ( . . . . . S P . . . . S . . . . . S . . . . . S . . . . . . . . . . . . 0 . { . 7 . 8 . D . F . 5 . 5 . E . 3 . - . E
Data Raw:	01 16 01 00 01 f0 00 00 00 88 03 00 00 d4 00 00 00 4c 02 00 00 ff ff ff ff 8f 03 00 00 33 05 00 00 00 00 00 00 01 00 00 00 d7 b8 13 01 00 00 ff ff 01 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "CALENDARFORM1"
Attribute VB_Base = "0{78DF55E3-E3FA-4BB6-A4C8-ECF27D58D424}{922567EE-D3F9-4FA1-AABF-F305F38DE12A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub Calendar_Click()
On Error GoTo DD
Sheets("GET STARTED").Range("C30").Value = Format(CALENDARFORM1.Calendar, "MM/DD/YYYY")
CALENDARFORM1.Hide
Exit Sub
DD:
MsgBox ("An error has occured, please input the First Date of Posting manually (DD/MM/YYYY), thank you!")
End Sub

VBA File Name: Module1, Stream Size: 1262

General
Stream Path:	VBA/Module1
VBA File Name:	Module1
Stream Size:	1262
Data ASCII:	. . . . . . . . . . . . . . . . . " . . . . . . . . . . . . . . . . , . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . 6 . . . . . . < . . . . . . . < . . . . . . . < . . . . . . . . . . . . . . . . . . . . . . . . . `
Data Raw:	01 16 01 00 06 f0 00 00 00 f4 02 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff 22 03 00 00 02 04 00 00 01 00 00 00 01 00 00 00 d7 b8 d7 2c 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 04 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Module1"
Sub ADDCOPY()
Attribute ADDCOPY.VB_Description = "Macro recorded 12/12/2012 by kevin.x.baker"
Attribute ADDCOPY.VB_ProcData.VB_Invoke_Func = " \n14"
Sheets("GET STARTED").Range("C21:C24").Value = Sheets("GET STARTED").Range("C7:C10").Value
End Sub

VBA File Name: Module2, Stream Size: 683

General
Stream Path:	VBA/Module2
VBA File Name:	Module2
Stream Size:	683
Data ASCII:	. . . . . . . . $ . . . . . . . . . + . . . . . . . . . . . . . . . . . N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 01 00 01 f0 00 00 00 24 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 2b 02 00 00 7f 02 00 00 00 00 00 00 01 00 00 00 d7 b8 0c 4e 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Module2"

VBA File Name: Module3, Stream Size: 14501

General
Stream Path:	VBA/Module3
VBA File Name:	Module3
Stream Size:	14501
Data ASCII:	. . . . . . . . . . . . . . . . . . . . # , . . . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . p . . . . . . . . . . . . . . . . . . . . . . . . * . . .
Data Raw:	01 16 01 00 01 f0 00 00 00 94 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 9b 02 00 00 23 2c 00 00 00 00 00 00 01 00 00 00 d7 b8 3d fc 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Module3"
Sub CHECK()
Attribute CHECK.VB_Description = "Macro recorded 13/12/2012 by kevin.x.baker"
Attribute CHECK.VB_ProcData.VB_Invoke_Func = " \n14"
Application.ScreenUpdating = False
If Sheets("CONTROL").Range("AA1").Value < 12 Then
    MsgBox "There are no claims on the claim form, please add claims before pressing this button"
Exit Sub
End If

Sheets("CONTROL").Range("F22").Value = Environ("USERNAME")

Sheets("CLAIM DETAILS").Range("D12:D1012").Replace What:=Chr(10), Replacement:=""
Sheets("CLAIM DETAILS").Range("D12:D1012").Replace What:=" ", Replacement:=""
Sheets("CLAIM DETAILS").Unprotect
'RESET
Sheets("CLAIM DETAILS").Range("B12:U" + CStr(Sheets("CONTROL").Range("AA1").Value)).Interior.ColorIndex = 0
For Each AACELL In Sheets("CLAIM DETAILS").Range("C12:C" + CStr(Sheets("CONTROL").Range("AA1").Value))
If AACELL.Value = "" Then
AACELL.Value = "Please Select"
End If
Next

'PRODUCT FIELD CHECK - CHECKS FOR BLANKS AS THIS FIELD IS NEEDED FOR OTHER CHECKS
For Each aCELL In Sheets("CLAIM DETAILS").Range("C12:C" + CStr(Sheets("CONTROL").Range("AA1").Value))
    If aCELL.Value = "Please Select" Then
    aCELL.Select
    aCELL.Interior.ColorIndex = 3
        If Range("T" & ActiveCell.Row).Value = "" Then
         aCELL.Interior.ColorIndex = 2
         GoTo 2
        Else
        MsgBox ("The PRODUCT USED is a mandatory field, please select a product to begin the basic checks.")
        Exit Sub
        End If
        End If
2:
Next

'MANDATORY FIELD CHECK - COLOURS BLANK FIELDS RED
'For Each BCELL In Sheets("CLAIM DETAILS").Range("E12:E212,K12:K212,N12:N212,O12:O212,P12:P212,R12:R212,T12:T212")
For Each BCELL In Sheets("CLAIM DETAILS").Range("E12:E" + CStr(Sheets("CONTROL").Range("AA1").Value))
    If BCELL.Value = "" Then
    BCELL.Select
        If Range("C" & ActiveCell.Row).Value = "Please Select" Then
        Else
        BCELL.Interior.ColorIndex = 3
        End If
    End If
Next
For Each BCELL In Sheets("CLAIM DETAILS").Range("K12:K" + CStr(Sheets("CONTROL").Range("AA1").Value))
    If BCELL.Value = "" Then
    BCELL.Select
        If Range("C" & ActiveCell.Row).Value = "Please Select" Then
        Else
        BCELL.Interior.ColorIndex = 3
        End If
    End If
Next
For Each BCELL In Sheets("CLAIM DETAILS").Range("N12:N" + CStr(Sheets("CONTROL").Range("AA1").Value))
    If BCELL.Value = "" Then
    BCELL.Select
        If Range("C" & ActiveCell.Row).Value = "Please Select" Then
        Else
        BCELL.Interior.ColorIndex = 3
        End If
    End If
Next
For Each BCELL In Sheets("CLAIM DETAILS").Range("O12:O" + CStr(Sheets("CONTROL").Range("AA1").Value))
    If BCELL.Value = "" Then
    BCELL.Select
        If Range("C" & ActiveCell.Row).Value = "Please Select" Then
        Else
        BCELL.Interior.ColorIndex = 3
        End If
    End If
Next
For Each BCELL In Sheets("CLAIM DETAILS").Range("P12:P" + CStr(Sheets("CONTROL").Range("AA1").Value))
    If BCELL.Value = "" Then
    BCELL.Select
        If Range("C" & ActiveCell.Row).Value = "Please Select" Then
        Else
        BCELL.Interior.ColorIndex = 3
        End If
    End If
Next
For Each BCELL In Sheets("CLAIM DETAILS").Range("R12:R" + CStr(Sheets("CONTROL").Range("AA1").Value))
    If BCELL.Value = "" Then
    BCELL.Select
        If Range("C" & ActiveCell.Row).Value = "Please Select" Then
        Else
        BCELL.Interior.ColorIndex = 3
        End If
    End If
Next
For Each BCELL In Sheets("CLAIM DETAILS").Range("T12:T" + CStr(Sheets("CONTROL").Range("AA1").Value))
    If BCELL.Value = "" Then
    BCELL.Select
        If Range("C" & ActiveCell.Row).Value = "Please Select" Then
        Else
        BCELL.Interior.ColorIndex = 3
        End If
    End If
Next


