Loading ...

Play interactive tourEdit tour

Analysis Report sviluppo_economico_19__98.xls

Overview

General Information

Sample Name:sviluppo_economico_19__98.xls
Analysis ID:320589
MD5:f85cc34cca018369113e5ea6aff1eae4
SHA1:62cb04d273f22c440aca13dc344bd05ec7fb9b79
SHA256:f93a962db6a8cfaf0513c5d2a36cf61b863c52f32ca7ab856cfe0b024001c9f3

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected password protected xls with embedded macros
Unable to load, office file is protected or invalid

Classification

Startup

  • System is w10x64
  • EXCEL.EXE (PID: 5384 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
sviluppo_economico_19__98.xlsJoeSecurity_PasswordProtectedXlsWithEmbeddedMacrosYara detected password protected xls with embedded macrosJoe Security

    Sigma Overview

    No Sigma rule has matched

    Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Multi AV Scanner detection for submitted fileShow sources
    Source: sviluppo_economico_19__98.xlsVirustotal: Detection: 8%Perma Link
    Source: sviluppo_economico_19__98.xlsReversingLabs: Detection: 10%
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://api.aadrm.com/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://api.diagnostics.office.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://api.microsoftstream.com/api/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://api.office.net
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://api.onedrive.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://apis.live.net/v5.0/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://augloop.office.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://augloop.office.com/v2
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://autodiscover-s.outlook.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://cdn.entity.
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://clients.config.office.net/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://config.edge.skype.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://cortana.ai
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://cr.office.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://dataservice.o365filtering.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://dataservice.o365filtering.com/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://devnull.onenote.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://directory.services.
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://graph.ppe.windows.net
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://graph.ppe.windows.net/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://graph.windows.net
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://graph.windows.net/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://incidents.diagnostics.office.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://lifecycle.office.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://login.microsoftonline.com/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://login.windows.local
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://management.azure.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://management.azure.com/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://messaging.office.com/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://ncus-000.contentsync.
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://ncus-000.pagecontentsync.
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://officeapps.live.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://onedrive.live.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://onedrive.live.com/embed?
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://outlook.office.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://outlook.office365.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://powerlift.acompli.net
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://settings.outlook.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://shell.suite.office.com:1443
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://skyapi.live.net/Activity/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://store.office.cn/addinstemplate
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://store.office.com/?productgroup=Outlook
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://store.office.com/addinstemplate
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://store.office.de/addinstemplate
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://tasks.office.com
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://templatelogging.office.com/client/log
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://web.microsoftstream.com/video/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://wus2-000.contentsync.
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://wus2-000.pagecontentsync.
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
    Source: E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drString found in binary or memory: https://www.odwebp.svc.ms
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEWindow title found: password
    Source: classification engineClassification label: mal52.expl.winXLS@1/1@0/0
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{C9515EFA-C67F-48E3-849C-58E3238F2436} - OProcSessId.datJump to behavior
    Source: sviluppo_economico_19__98.xlsOLE indicator, Workbook stream: true
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
    Source: sviluppo_economico_19__98.xlsVirustotal: Detection: 8%
    Source: sviluppo_economico_19__98.xlsReversingLabs: Detection: 10%
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
    Source: sviluppo_economico_19__98.xlsInitial sample: OLE indicators vbamacros = False
    Source: sviluppo_economico_19__98.xlsInitial sample: OLE indicators encrypted = True
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX

    HIPS / PFW / Operating System Protection Evasion:

    barindex
    Yara detected password protected xls with embedded macrosShow sources
    Source: Yara matchFile source: sviluppo_economico_19__98.xls, type: SAMPLE

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionMasquerading1OS Credential DumpingFile and Directory Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemorySystem Information Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    sviluppo_economico_19__98.xls8%VirustotalBrowse
    sviluppo_economico_19__98.xls10%ReversingLabs