'MANDATORY FIELD CHECK FOR DESCRIPTION FIELD Q (NOT REQUIRED FOR DELAY AND SIGNATURE FAILURE) - COLOURS BLANK FIELDS RED
For Each BCELL In Sheets("CLAIM DETAILS").Range("Q12:Q" + CStr(Sheets("CONTROL").Range("AA1").Value))
    
     If BCELL.Offset(0, -12).Value = "Delay" Then
     GoTo NOTREQ
     End If
     If BCELL.Offset(0, -12).Value = "Signature Failure" Then
     GoTo NOTREQ
     End If
     
    If BCELL.Value = "" Then
    BCELL.Select
        If Range("C" & ActiveCell.Row).Value = "Please Select" Then
        Else
        BCELL.Interior.ColorIndex = 3
        End If
    End If
   
NOTREQ:
Next

'TITLE, FORENAME AND SURNAME ALL BLANK CHECK
For Each cCELL In Sheets("CLAIM DETAILS").Range("H12:H" + CStr(Sheets("CONTROL").Range("AA1").Value))
cCELL.Select

     If cCELL.Offset(0, -3).Value = "Delay" Then
     GoTo NOTREQ2
     End If
     If cCELL.Offset(0, -3).Value = "Signature Failure" Then
     GoTo NOTREQ2
     End If

If cCELL.Value = "" Then
If Range("C" & ActiveCell.Row).Value = "Please Select" Then
        Else
cCELL.Interior.ColorIndex = 3
End If

If cCELL.Offset(0, -1).Value = "" Then
If Range("C" & ActiveCell.Row).Value = "Please Select" Then
        Else
cCELL.Offset(0, -1).Interior.ColorIndex = 3
End If
End If
If cCELL.Offset(0, -2).Value = "" Then
If Range("C" & ActiveCell.Row).Value = "Please Select" Then
        Else
cCELL.Offset(0, -2).Interior.ColorIndex = 3
End If
End If
Else
If cCELL.Offset(0, -1).Value = "" Then
cCELL.Offset(0, -1).Interior.ColorIndex = 45
End If
If cCELL.Offset(0, -2).Value = "" Then
cCELL.Offset(0, -2).Interior.ColorIndex = 45
End If
End If
NOTREQ2:
Next

'THIS MOVES THE LINE OF INFO FOR EACH CLAIM TO THE CONTROL SHEET TO VALIDATE
For Each fcell In Sheets("CLAIM DETAILS").Range("B12:B" + CStr(Sheets("CONTROL").Range("AA1").Value))
fcell.Select
If Range("C" & ActiveCell.Row).Value = "Please Select" Then
Else
Sheets("CONTROL").Range("B30").Value = fcell.Value
Sheets("CONTROL").Range("C30").Value = fcell.Offset(0, 1).Value
Sheets("CONTROL").Range("D30").Value = fcell.Offset(0, 2).Value
Sheets("CONTROL").Range("E28").Value = fcell.Offset(0, 3).Value
Sheets("CONTROL").Range("F30").Value = fcell.Offset(0, 4).Value
Sheets("CONTROL").Range("G30").Value = fcell.Offset(0, 5).Value
Sheets("CONTROL").Range("H30").Value = fcell.Offset(0, 6).Value
Sheets("CONTROL").Range("I30").Value = fcell.Offset(0, 7).Value
Sheets("CONTROL").Range("J30").Value = fcell.Offset(0, 8).Value
Sheets("CONTROL").Range("K30").Value = fcell.Offset(0, 9).Value
Sheets("CONTROL").Range("L30").Value = fcell.Offset(0, 10).Value
Sheets("CONTROL").Range("M30").Value = fcell.Offset(0, 11).Value
Sheets("CONTROL").Range("N30").Value = fcell.Offset(0, 12).Value
Sheets("CONTROL").Range("O30").Value = fcell.Offset(0, 13).Value
Sheets("CONTROL").Range("P30").Value = fcell.Offset(0, 14).Value
Sheets("CONTROL").Range("Q30").Value = fcell.Offset(0, 15).Value
Sheets("CONTROL").Range("R30").Value = fcell.Offset(0, 16).Value
Sheets("CONTROL").Range("S30").Value = fcell.Offset(0, 17).Value
Sheets("CONTROL").Range("T30").Value = fcell.Offset(0, 18).Value
Sheets("CONTROL").Range("U30").Value = fcell.Offset(0, 19).Value
Sheets("CONTROL").Range("V30").Value = fcell.Offset(0, 20).Value


'THIS COLOURS THE CONTENTS COST PRICE CELL IF AMOUNT IS GREATER THAN THE PRODUCTS MAX CLAIM AMOUNT
If Sheets("CONTROL").Range("G5").Value = "Yes" Then
fcell.Offset(0, 17).Interior.ColorIndex = 12
Else
fcell.Offset(0, 17).Interior.ColorIndex = 2
End If
On Error GoTo XEX
'THIS COLOURS THE DATE OF POSTING CELL IF MIN REQUIRED NUMBER OF DAYS HAVE NOT BEEN MET TO CLAIM
If Sheets("CONTROL").Range("C11").Value = "Fail" Then
fcell.Offset(0, 14).Interior.ColorIndex = 7
Else
fcell.Offset(0, 14).Interior.ColorIndex = 2
End If

'THIS COLOURS THE DATE OF POSTING CELL IF DELAY CLAIM MORE THAN 14 DAYS
If Sheets("CONTROL").Range("C14").Value = "Fail" Then
fcell.Offset(0, 14).Interior.ColorIndex = 7
'7

End If

'THIS COLOURS THE DATE OF POSTING CELL IF CLAIM PERIOD HAS EXPIRED
If Sheets("CONTROL").Range("e5").Value = "Fail" Then
fcell.Offset(0, 14).Interior.ColorIndex = 7
End If
'SETS RECOMPENSE VALUE
fcell.Offset(0, 20).Value = Sheets("CONTROL").Range("I7").Value

'SETS ORIGINAL CLAIM AMOUNT
fcell.Offset(0, 22).Value = Sheets("CONTROL").Range("I5").Value - Sheets("CONTROL").Range("I7").Value

'SETS REASON VALUE
fcell.Offset(0, 21).Value = Sheets("CONTROL").Range("G14").Value

End If
Next

'16 = postage
'17 = cost
'18 = total claimed
'20 reompense
'21 reason


Sheets("CLAIM DETAILS").Range("B12").Select
'Sheets("CLAIM DETAILS").Protect DrawingObjects:=True, Contents:=True, Scenarios:=True

Application.ScreenUpdating = True
MsgBox ("The claims below have been checked.  Please check for any highlighted issues before submitting your claim. Use the Key button for more information on highlighted cells")
Exit Sub

XEX:
Application.ScreenUpdating = True
MsgBox ("Apologies, an error has been identified with the claim details.  Please check the Claim Details for errors, Many Thanks")


End Sub

VBA File Name: Module4, Stream Size: 11092

General
Stream Path:	VBA/Module4
VBA File Name:	Module4
Stream Size:	11092
Data ASCII:	. . . . . . . . . . . . . . . . . " . . . B " . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . 6 . . . . . . < . . . . . . . < . . . . . . . < . . . . . . . . . . . . . . . . . . . . . L . . . . `
Data Raw:	01 16 01 00 06 f0 00 00 00 f4 02 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff 22 03 00 00 42 22 00 00 01 00 00 00 01 00 00 00 d7 b8 f5 9b 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 04 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Module4"
Sub SIEBEL()
Attribute SIEBEL.VB_Description = "Macro recorded 16/12/2012 by kevin.x.baker"
Attribute SIEBEL.VB_ProcData.VB_Invoke_Func = " \n14"
Application.ScreenUpdating = False

'RESETS SIEBEL EXTRACT TAB TO BEGIN
Sheets("SIEBELFILE").Range("A2:AV350").Value = ""

'THIS MOVES THE LINE OF INFO FOR EACH CLAIM TO THE CONTROL SHEET
For Each CELL In Sheets("CLAIM DETAILS").Range("B10:B2009")
Sheets("CLAIM DETAILS").Select
CELL.Select
If Range("C" & ActiveCell.Row).Value = "Please Select" Then ''''NEEDS MORE WORK OR BETTER SOLUTION
        Else
Sheets("CONTROL").Range("B30").Value = CELL.Value
Sheets("CONTROL").Range("C30").Value = CELL.Offset(0, 1).Value
Sheets("CONTROL").Range("D30").Value = CELL.Offset(0, 2).Value
Sheets("CONTROL").Range("E28").Value = CELL.Offset(0, 3).Value
Sheets("CONTROL").Range("F30").Value = CELL.Offset(0, 4).Value
Sheets("CONTROL").Range("G30").Value = CELL.Offset(0, 5).Value
Sheets("CONTROL").Range("H30").Value = CELL.Offset(0, 6).Value
Sheets("CONTROL").Range("I30").Value = CELL.Offset(0, 7).Value
Sheets("CONTROL").Range("J30").Value = CELL.Offset(0, 8).Value
Sheets("CONTROL").Range("K30").Value = CELL.Offset(0, 9).Value
Sheets("CONTROL").Range("L30").Value = CELL.Offset(0, 10).Value
Sheets("CONTROL").Range("M30").Value = CELL.Offset(0, 11).Value
Sheets("CONTROL").Range("N30").Value = CELL.Offset(0, 12).Value
Sheets("CONTROL").Range("O30").Value = CELL.Offset(0, 13).Value
Sheets("CONTROL").Range("P30").Value = CELL.Offset(0, 14).Value
Sheets("CONTROL").Range("Q30").Value = CELL.Offset(0, 15).Value
Sheets("CONTROL").Range("R30").Value = CELL.Offset(0, 16).Value
Sheets("CONTROL").Range("S30").Value = CELL.Offset(0, 17).Value
Sheets("CONTROL").Range("T30").Value = CELL.Offset(0, 18).Value
Sheets("CONTROL").Range("u30").Value = CELL.Offset(0, 19).Value
Sheets("CONTROL").Range("v30").Value = CELL.Offset(0, 20).Value
Sheets("CONTROL").Range("W30").Value = CELL.Offset(0, 21).Value
Sheets("CONTROL").Range("X30").Value = CELL.Offset(0, 23).Value '22 IS SPARE

'CHECKS OUR REFERENCE FIELD FOR UPLOAD - EMPTY=TRUE, HAS A VALUE=FALSE
If Sheets("CONTROL").Range("X30").Value = "" Then
GoTo UPLOAD
Else
GoTo NONUPLOAD
End If

UPLOAD: '
'MOVES DATA FROM CONTROL TO SIEBEL EXTRACT TAB
If Sheets("SIEBELFILE").Range("A2").Value = "" Then

'THIS CHECKS FOR A BLANK FIRST ROW
Sheets("SIEBELFILE").Range("A2:AV2").Value = Sheets("CONTROL").Range("a33:av33").Value
Else
'THIS LOOKS FOR NEXT EMPTY ROW TO ADD DATA
Sheets("SIEBELFILE").Visible = True
Sheets("SIEBELFILE").Select
Sheets("SIEBELFILE").Range("A1").End(xlDown).Offset(1, 0).Select
ActiveCell.Value = Sheets("CONTROL").Range("A33").Value
ActiveCell.Offset(0, 1).Value = Sheets("CONTROL").Range("B33").Value
ActiveCell.Offset(0, 2).Value = Sheets("CONTROL").Range("C33").Value
ActiveCell.Offset(0, 3).Value = Sheets("CONTROL").Range("D33").Value
ActiveCell.Offset(0, 4).Value = Sheets("CONTROL").Range("E33").Value
ActiveCell.Offset(0, 5).Value = Sheets("CONTROL").Range("F33").Value
ActiveCell.Offset(0, 6).Value = Sheets("CONTROL").Range("G33").Value
ActiveCell.Offset(0, 7).Value = Sheets("CONTROL").Range("H33").Value
ActiveCell.Offset(0, 8).Value = Sheets("CONTROL").Range("I33").Value
ActiveCell.Offset(0, 9).Value = Sheets("CONTROL").Range("J33").Value
ActiveCell.Offset(0, 10).Value = Sheets("CONTROL").Range("K33").Value

ActiveCell.Offset(0, 11).Value = Sheets("CONTROL").Range("L33").Value
ActiveCell.Offset(0, 12).Value = Sheets("CONTROL").Range("M33").Value
ActiveCell.Offset(0, 13).Value = Sheets("CONTROL").Range("N33").Value
ActiveCell.Offset(0, 14).Value = Sheets("CONTROL").Range("O33").Value
ActiveCell.Offset(0, 15).Value = Sheets("CONTROL").Range("P33").Value
ActiveCell.Offset(0, 16).Value = Sheets("CONTROL").Range("Q33").Value
ActiveCell.Offset(0, 17).Value = Sheets("CONTROL").Range("R33").Value
ActiveCell.Offset(0, 18).Value = Sheets("CONTROL").Range("S33").Value
ActiveCell.Offset(0, 19).Value = Sheets("CONTROL").Range("T33").Value
ActiveCell.Offset(0, 20).Value = Sheets("CONTROL").Range("U33").Value

ActiveCell.Offset(0, 21).Value = Sheets("CONTROL").Range("V33").Value
ActiveCell.Offset(0, 22).Value = Sheets("CONTROL").Range("W33").Value
ActiveCell.Offset(0, 23).Value = Sheets("CONTROL").Range("X33").Value
ActiveCell.Offset(0, 24).Value = Sheets("CONTROL").Range("Y33").Value
ActiveCell.Offset(0, 25).Value = Sheets("CONTROL").Range("Z33").Value
ActiveCell.Offset(0, 26).Value = Sheets("CONTROL").Range("AA33").Value
ActiveCell.Offset(0, 27).Value = Sheets("CONTROL").Range("AB33").Value
ActiveCell.Offset(0, 28).Value = Sheets("CONTROL").Range("AC33").Value
ActiveCell.Offset(0, 29).Value = Sheets("CONTROL").Range("AD33").Value
ActiveCell.Offset(0, 30).Value = Sheets("CONTROL").Range("AE33").Value

ActiveCell.Offset(0, 31).Value = Sheets("CONTROL").Range("AF33").Value
ActiveCell.Offset(0, 32).Value = Sheets("CONTROL").Range("AG33").Value
ActiveCell.Offset(0, 33).Value = Sheets("CONTROL").Range("AH33").Value
ActiveCell.Offset(0, 34).Value = Sheets("CONTROL").Range("AI33").Value
ActiveCell.Offset(0, 35).Value = Sheets("CONTROL").Range("AJ33").Value
ActiveCell.Offset(0, 36).Value = Sheets("CONTROL").Range("AK33").Value
ActiveCell.Offset(0, 37).Value = Sheets("CONTROL").Range("AL33").Value
ActiveCell.Offset(0, 38).Value = Sheets("CONTROL").Range("AM33").Value
ActiveCell.Offset(0, 39).Value = Sheets("CONTROL").Range("AN33").Value
ActiveCell.Offset(0, 40).Value = Sheets("CONTROL").Range("AO33").Value

ActiveCell.Offset(0, 41).Value = Sheets("CONTROL").Range("AP33").Value
ActiveCell.Offset(0, 42).Value = Sheets("CONTROL").Range("AQ33").Value
ActiveCell.Offset(0, 43).Value = Sheets("CONTROL").Range("AR33").Value
ActiveCell.Offset(0, 44).Value = Sheets("CONTROL").Range("AS33").Value
ActiveCell.Offset(0, 45).Value = Sheets("CONTROL").Range("AT33").Value
End If
End If
NONUPLOAD:
Next