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://wus2-000.contentsync.0%URL Reputationsafe
    https://wus2-000.contentsync.0%URL Reputationsafe
    https://wus2-000.contentsync.0%URL Reputationsafe
    https://wus2-000.contentsync.0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://ofcrecsvcapi-int.azurewebsites.net/0%VirustotalBrowse
    https://ofcrecsvcapi-int.azurewebsites.net/0%Avira URL Cloudsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://officeci.azurewebsites.net/api/0%VirustotalBrowse
    https://officeci.azurewebsites.net/api/0%Avira URL Cloudsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://wus2-000.pagecontentsync.0%URL Reputationsafe
    https://wus2-000.pagecontentsync.0%URL Reputationsafe
    https://wus2-000.pagecontentsync.0%URL Reputationsafe
    https://wus2-000.pagecontentsync.0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://asgsmsproxyapi.azurewebsites.net/0%VirustotalBrowse
    https://asgsmsproxyapi.azurewebsites.net/0%Avira URL Cloudsafe
    https://ncus-000.contentsync.0%URL Reputationsafe
    https://ncus-000.contentsync.0%URL Reputationsafe
    https://ncus-000.contentsync.0%URL Reputationsafe
    https://ncus-000.contentsync.0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://ovisualuiapp.azurewebsites.net/pbiagave/0%VirustotalBrowse
    https://ovisualuiapp.azurewebsites.net/pbiagave/0%Avira URL Cloudsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe

    Domains and IPs

    Contacted Domains

    No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://api.diagnosticssdf.office.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
      high
      https://login.microsoftonline.com/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
        high
        https://shell.suite.office.com:1443E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
          high
          https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorizeE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
            high
            https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
              high
              https://cdn.entity.E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              unknown
              https://api.addins.omex.office.net/appinfo/queryE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                high
                https://wus2-000.contentsync.E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                unknown
                https://clients.config.office.net/user/v1.0/tenantassociationkeyE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                  high
                  https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                    high
                    https://powerlift.acompli.netE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    https://rpsticket.partnerservices.getmicrosoftkey.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    https://lookup.onenote.com/lookup/geolocation/v1E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                      high
                      https://cortana.aiE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                        high
                        https://cloudfiles.onenote.com/upload.aspxE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                          high
                          https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                            high
                            https://entitlement.diagnosticssdf.office.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                              high
                              https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicyE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                high
                                https://api.aadrm.com/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                unknown
                                https://ofcrecsvcapi-int.azurewebsites.net/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                • 0%, Virustotal, Browse
                                • Avira URL Cloud: safe
                                unknown
                                https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                  high
                                  https://api.microsoftstream.com/api/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                    high
                                    https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                      high
                                      https://cr.office.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                        high
                                        https://portal.office.com/account/?ref=ClientMeControlE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                          high
                                          https://ecs.office.com/config/v2/OfficeE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                            high
                                            https://graph.ppe.windows.netE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                              high
                                              https://res.getmicrosoftkey.com/api/redemptioneventsE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              unknown
                                              https://powerlift-frontdesk.acompli.netE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              unknown
                                              https://tasks.office.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                high
                                                https://officeci.azurewebsites.net/api/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                • 0%, Virustotal, Browse
                                                • Avira URL Cloud: safe
                                                unknown
                                                https://sr.outlook.office.net/ws/speech/recognize/assistant/workE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                  high
                                                  https://store.office.cn/addinstemplateE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://wus2-000.pagecontentsync.E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://outlook.office.com/autosuggest/api/v1/init?cvid=E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                    high
                                                    https://globaldisco.crm.dynamics.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                      high
                                                      https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                        high
                                                        https://store.officeppe.com/addinstemplateE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        unknown
                                                        https://dev0-api.acompli.net/autodetectE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        unknown
                                                        https://www.odwebp.svc.msE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        unknown
                                                        https://api.powerbi.com/v1.0/myorg/groupsE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                          high
                                                          https://web.microsoftstream.com/video/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                            high
                                                            https://graph.windows.netE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                              high
                                                              https://dataservice.o365filtering.com/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              unknown
                                                              https://officesetup.getmicrosoftkey.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              unknown
                                                              https://analysis.windows.net/powerbi/apiE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                high
                                                                https://prod-global-autodetect.acompli.net/autodetectE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://outlook.office365.com/autodiscover/autodiscover.jsonE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                  high
                                                                  https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-iosE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                    high
                                                                    https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                      high
                                                                      https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                        high
                                                                        https://onedrive.live.com/about/download/?windows10SyncClientInstalled=falseE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                          high
                                                                          https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                            high
                                                                            http://weather.service.msn.com/data.aspxE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                              high
                                                                              https://apis.live.net/v5.0/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              unknown
                                                                              https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asksE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                high
                                                                                https://word.uservoice.com/forums/304948-word-for-ipad-iphone-iosE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                  high
                                                                                  https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                    high
                                                                                    https://management.azure.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                      high
                                                                                      https://outlook.office365.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                        high
                                                                                        https://incidents.diagnostics.office.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                          high
                                                                                          https://clients.config.office.net/user/v1.0/iosE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                            high
                                                                                            https://insertmedia.bing.office.net/odc/insertmediaE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                              high
                                                                                              https://o365auditrealtimeingestion.manage.office.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                high
                                                                                                https://outlook.office365.com/api/v1.0/me/ActivitiesE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                  high
                                                                                                  https://api.office.netE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                    high
                                                                                                    https://incidents.diagnosticssdf.office.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                      high
                                                                                                      https://asgsmsproxyapi.azurewebsites.net/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                      • 0%, Virustotal, Browse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      unknown
                                                                                                      https://clients.config.office.net/user/v1.0/android/policiesE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                        high
                                                                                                        https://entitlement.diagnostics.office.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                          high
                                                                                                          https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                            high
                                                                                                            https://autodiscover-s.outlook.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                              high
                                                                                                              https://storage.live.com/clientlogs/uploadlocationE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                high
                                                                                                                https://templatelogging.office.com/client/logE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                  high
                                                                                                                  https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDriveE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                    high
                                                                                                                    https://management.azure.com/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                      high
                                                                                                                      https://ncus-000.contentsync.E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                      • URL Reputation: safe
                                                                                                                      • URL Reputation: safe
                                                                                                                      • URL Reputation: safe
                                                                                                                      • URL Reputation: safe
                                                                                                                      unknown
                                                                                                                      https://login.windows.net/common/oauth2/authorizeE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                        high
                                                                                                                        https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFileE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                        • URL Reputation: safe
                                                                                                                        • URL Reputation: safe
                                                                                                                        • URL Reputation: safe
                                                                                                                        • URL Reputation: safe
                                                                                                                        unknown
                                                                                                                        https://graph.windows.net/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                          high
                                                                                                                          https://api.powerbi.com/beta/myorg/importsE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                            high
                                                                                                                            https://devnull.onenote.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                              high
                                                                                                                              https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.jsonE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                high
                                                                                                                                https://messaging.office.com/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                  high
                                                                                                                                  https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                    high
                                                                                                                                    https://augloop.office.com/v2E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                      high
                                                                                                                                      https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=BingE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                        high
                                                                                                                                        https://skyapi.live.net/Activity/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        unknown
                                                                                                                                        https://clients.config.office.net/user/v1.0/macE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                          high
                                                                                                                                          https://dataservice.o365filtering.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          unknown
                                                                                                                                          https://onedrive.live.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                            high
                                                                                                                                            https://ovisualuiapp.azurewebsites.net/pbiagave/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                            • 0%, Virustotal, Browse
                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                            unknown
                                                                                                                                            https://visio.uservoice.com/forums/368202-visio-on-devicesE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                              high
                                                                                                                                              https://directory.services.E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              unknown
                                                                                                                                              https://login.windows-ppe.net/common/oauth2/authorizeE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                                high
                                                                                                                                                https://loki.delve.office.com/api/v1/configuration/officewin32/E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                                  high
                                                                                                                                                  https://onedrive.live.com/embed?E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                                    high
                                                                                                                                                    https://augloop.office.comE0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                                      high
                                                                                                                                                      https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2E0ED8BAC-9F96-4C65-A32A-441483C92CB1.0.drfalse
                                                                                                                                                        high