'CREATES SEPERATE TEMP FILE WITH SIEBEL EXTRACT INFORMATION
Application.ScreenUpdating = True
    Sheets("SIEBELFILE").Visible = True
Sheets("SIEBELFILE").Select
Sheets("SIEBELFILE").Range("A1:AT350").Select
    Selection.Copy
    Sheets("INTERNAL USE ONLY").Select
    Sheets("SIEBELFILE").Visible = False
    Workbooks.Add
       ActiveWorkbook.Windows(1).Caption = "SIEBEL Export file - Please Save and Rename!"
    Selection.PasteSpecial Paste:=xlValues, Operation:=xlNone, SkipBlanks:=         False, Transpose:=False
              ActiveSheet.Columns("R:S").Select
       Application.CutCopyMode = False
     Selection.NumberFormat = "dd/mm/yyyy"
'DELETE FIRST LINE OF SIEBEL DATA - THIS REMOVES THE PARENT CASE TO AVOID DUPLICATION
        'ActiveSheet.Rows("2:2").Select
  '  Selection.Delete Shift:=xlUp
         ActiveSheet.Range("A1").Select
       
MsgBox "You have successfullly extracted all validated claims to this temporary file." & vbNewLine & vbNewLine & "PLEASE RENAME AND SAVE IN THE APPROPRIATE FOLDER FOR PROCESSING, THANK YOU!", , "SIEBEL EXTRACT COMPLETE!"

End Sub

VBA File Name: Module5, Stream Size: 1085

General
Stream Path:	VBA/Module5
VBA File Name:	Module5
Stream Size:	1085
Data ASCII:	. . . . . . . . d . . . . . . . . . k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . . . . . < . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 . .
Data Raw:	01 16 01 00 01 f0 00 00 00 64 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 6b 02 00 00 9b 03 00 00 00 00 00 00 01 00 00 00 d7 b8 da 2e 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Module5"
Sub TESTER()
Sheets("CLAIM DETAILS").Range("D12:D1012").Replace What:=Chr(10), Replacement:=""
Sheets("CLAIM DETAILS").Range("D12:D1012").Replace What:=" ", Replacement:=""

End Sub

VBA File Name: Module6, Stream Size: 1126

General
Stream Path:	VBA/Module6
VBA File Name:	Module6
Stream Size:	1126
Data ASCII:	. . . . . . . . l . . . . . . . . . s . . . . . . . . . . . . . . . - . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . X . . . . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 01 00 01 f0 00 00 00 6c 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 73 02 00 00 ab 03 00 00 00 00 00 00 01 00 00 00 d7 b8 2d ec 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Module6"
Sub continue()
Attribute continue.VB_ProcData.VB_Invoke_Func = " \n14"
'
' continue Macro
'

'
    Range("R31").Select
    Sheets("CLAIM DETAILS").Select
End Sub

VBA File Name: Sheet1, Stream Size: 985

General
Stream Path:	VBA/Sheet1
VBA File Name:	Sheet1
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . ' . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
Data Raw:	01 16 01 00 01 f0 00 00 00 cc 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d3 02 00 00 27 03 00 00 00 00 00 00 01 00 00 00 d7 b8 ac ea 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2, Stream Size: 999

General
Stream Path:	VBA/Sheet2
VBA File Name:	Sheet2
Stream Size:	999
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . 3 . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
Data Raw:	01 16 01 00 01 f0 00 00 00 cc 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d3 02 00 00 33 03 00 00 00 00 00 00 01 00 00 00 d7 b8 fd e1 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3, Stream Size: 985

General
Stream Path:	VBA/Sheet3
VBA File Name:	Sheet3
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . ' . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
Data Raw:	01 16 01 00 01 f0 00 00 00 cc 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d3 02 00 00 27 03 00 00 00 00 00 00 01 00 00 00 d7 b8 f7 ce 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet4, Stream Size: 985

General
Stream Path:	VBA/Sheet4
VBA File Name:	Sheet4
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . ' . . . . . . . . . . . . f E . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 01 f0 00 00 00 cc 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d3 02 00 00 27 03 00 00 00 00 00 00 01 00 00 00 d7 b8 66 45 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet4"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet5, Stream Size: 985

General
Stream Path:	VBA/Sheet5
VBA File Name:	Sheet5
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . ' . . . . . . . . . . . . 9 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 01 f0 00 00 00 cc 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d3 02 00 00 27 03 00 00 00 00 00 00 01 00 00 00 d7 b8 39 da 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet5"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet6, Stream Size: 985

General
Stream Path:	VBA/Sheet6
VBA File Name:	Sheet6
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . ' . . . . . . . . . . . . . ; . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 01 f0 00 00 00 cc 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d3 02 00 00 27 03 00 00 00 00 00 00 01 00 00 00 d7 b8 06 3b 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet6"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet7, Stream Size: 985

General
Stream Path:	VBA/Sheet7
VBA File Name:	Sheet7
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . ' . . . . . . . . . . . . c . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 01 f0 00 00 00 cc 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d3 02 00 00 27 03 00 00 00 00 00 00 01 00 00 00 d7 b8 63 e8 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet7"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet8, Stream Size: 999

General
Stream Path:	VBA/Sheet8
VBA File Name:	Sheet8
Stream Size:	999
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . 3 . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 01 f0 00 00 00 cc 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d3 02 00 00 33 03 00 00 00 00 00 00 01 00 00 00 d7 b8 d5 8c 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet8"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook, Stream Size: 1851

General
Stream Path:	VBA/ThisWorkbook
VBA File Name:	ThisWorkbook
Stream Size:	1851
Data ASCII:	. . . . . . . . . . . . . . . . 8 . . . . . . . . . < . . . . . . . . . . . . r . . # . . . . . . . . . . . . . . . . . < . . . a . q I \| J E E . . . . . . . . . . . . . . . F . . . . . . . . . . . . . . . . . . . . . . s . I ? $ . . . . . . . . . . . . . . . . . . . . . . x . . . . . . s . I ? $ a . q I \| J E E . . . . . M E . . . . . . . . . . . . . . . . . . . . . P . . . . . S L . . . . S . . . . . S . . . . 6 " . . . . . . . . . . L . . . . . . . . . . . . . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2
Data Raw:	01 16 01 00 06 00 01 00 00 04 05 00 00 e4 00 00 00 38 02 00 00 86 05 00 00 94 05 00 00 3c 06 00 00 00 00 00 00 01 00 00 00 d7 b8 f6 72 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 3c 00 ff ff 00 00 61 1c 71 49 7c ff c2 4a aa a0 bf 45 45 c4 81 f8 19 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
AddIns("Analysis ToolPak").Installed = True
End Sub

VBA File Name: UserForm1, Stream Size: 1358

General
Stream Path:	VBA/UserForm1
VBA File Name:	UserForm1
Stream Size:	1358
Data ASCII:	. . . . . . . . . . . . . . L . . . . . . 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . ( . . . . . S P . . . . S . . . . . S . . . . . S . . . . . . . . . . . . 0 . { . E . 9 . F . C . 1 . 9 . 5 . 0 . - . 5 .
Data Raw:	01 16 01 00 01 f0 00 00 00 88 03 00 00 d4 00 00 00 4c 02 00 00 ff ff ff ff 8f 03 00 00 33 04 00 00 00 00 00 00 01 00 00 00 d7 b8 d3 8b 00 00 ff ff 01 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{E9FC1950-5955-4540-8EE9-20E8FF97B64C}{A37438F2-14D5-45FA-AED1-0BE85459E511}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub Image1_Click()
UserForm1.Hide

End Sub

Streams

Stream Path: CALENDARFORM1/\x1CompObj, File Type: data, Stream Size: 97

General
Stream Path:	CALENDARFORM1/\x1CompObj
CLSID:
File Type:	data
Stream Size:	97
Entropy:	3.6106491830605214
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t F o r m s 2 . 0 F o r m . . . . . E m b e d d e d O b j e c t . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 20 32 2e 30 20 46 6f 72 6d 00 10 00 00 00 45 6d 62 65 64 64 65 64 20 4f 62 6a 65 63 74 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: CALENDARFORM1/\x3VBFrame, File Type: ASCII text, with CRLF line terminators, Stream Size: 304

General
Stream Path:	CALENDARFORM1/\x3VBFrame
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	304
Entropy:	4.694288577295008
Base64 Encoded:	True
Data ASCII:	V E R S I O N 5 . 0 0 . . B e g i n { C 6 2 A 6 9 F 0 - 1 6 D C - 1 1 C E - 9 E 9 8 - 0 0 A A 0 0 5 7 4 A 4 F } C A L E N D A R F O R M 1 . . C a p t i o n = " D A T E O F S U B M I S S I O N " . . C l i e n t H e i g h t = 2 8 3 5 . . C l i e n t L e f t = 4 5 . . C l i e n t T o p = 4 3 5 . . C l i e n t W i d t h = 4 4 7 0 . . S t a r t U p P o s i t i o n =
Data Raw:	56 45 52 53 49 4f 4e 20 35 2e 30 30 0d 0a 42 65 67 69 6e 20 7b 43 36 32 41 36 39 46 30 2d 31 36 44 43 2d 31 31 43 45 2d 39 45 39 38 2d 30 30 41 41 30 30 35 37 34 41 34 46 7d 20 43 41 4c 45 4e 44 41 52 46 4f 52 4d 31 20 0d 0a 20 20 20 43 61 70 74 69 6f 6e 20 20 20 20 20 20 20 20 20 3d 20 20 20 22 44 41 54 45 20 4f 46 20 53 55 42 4d 49 53 53 49 4f 4e 22 0d 0a 20 20 20 43 6c 69 65 6e

Stream Path: CALENDARFORM1/f, File Type: data, Stream Size: 83

General
Stream Path:	CALENDARFORM1/f
CLSID:
File Type:	data
Stream Size:	83
Entropy:	3.492277110096586
Base64 Encoded:	False
Data ASCII:	. . $ . . . . . . . . . . . . . . . . } . . . . . . . . . . . . . . . . . R . . . . K Q . . . . . H . . . T a h o m a . . . . . . . . . .
Data Raw:	00 04 24 00 08 0c 10 0c 01 00 00 00 ff ff 00 00 01 00 00 00 00 7d 00 00 cd 1e 00 00 89 13 00 00 00 00 00 00 00 00 00 00 03 52 e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b8 51 01 00 00 00 90 01 20 48 01 00 06 54 61 68 6f 6d 61 00 00 00 00 00 00 00 00 00 00

Stream Path: CALENDARFORM1/o, File Type: empty, Stream Size: 0

General
Stream Path:	CALENDARFORM1/o
CLSID:
File Type:	empty
Stream Size:	0
Entropy:	0.0
Base64 Encoded:	False
Data ASCII:
Data Raw:

Stream Path: PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 1263

General
Stream Path:	PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	1263
Entropy:	5.054151901627322
Base64 Encoded:	True
Data ASCII:	I D = " { 0 E 2 A 7 7 E F - 4 C 8 A - 4 7 F D - 8 4 5 8 - E 1 4 7 1 5 9 E 1 9 F 6 } " . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 4 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 5 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 6 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t =
Data Raw:	49 44 3d 22 7b 30 45 32 41 37 37 45 46 2d 34 43 38 41 2d 34 37 46 44 2d 38 34 35 38 2d 45 31 34 37 31 35 39 45 31 39 46 36 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: PROJECTlk, File Type: Windows Precompiled iNF, version 0.1, InfStyle 1, flags 0xc92b0000, at 0x29c, Stream Size: 30

General
Stream Path:	PROJECTlk
CLSID:
File Type:	Windows Precompiled iNF, version 0.1, InfStyle 1, flags 0xc92b0000, at 0x29c
Stream Size:	30
Entropy:	3.1700333844140456
Base64 Encoded:	False
Data ASCII:	. . . . . . + ' d . . . / . . $ . . . . . . . . . .
Data Raw:	01 00 01 00 00 00 2b c9 27 8e 64 12 1c 10 8a 2f 04 02 24 00 9c 02 00 00 00 00 00 00 00 00

Stream Path: PROJECTwm, File Type: data, Stream Size: 425

General
Stream Path:	PROJECTwm
CLSID:
File Type:	data
Stream Size:	425
Entropy:	3.566098705834202
Base64 Encoded:	False
Data ASCII:	S h e e t 1 . S . h . e . e . t . 1 . . . T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . S h e e t 4 . S . h . e . e . t . 4 . . . S h e e t 5 . S . h . e . e . t . 5 . . . S h e e t 6 . S . h . e . e . t . 6 . . . S h e e t 7 . S . h . e . e . t . 7 . . . S h e e t 8 . S . h . e . e . t . 8 . . . M o d u l e 1 . M . o . d . u . l . e . 1 . . . C A L E N D A R F O R M 1 . C . A . L . E . N . D
Data Raw:	53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 53 68 65 65 74 34 00 53 00 68 00 65 00 65 00 74 00 34 00 00 00 53 68 65 65 74

Stream Path: UserForm1/\x1CompObj, File Type: data, Stream Size: 97

General
Stream Path:	UserForm1/\x1CompObj
CLSID:
File Type:	data
Stream Size:	97
Entropy:	3.6106491830605214
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t F o r m s 2 . 0 F o r m . . . . . E m b e d d e d O b j e c t . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 20 32 2e 30 20 46 6f 72 6d 00 10 00 00 00 45 6d 62 65 64 64 65 64 20 4f 62 6a 65 63 74 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: UserForm1/\x3VBFrame, File Type: ASCII text, with CRLF line terminators, Stream Size: 286

General
Stream Path:	UserForm1/\x3VBFrame
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	286
Entropy:	4.585970389260873
Base64 Encoded:	True
Data ASCII:	V E R S I O N 5 . 0 0 . . B e g i n { C 6 2 A 6 9 F 0 - 1 6 D C - 1 1 C E - 9 E 9 8 - 0 0 A A 0 0 5 7 4 A 4 F } U s e r F o r m 1 . . C a p t i o n = " K E Y " . . C l i e n t H e i g h t = 3 0 0 0 . . C l i e n t L e f t = 4 5 . . C l i e n t T o p = 4 3 5 . . C l i e n t W i d t h = 1 1 7 0 0 . . S t a r t U p P o s i t i o n = 1 ' C e n t e r O w n e r . .
Data Raw:	56 45 52 53 49 4f 4e 20 35 2e 30 30 0d 0a 42 65 67 69 6e 20 7b 43 36 32 41 36 39 46 30 2d 31 36 44 43 2d 31 31 43 45 2d 39 45 39 38 2d 30 30 41 41 30 30 35 37 34 41 34 46 7d 20 55 73 65 72 46 6f 72 6d 31 20 0d 0a 20 20 20 43 61 70 74 69 6f 6e 20 20 20 20 20 20 20 20 20 3d 20 20 20 22 4b 45 59 22 0d 0a 20 20 20 43 6c 69 65 6e 74 48 65 69 67 68 74 20 20 20 20 3d 20 20 20 33 30 30 30