                                                                                                                                                        Contacted IPs

                                                                                                                                                        No contacted IP infos

                                                                                                                                                        General Information

                                                                                                                                                        Joe Sandbox Version:31.0.0 Red Diamond
                                                                                                                                                        Analysis ID:320589
                                                                                                                                                        Start date:19.11.2020
                                                                                                                                                        Start time:15:37:48
                                                                                                                                                        Joe Sandbox Product:CloudBasic
                                                                                                                                                        Overall analysis duration:0h 4m 15s
                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                        Report type:light
                                                                                                                                                        Sample file name:sviluppo_economico_19__98.xls
                                                                                                                                                        Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                        Run name:Potential for more IOCs and behavior
                                                                                                                                                        Number of analysed new started processes analysed:26
                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                        Technologies:
                                                                                                                                                        • HCA enabled
                                                                                                                                                        • EGA enabled
                                                                                                                                                        • HDC enabled
                                                                                                                                                        • AMSI enabled
                                                                                                                                                        Analysis Mode:default
                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                        Detection:MAL
                                                                                                                                                        Classification:mal52.expl.winXLS@1/1@0/0
                                                                                                                                                        Cookbook Comments:
                                                                                                                                                        • Adjust boot time
                                                                                                                                                        • Enable AMSI
                                                                                                                                                        • Found application associated with file extension: .xls
                                                                                                                                                        • Changed system and user locale, location and keyboard layout to Italian - Italy
                                                                                                                                                        • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                        • Attach to Office via COM
                                                                                                                                                        • Scroll down
                                                                                                                                                        • Close Viewer
                                                                                                                                                        Warnings:
                                                                                                                                                        Show All
                                                                                                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe
                                                                                                                                                        • Excluded IPs from analysis (whitelisted): 104.43.193.48, 52.147.198.201, 52.109.32.27, 52.109.12.21, 52.109.88.39, 23.210.248.85, 51.104.146.109, 205.185.216.42, 205.185.216.10, 20.54.26.129, 51.104.139.180, 92.122.213.194, 92.122.213.247, 51.11.168.160
                                                                                                                                                        • Excluded domains from analysis (whitelisted): prod-w.nexus.live.com.akadns.net, arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, nexus.officeapps.live.com, officeclient.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, skypedataprdcolcus15.cloudapp.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, umwatsonrouting.trafficmanager.net, config.officeapps.live.com, europe.configsvc1.live.com.akadns.net

                                                                                                                                                        Simulations

                                                                                                                                                        Behavior and APIs

                                                                                                                                                        No simulations

                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                        IPs

                                                                                                                                                        No context

                                                                                                                                                        Domains

                                                                                                                                                        No context

                                                                                                                                                        ASN

                                                                                                                                                        No context

                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                        No context

                                                                                                                                                        Dropped Files

                                                                                                                                                        No context

                                                                                                                                                        Created / dropped Files

                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E0ED8BAC-9F96-4C65-A32A-441483C92CB1
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):129952
                                                                                                                                                        Entropy (8bit):5.378327306379209
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:1536:1cQceNWiA3gZwLpQ9DQW+zAUH34ZldpKWXboOilXPErLL8TT:nmQ9DQW+zBX8u
                                                                                                                                                        MD5:F8A7E5DD8DA49CEB2ADB7D081647669F
                                                                                                                                                        SHA1:23ABC3C039FC08496CB089591B0EA707600AD768
                                                                                                                                                        SHA-256:FF90EA81C7D3CB75DA4BB89382E69DADC3DFB3E2B282CDF1A9E0DF19CF2734EA
                                                                                                                                                        SHA-512:7D77826784D994C9C403854E6D995F7245593AEFD2D44BDC8D939728BA80AD7AE6EF56651B9993B9A2FAF78981CCCDE1CEF2F9A2B5B61FF65F5567261AFB0F82
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:low
                                                                                                                                                        Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2020-11-19T14:41:32">.. Build: 16.0.13517.30525-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:

                                                                                                                                                        Static File Info

                                                                                                                                                        General

                                                                                                                                                        File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: OXYWbyFNqEDTXZRqGxi, Last Saved By: administrator, Name of Creating Application: Microsoft Excel, Create Time/Date: Wed Nov 18 22:00:31 2020, Last Saved Time/Date: Wed Nov 18 22:26:33 2020, Security: 1
                                                                                                                                                        Entropy (8bit):7.663256298038157
                                                                                                                                                        TrID:
                                                                                                                                                        • Microsoft Excel sheet (30009/1) 78.94%
                                                                                                                                                        • Generic OLE2 / Multistream Compound File (8008/1) 21.06%
                                                                                                                                                        File name:sviluppo_economico_19__98.xls
                                                                                                                                                        File size:423424
                                                                                                                                                        MD5:f85cc34cca018369113e5ea6aff1eae4
                                                                                                                                                        SHA1:62cb04d273f22c440aca13dc344bd05ec7fb9b79
                                                                                                                                                        SHA256:f93a962db6a8cfaf0513c5d2a36cf61b863c52f32ca7ab856cfe0b024001c9f3
                                                                                                                                                        SHA512:434a43f2b2870596c2384fe678b24d4e2335d0c2bfd9826c23eba04d552e3791db3fa83c7ca1a574d6209ec247e0063cbc354fa3ff68029d9456d23bbb26cd98
                                                                                                                                                        SSDEEP:6144:s9CdPZDiqSz9tpBWL5A4hXF+vu7lTcDHEHUEDagk6xrGgvmHfoiNzaU5AU/cp/:fdhsz7p0L++F+vfDkxagkArGBHflNu/
                                                                                                                                                        File Content Preview:........................>.......................9...........................2...3...4...5...6...7...8..........................................................................................................................................................