Stream Path: UserForm1/f, File Type: data, Stream Size: 127

General
Stream Path:	UserForm1/f
CLSID:
File Type:	data
Stream Size:	127
Entropy:	4.004867879022472
Base64 Encoded:	False
Data ASCII:	. . $ . . . . . . . . . . . . . . . . } . . P . . . . . . . . . . . . . . R . . . . K Q . . . . . H . . . T a h o m a . . . . . . , . . . . . T . . . $ . . . . . . . . . . . f 0 . . . . . . I m a g e 1 . ,
Data Raw:	00 04 24 00 08 0c 10 0c 02 00 00 00 ff ff 00 00 03 00 00 00 00 7d 00 00 9d 50 00 00 ac 14 00 00 00 00 00 00 00 00 00 00 03 52 e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b8 51 01 00 00 00 90 01 20 48 01 00 06 54 61 68 6f 6d 61 00 00 01 00 00 00 2c 00 00 00 00 01 54 2e 00 00 24 00 e5 01 00 00 06 00 00 80 02 00 00 00 66 30 06 00 00 00 0c 00 49 6d 61 67 65 31 a9 03 2c ff ff ff de fb ff ff

Stream Path: UserForm1/o, File Type: Intel ia64 COFF object file, not stripped, 20 sections, symbol offset=0x80000009, 65535 symbols, optional header size 20955, created Thu Jan 1 00:25:52 1970, Stream Size: 405606

General
Stream Path:	UserForm1/o
CLSID:
File Type:	Intel ia64 COFF object file, not stripped, 20 sections, symbol offset=0x80000009, 65535 symbols, optional header size 20955, created Thu Jan 1 00:25:52 1970
Stream Size:	405606
Entropy:	1.1456531467366122
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . Q . . I . . . . R . . . . K Q l t . . 6 0 . . B M 6 0 . . . . . . 6 . . . ( . . . . . . . . . . . . . . . . . . . 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	00 02 14 00 10 06 00 00 09 00 00 80 ff ff 00 00 db 51 00 00 49 1b 00 00 04 52 e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b8 51 6c 74 00 00 36 30 06 00 42 4d 36 30 06 00 00 00 00 00 36 00 00 00 28 00 00 00 00 03 00 00 b0 00 00 00 01 00 18 00 00 00 00 00 00 30 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff

Stream Path: VBA/_VBA_PROJECT, File Type: data, Stream Size: 6131

General
Stream Path:	VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	6131
Entropy:	4.799372394976097
Base64 Encoded:	True
Data ASCII:	a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . . ( . x . 8 . 6 . ) . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ .
Data Raw:	cc 61 b2 00 00 01 00 ff 09 08 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 2c 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: VBA/__SRP_0, File Type: data, Stream Size: 2491

General
Stream Path:	VBA/__SRP_0
CLSID:
File Type:	data
Stream Size:	2491
Entropy:	4.114387881094324
Base64 Encoded:	True
Data ASCII:	K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . r U . . . . . . . . . . . . . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # > ' N { . { . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . q . . . . . . . . .
Data Raw:	93 4b 2a b2 01 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 0e 00 00 00 00 00 01 00 02 00 0e 00 00 00 00 00 01 00 00 00 0a 00 00 00 00 00 01 00 02 00 0a 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 01 00 02 00 01 00 00 00 00 00 01 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 00 00 72 55 80 01 00 00 80 00 00 00 80 00 00 00 80 00 00 00 04 00 00 7e

Stream Path: VBA/__SRP_1, File Type: data, Stream Size: 286

General
Stream Path:	VBA/__SRP_1
CLSID:
File Type:	data
Stream Size:	286
Entropy:	3.720814424010549
Base64 Encoded:	True
Data ASCII:	r U . . . . . . . . . . . . . . . ~ } . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . . . M a c r o r e c o r d e d 1 2 / 1 2 / 2 0 1 2 b y k e v i n . x . b a k e r . . . . . . . . . 1 4 . . . . * . . . M a c r o r e c o r d e d 1 6 / 1 2 / 2 0 1 2 b y k e v i n . x . b a k e r . . . . . . . . . . . . . . . . . . . . . . . . . . . U . . . . . . .
Data Raw:	72 55 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 01 00 00 7e 7d 00 00 7f 00 00 00 00 0a 00 00 00 09 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 ff ff ff ff 09 00 00 00 00 00 07 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 09 00 00 00 00 00 05 00 ff ff ff ff ff ff ff ff ff ff ff ff 09 00 00 00 00 00

Stream Path: VBA/__SRP_2, File Type: data, Stream Size: 136

General
Stream Path:	VBA/__SRP_2
CLSID:
File Type:	data
Stream Size:	136
Entropy:	1.6161992011982347
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . ~ \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . k . . . . . . .
Data Raw:	72 55 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 02 00 00 7e 7c 00 00 7f 00 00 00 00 0e 00 00 00 09 00 00 00 00 00 00 00 09 00 00 00 00 00 03 00 08 00 00 00 00 00 02 00 01 00 01 00 00 00 00 00 30 00 00 00 0c 00 00 00 fc c6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 04 00 00 12 00 00

Stream Path: VBA/__SRP_3, File Type: data, Stream Size: 111

General
Stream Path:	VBA/__SRP_3
CLSID:
File Type:	data
Stream Size:	111
Entropy:	1.8862418626278998
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . ` . . a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . n . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 10 00 00 00 09 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff 00 00 00 00 08 00 00 00 04 00 24 00 81 00 00 00 00 00 02 00 00 00 00 60 00 00 fd ff ff ff 61 00 00 00 00 00 01 00 c1 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6e 00 00 7f 00 00 00 00

Stream Path: VBA/__SRP_4, File Type: data, Stream Size: 136

General
Stream Path:	VBA/__SRP_4
CLSID:
File Type:	data
Stream Size:	136
Entropy:	1.6161992011982345
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . ~ \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . k . . . . . . .
Data Raw:	72 55 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 02 00 00 7e 7c 00 00 7f 00 00 00 00 0e 00 00 00 09 00 00 00 00 00 00 00 09 00 00 00 00 00 05 00 08 00 00 00 00 00 04 00 01 00 01 00 00 00 00 00 30 00 00 00 0c 00 00 00 fc c6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 04 00 00 12 00 00

Stream Path: VBA/__SRP_5, File Type: data, Stream Size: 111

General
Stream Path:	VBA/__SRP_5
CLSID:
File Type:	data
Stream Size:	111
Entropy:	1.8614230563021028
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . n . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 10 00 00 00 09 00 00 00 00 00 04 00 ff ff ff ff ff ff ff ff 00 00 00 00 08 00 00 00 04 00 24 00 81 00 00 00 00 00 04 00 00 00 00 60 00 00 fd ff ff ff d9 00 00 00 00 00 01 00 c1 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6e 00 00 7f 00 00 00 00

Stream Path: VBA/__SRP_6, File Type: data, Stream Size: 592

General
Stream Path:	VBA/__SRP_6
CLSID:
File Type:	data
Stream Size:	592
Entropy:	2.6276704119825274
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 . . . . . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . 7 . 4 . . . . . . . . . . . 9 . . . . . . . ) . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . H . . . . . . @ c 8 % : h . . % . x . . . $ . . . L . . . . x H . . . . . . . . . $ . $ , & . . . ) . . x $ 5 H . . . . 0 . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 1e 00 00 00 09 00 00 00 00 00 00 00 09 00 00 00 00 00 07 00 c0 00 00 00 00 00 00 00 01 00 01 00 05 00 00 00 91 0a 00 00 00 00 00 00 89 0b 00 00 00 00 00 00 39 0b 00 00 00 00 00 00 11 0b 00 00 00 00 00 00 61 0b 00 00 00 00 00 00 01 00 01 00 00 00 01 00 89 09 00 00 00 00 00 00 b1 09 00 00 00 00 00 00 d9 09 00 00 00 00

Stream Path: VBA/__SRP_7, File Type: data, Stream Size: 103

General
Stream Path:	VBA/__SRP_7
CLSID:
File Type:	data
Stream Size:	103
Entropy:	2.160201543212218
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . $ . . . . . . . . . . . . ` . . l . . . . . . . . . . . . . . . . . . n . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 10 00 00 00 09 00 00 00 00 00 06 00 ff ff ff ff ff ff ff ff 00 00 00 00 40 00 00 00 04 00 24 00 01 01 00 00 00 00 06 00 00 00 03 60 00 00 6c 04 1c 00 ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 1e 00 00 00 00 00 00 6e 00 00 7f 00 00 00 00

Stream Path: VBA/dir, File Type: data, Stream Size: 1247

General
Stream Path:	VBA/dir
CLSID:
File Type:	data
Stream Size:	1247
Entropy:	6.8217580891372736
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . 0 J . . . H . . H . . . . . H . . . d . . . . . . V B A P r @ o j e c t . . . . T . @ . . . . . = . . . + . r . . . . . . . . A j a . . . . J < . . . . . . 9 s t d o l . e > . . s . t . d . . o . l . e . . . . h . % ^ . . * \\ G . { 0 0 0 2 0 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # 2 . . 0 # 0 # C : \\ W . i n d o w s \\ S . y s W O W 6 4 \\ . . e 2 . t l b # O . L E A u t o m a t i o n . 0 . . E O f f i c E O . f . i . c E . . . E 2 D F 8 D . 0 4 C - 5 B F A . - 1 0 1 B - B D E 5 E
Data Raw:	01 db b4 80 01 00 04 00 00 00 01 00 30 aa 4a 02 90 02 00 48 02 02 48 09 00 c0 12 14 06 48 03 00 01 64 e4 04 04 04 00 0a 00 84 56 42 41 50 72 40 6f 6a 65 63 74 05 00 1a 00 54 00 40 02 0a 06 02 0a 3d 02 0a 07 2b 02 72 01 14 08 06 12 09 02 12 41 b9 a0 6a 61 05 00 0c 02 4a 3c 02 0a 04 16 00 01 39 73 74 64 6f 6c 04 65 3e 02 19 73 00 74 00 64 00 00 6f 00 6c 00 65 00 0d 14 00 68 00 25 5e

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 18:54:57.245970964 CET	57141	53	192.168.2.24	1.1.1.1
Mar 7, 2025 18:54:57.251014948 CET	53	57141	1.1.1.1	192.168.2.24
Mar 7, 2025 18:54:57.252011061 CET	57141	53	192.168.2.24	1.1.1.1
Mar 7, 2025 18:54:57.254021883 CET	57141	53	192.168.2.24	1.1.1.1
Mar 7, 2025 18:54:57.259046078 CET	53	57141	1.1.1.1	192.168.2.24
Mar 7, 2025 18:54:57.470731974 CET	63938	53	192.168.2.24	1.1.1.1
Mar 7, 2025 18:54:57.475780964 CET	53	63938	1.1.1.1	192.168.2.24
Mar 7, 2025 18:54:57.475876093 CET	63938	53	192.168.2.24	1.1.1.1
Mar 7, 2025 18:54:57.477250099 CET	63938	53	192.168.2.24	1.1.1.1
Mar 7, 2025 18:54:57.482251883 CET	53	63938	1.1.1.1	192.168.2.24
Mar 7, 2025 18:54:57.923413038 CET	53	57141	1.1.1.1	192.168.2.24
Mar 7, 2025 18:54:57.963304043 CET	57141	53	192.168.2.24	1.1.1.1
Mar 7, 2025 18:54:57.968564034 CET	53	57141	1.1.1.1	192.168.2.24
Mar 7, 2025 18:54:57.968631983 CET	57141	53	192.168.2.24	1.1.1.1
Mar 7, 2025 18:54:58.057431936 CET	53	63938	1.1.1.1	192.168.2.24
Mar 7, 2025 18:54:58.100893021 CET	63938	53	192.168.2.24	1.1.1.1
Mar 7, 2025 18:54:58.152980089 CET	63938	53	192.168.2.24	1.1.1.1
Mar 7, 2025 18:54:58.158195972 CET	53	63938	1.1.1.1	192.168.2.24
Mar 7, 2025 18:54:58.159655094 CET	63938	53	192.168.2.24	1.1.1.1
Mar 7, 2025 18:56:12.576886892 CET	63951	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:12.576944113 CET	443	63951	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:12.577001095 CET	63952	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:12.577043056 CET	443	63952	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:12.577054024 CET	63951	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:12.577086926 CET	63952	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:12.577606916 CET	63951	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:12.577619076 CET	443	63951	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:12.577625036 CET	63952	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:12.577637911 CET	443	63952	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:16.816855907 CET	443	63952	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:16.817018986 CET	63952	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:16.821922064 CET	63952	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:16.821928978 CET	443	63952	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:16.822278023 CET	443	63952	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:16.832318068 CET	63952	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:16.876322985 CET	443	63952	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:16.986856937 CET	443	63951	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:16.986985922 CET	63951	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:16.988748074 CET	63951	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:16.988760948 CET	443	63951	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:16.989609957 CET	443	63951	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:16.990550041 CET	63951	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:17.036324978 CET	443	63951	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:17.486242056 CET	443	63952	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:17.486315012 CET	443	63952	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:17.486428022 CET	63952	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:17.486798048 CET	63952	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:17.486826897 CET	443	63952	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:17.486841917 CET	63952	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:17.486849070 CET	443	63952	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:17.710850954 CET	443	63951	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:17.710881948 CET	443	63951	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:17.710943937 CET	443	63951	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:17.710990906 CET	63951	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:17.711051941 CET	63951	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:17.711446047 CET	63951	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:17.711467981 CET	443	63951	13.107.246.67	192.168.2.24
Mar 7, 2025 18:56:17.711479902 CET	63951	443	192.168.2.24	13.107.246.67
Mar 7, 2025 18:56:17.711486101 CET	443	63951	13.107.246.67	192.168.2.24

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 18:54:57.244229078 CET	53	57749	1.1.1.1	192.168.2.24
Mar 7, 2025 18:54:57.470068932 CET	53	57749	1.1.1.1	192.168.2.24
Mar 7, 2025 18:56:12.545175076 CET	55613	53	192.168.2.24	1.1.1.1
Mar 7, 2025 18:56:12.575790882 CET	53	55613	1.1.1.1	192.168.2.24