                                                                                                                                                        File Icon

                                                                                                                                                        Icon Hash:74ecd4c6c3c6c4d8

                                                                                                                                                        Static OLE Info

                                                                                                                                                        General

                                                                                                                                                        Document Type:OLE
                                                                                                                                                        Number of OLE Files:1

                                                                                                                                                        OLE File "sviluppo_economico_19__98.xls"

                                                                                                                                                        Indicators

                                                                                                                                                        Has Summary Info:True
                                                                                                                                                        Application Name:Microsoft Excel
                                                                                                                                                        Encrypted Document:True
                                                                                                                                                        Contains Word Document Stream:False
                                                                                                                                                        Contains Workbook/Book Stream:True
                                                                                                                                                        Contains PowerPoint Document Stream:False
                                                                                                                                                        Contains Visio Document Stream:False
                                                                                                                                                        Contains ObjectPool Stream:
                                                                                                                                                        Flash Objects Count:
                                                                                                                                                        Contains VBA Macros:False

                                                                                                                                                        Summary

                                                                                                                                                        Code Page:1252
                                                                                                                                                        Author:OXYWbyFNqEDTXZRqGxi
                                                                                                                                                        Last Saved By:administrator
                                                                                                                                                        Create Time:2020-11-18 22:00:31
                                                                                                                                                        Last Saved Time:2020-11-18 22:26:33
                                                                                                                                                        Creating Application:Microsoft Excel
                                                                                                                                                        Security:1

                                                                                                                                                        Document Summary

                                                                                                                                                        Document Code Page:1252
                                                                                                                                                        Thumbnail Scaling Desired:False
                                                                                                                                                        Company:
                                                                                                                                                        Contains Dirty Links:False
                                                                                                                                                        Shared Document:False
                                                                                                                                                        Changed Hyperlinks:False
                                                                                                                                                        Application Version:1048576

                                                                                                                                                        Streams

                                                                                                                                                        Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096
                                                                                                                                                        General
                                                                                                                                                        Stream Path:\x5DocumentSummaryInformation
                                                                                                                                                        File Type:data
                                                                                                                                                        Stream Size:4096
                                                                                                                                                        Entropy:0.64107045361
                                                                                                                                                        Base64 Encoded:False
                                                                                                                                                        Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . | . . . . . . . . . . . . . . . . . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F o g l i o 1 . . . . . F o g l i o 2 . . . . . F o g l i o 3 . . . . . F o g l i o 4 . . . . . X j z P k Y h F
                                                                                                                                                        Data Raw:fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 b4 01 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 68 01 00 00
                                                                                                                                                        Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096
                                                                                                                                                        General
                                                                                                                                                        Stream Path:\x5SummaryInformation
                                                                                                                                                        File Type:data
                                                                                                                                                        Stream Size:4096
                                                                                                                                                        Entropy:0.348694171161
                                                                                                                                                        Base64 Encoded:False
                                                                                                                                                        Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . d . . . . . . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O X Y W b y F N q E D T X Z R q G x i . . . . . . . . . a d m i n i s t r a t o r . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . . c ; . . . . @ . . . . . i . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                                                                                                        Data Raw:fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 b4 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 64 00 00 00 12 00 00 00 7c 00 00 00 0c 00 00 00 94 00 00 00 0d 00 00 00 a0 00 00 00 13 00 00 00 ac 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 14 00 00 00
                                                                                                                                                        Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 410329
                                                                                                                                                        General
                                                                                                                                                        Stream Path:Workbook
                                                                                                                                                        File Type:Applesoft BASIC program data, first line number 16
                                                                                                                                                        Stream Size:410329
                                                                                                                                                        Entropy:7.75910354304
                                                                                                                                                        Base64 Encoded:True
                                                                                                                                                        Data ASCII:. . . . . . . . Z O . . . . . . . . . . / . . . . . . . . . . . . . ~ . . . . . . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . M . i . c . r . o . s . o . f . t . . E . n . h . a . n . c . e . d . . C . r . y . p . t . o . g . r . a . p . h . i . c . . P . r . o . v . i . d . e . r . . v . 1 . . . 0 . . . . . . . . . a ) _ . . . S . . . = . j . . . . X x . . + . ~ v ^ . p = . . . . . . . R . . $ R . . B M . . . _ . . . . . . . . . . . . . . . _ . . . . \\ . p . k . B d 9 . . E . . B K
                                                                                                                                                        Data Raw:09 08 10 00 00 06 05 00 5a 4f cd 07 c9 00 02 00 06 08 00 00 2f 00 c8 00 01 00 04 00 02 00 0c 00 00 00 7e 00 00 00 0c 00 00 00 00 00 00 00 01 68 00 00 04 80 00 00 80 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 45 00 6e 00 68 00 61 00 6e 00 63 00 65 00 64 00 20 00 43 00 72 00 79 00 70 00 74 00 6f 00 67 00 72 00 61 00 70 00