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 7, 2025 18:56:12.545175076 CET	192.168.2.24	1.1.1.1	0x7b7d	Standard query (0)	otelrules.svc.static.microsoft	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 7, 2025 18:54:41.113234043 CET	1.1.1.1	192.168.2.24	0x9d85	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:54:41.113234043 CET	1.1.1.1	192.168.2.24	0x9d85	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:54:57.218863010 CET	1.1.1.1	192.168.2.24	0xd674	No error (0)	res-stls-prod.edgesuite.net.globalredir.akadns88.net	a726.dscd.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 18:54:57.218863010 CET	1.1.1.1	192.168.2.24	0xd674	No error (0)	a726.dscd.akamai.net		2.22.242.9	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:54:57.218863010 CET	1.1.1.1	192.168.2.24	0xd674	No error (0)	a726.dscd.akamai.net		2.22.242.114	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:54:57.218863010 CET	1.1.1.1	192.168.2.24	0xd674	No error (0)	a726.dscd.akamai.net		2.22.242.145	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:54:57.251816988 CET	1.1.1.1	192.168.2.24	0xdee	No error (0)	ecs-office.s-0005.dual-s-msedge.net	s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 18:54:57.251816988 CET	1.1.1.1	192.168.2.24	0xdee	No error (0)	s-0005.dual-s-msedge.net		52.123.128.14	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:54:57.251816988 CET	1.1.1.1	192.168.2.24	0xdee	No error (0)	s-0005.dual-s-msedge.net		52.123.129.14	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:55:01.073522091 CET	1.1.1.1	192.168.2.24	0x8889	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:55:01.073522091 CET	1.1.1.1	192.168.2.24	0x8889	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:55:01.073522091 CET	1.1.1.1	192.168.2.24	0x8889	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:55:01.073522091 CET	1.1.1.1	192.168.2.24	0x8889	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:55:01.073522091 CET	1.1.1.1	192.168.2.24	0x8889	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:55:01.073522091 CET	1.1.1.1	192.168.2.24	0x8889	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:55:01.073522091 CET	1.1.1.1	192.168.2.24	0x8889	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:55:01.073522091 CET	1.1.1.1	192.168.2.24	0x8889	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:56:02.584832907 CET	1.1.1.1	192.168.2.24	0xb2c9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:56:02.584832907 CET	1.1.1.1	192.168.2.24	0xb2c9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Mar 7, 2025 18:56:12.575790882 CET	1.1.1.1	192.168.2.24	0x7b7d	No error (0)	otelrules.svc.static.microsoft	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 18:56:12.575790882 CET	1.1.1.1	192.168.2.24	0x7b7d	No error (0)	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 18:56:12.575790882 CET	1.1.1.1	192.168.2.24	0x7b7d	No error (0)	star-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0039.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 18:56:12.575790882 CET	1.1.1.1	192.168.2.24	0x7b7d	No error (0)	shed.dual-low.s-part-0039.t-0009.t-msedge.net	s-part-0039.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 18:56:12.575790882 CET	1.1.1.1	192.168.2.24	0x7b7d	No error (0)	s-part-0039.t-0009.t-msedge.net		13.107.246.67	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.svc.static.microsoft

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.24	63952	13.107.246.67	443	2848	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-07 17:56:16 UTC	214	OUT	GET /rules/rule170146v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.18129; Pro) Host: otelrules.svc.static.microsoft
2025-03-07 17:56:17 UTC	498	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 17:56:17 GMT Content-Type: text/xml Content-Length: 461 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Thu, 14 Nov 2024 16:14:57 GMT ETag: "0x8DD04C77BDE7614" x-ms-request-id: 106e8fa1-c01e-0034-437e-8f2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20250307T175617Z-155db4c95f76gzs2hC1PHX9xq00000000gkg00000000d8vv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2025-03-07 17:56:17 UTC	461	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 37 30 31 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 47 72 61 70 68 69 63 73 2e 45 78 70 6f 72 74 42 75 6c 6c 65 74 42 6c 69 70 43 45 78 63 65 70 74 69 6f 6e 22 20 41 54 54 3d 22 63 66 63 66 64 62 39 31 63 36 38 63 34 33 32 39 62 62 38 62 37 63 62 37 62 61 62 62 33 63 66 37 2d 65 30 38 32 63 32 66 32 2d 65 66 31 64 2d 34 32 37 61 2d 61 63 34 64 2d 62 30 62 37 30 30 61 66 65 37 61 37 2d 37 36 35 35 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 34 38 39 66 34 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="170146" V="0" DC="SM" EN="Office.Graphics.ExportBulletBlipCException" ATT="cfcfdb91c68c4329bb8b7cb7babb3cf7-e082c2f2-ef1d-427a-ac4d-b0b700afe7a7-7655" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="489f4"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.24	63951	13.107.246.67	443	2848	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-07 17:56:16 UTC	215	OUT	GET /rules/rule120201v19s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.18129; Pro) Host: otelrules.svc.static.microsoft
2025-03-07 17:56:17 UTC	495	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 17:56:17 GMT Content-Type: text/xml Content-Length: 2781 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 31 Dec 2024 22:07:50 GMT ETag: "0x8DD29E791389B5C" x-ms-request-id: 6e961755-c01e-007a-288a-8fb877000000 x-ms-version: 2018-03-28 x-azure-ref: 20250307T175617Z-155db4c95f7gm646hC1PHXrux00000000g2g000000009uy7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2025-03-07 17:56:17 UTC	2781	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 32 30 31 22 20 56 3d 22 31 39 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 73 61 67 65 2e 43 6c 69 63 6b 53 74 72 65 61 6d 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 55 73 61 67 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120201" V="19" DC="SM" EN="Office.System.SystemHealthUsage.ClickStream" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalUsage" DCa="PSU" xmlns=""> <RIS>

Target ID:	0
Start time:	12:54:47
Start date:	07/03/2025
Path:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x7ff66c200000
File size:	70'082'712 bytes
MD5 hash:	F9F7B6C42211B06E7AC3E4B60AA8FB77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	12:55:52
Start date:	07/03/2025
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff689760000
File size:	192'512 bytes
MD5 hash:	AF4A7EBF6114EE9E6FBCC910EC3C96E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	12:56:55
Start date:	07/03/2025
Path:	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\Royal Mail Inland Claim Form V1.3.xlsm"
Imagebase:	0x7ff66c200000
File size:	70'082'712 bytes
MD5 hash:	F9F7B6C42211B06E7AC3E4B60AA8FB77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make a payload or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the device or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Portions of files can also be encoded to hide the plaintext strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.
Tactics:	Defense Evasion
Data Sources:
Platforms:	Android, iOS
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Royal Mail Inland Claim Form V1.3.xlsm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Additional\Additional1741370090085057700_A2BC7F7D-C10F-4FB9-8C9C-0E06D4C27602.log

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Additional\Additional1741370090085706100_A2BC7F7D-C10F-4FB9-8C9C-0E06D4C27602.log

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Additional\Additional1741370215492847900_0EE3EFB0-A6F1-4351-A3EB-3FF26CC45DFF.log

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Additional\Additional1741370215493160300_0EE3EFB0-A6F1-4351-A3EB-3FF26CC45DFF.log

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Primary1741370090067167200_A2BC7F7D-C10F-4FB9-8C9C-0E06D4C27602.log

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Primary1741370090067569100_A2BC7F7D-C10F-4FB9-8C9C-0E06D4C27602.log

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Primary1741370215491905600_0EE3EFB0-A6F1-4351-A3EB-3FF26CC45DFF.log

C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Primary1741370215492347300_0EE3EFB0-A6F1-4351-A3EB-3FF26CC45DFF.log

C:\Users\user\AppData\Local\Temp\Excel8.0\MSForms.exd

C:\Users\user\AppData\Local\Temp\~DF1A8AD45732C5A845.TMP

C:\Users\user\AppData\Local\Temp\~DF362117FD176B7F1A.TMP

C:\Users\user\AppData\Local\Temp\~DF3A3F41CBA993218B.TMP

C:\Users\user\AppData\Local\Temp\~DF648CC526AB4166A1.TMP

C:\Users\user\AppData\Local\Temp\~DF7387C9515645B4B0.TMP

C:\Users\user\AppData\Local\Temp\~DFA7EE61036CE425FA.TMP

C:\Users\user\AppData\Local\Temp\~DFB4BC96AE9E6228B2.TMP

C:\Users\user\AppData\Local\Temp\~DFC708928A9F743D2A.TMP

C:\Users\user\AppData\Local\Temp\~DFD70EC483F49A2C64.TMP

C:\Users\user\Desktop\32160000

C:\Users\user\Desktop\32160000:Zone.Identifier

C:\Users\user\Desktop\Royal Mail Inland Claim Form V1.3.xlsm (copy)

C:\Users\user\Desktop\~$Royal Mail Inland Claim Form V1.3.xlsm

C:\Users\user\Documents\~$0.xlsx

Static File Info

General

Windows Analysis Report
Royal Mail Inland Claim Form V1.3.xlsm