                                                                                                                                                        Network Behavior

                                                                                                                                                        Network Port Distribution

                                                                                                                                                        UDP Packets

                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                        Nov 19, 2020 15:41:15.954950094 CET6418553192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:15.982069016 CET53641858.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:16.846503019 CET6511053192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:16.873733044 CET53651108.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:18.133800030 CET5836153192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:18.160774946 CET53583618.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:18.999408960 CET6349253192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:19.026453972 CET53634928.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:20.175544024 CET6083153192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:20.210936069 CET53608318.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:22.969084978 CET6010053192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:22.995865107 CET53601008.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:23.990010023 CET5319553192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:24.017407894 CET53531958.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:25.091245890 CET5014153192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:25.118285894 CET53501418.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:30.995492935 CET5302353192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:31.022440910 CET53530238.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:32.140877962 CET4956353192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:32.189080000 CET53495638.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:32.499978065 CET5135253192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:32.552670002 CET53513528.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:33.507258892 CET5135253192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:33.631208897 CET53513528.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:34.520112991 CET5934953192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:34.521812916 CET5135253192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:34.547127008 CET53593498.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:34.558454990 CET53513528.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:35.411463976 CET5708453192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:35.438574076 CET53570848.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:36.062640905 CET5882353192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:36.089689970 CET53588238.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:36.538332939 CET5135253192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:36.573633909 CET53513528.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:36.805690050 CET5756853192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:36.840802908 CET53575688.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:40.553368092 CET5135253192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:40.588821888 CET53513528.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:44.411493063 CET5054053192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:44.447098017 CET53505408.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:41:48.886693001 CET5436653192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:41:48.913783073 CET53543668.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:42:05.769618034 CET5303453192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:42:05.796716928 CET53530348.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:42:07.689606905 CET5776253192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:42:07.716733932 CET53577628.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:42:23.700062037 CET5543553192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:42:23.727077961 CET53554358.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:42:30.277544022 CET5071353192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:42:30.314619064 CET53507138.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:42:58.444713116 CET5613253192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:42:58.471815109 CET53561328.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:43:32.474759102 CET5898753192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:43:32.501848936 CET53589878.8.8.8192.168.2.3
                                                                                                                                                        Nov 19, 2020 15:43:34.965167046 CET5657953192.168.2.38.8.8.8
                                                                                                                                                        Nov 19, 2020 15:43:35.002229929 CET53565798.8.8.8192.168.2.3

                                                                                                                                                        Code Manipulations

                                                                                                                                                        Statistics

                                                                                                                                                        System Behavior

                                                                                                                                                        General

                                                                                                                                                        Start time:15:41:30
                                                                                                                                                        Start date:19/11/2020
                                                                                                                                                        Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
                                                                                                                                                        Imagebase:0xbd0000
                                                                                                                                                        File size:27110184 bytes
                                                                                                                                                        MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high

                                                                                                                                                        Disassembly

                                                                                                                                                        Reset < >