Loading ...

Play interactive tourEdit tour

Analysis Report research-2012220787.xlsb

Overview

General Information

Sample Name:research-2012220787.xlsb
Analysis ID:432145
MD5:25d7775b163763cbd7f31dcfb5508df6
SHA1:f2194e73570b1868fda6237185aaf1035db042f7
SHA256:72fa58d32cca86eb881fb398e30796d5315cc4e535166ecde99ad51f4890b573
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found abnormal large hidden Excel 4.0 Macro sheet
Sigma detected: Microsoft Office Product Spawning Windows Shell
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Registers a DLL
Tries to load missing DLLs
Yara detected Xls With Macro 4.0

Classification

Process Tree

  • System is w10x64
  • EXCEL.EXE (PID: 6080 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • regsvr32.exe (PID: 6208 cmdline: regsvr32 -s ..\werty1.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
    • regsvr32.exe (PID: 6224 cmdline: regsvr32 -s ..\werty2.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
app.xmlJoeSecurity_XlsWithMacro4Yara detected Xls With Macro 4.0Joe Security

    Sigma Overview

    System Summary:

    barindex
    Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
    Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: regsvr32 -s ..\werty1.dll, CommandLine: regsvr32 -s ..\werty1.dll, CommandLine|base64offset|contains: ,, Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 6080, ProcessCommandLine: regsvr32 -s ..\werty1.dll, ProcessId: 6208

    Signature Overview

    Click to jump to signature section

    Show All Signature Results
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dll
    Source: unknownHTTPS traffic detected: 192.254.225.103:443 -> 192.168.2.3:49716 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 216.172.184.23:443 -> 192.168.2.3:49718 version: TLS 1.2

    Software Vulnerabilities:

    barindex
    Document exploit detected (UrlDownloadToFile)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXESection loaded: unknown origin: URLDownloadToFileA
    Document exploit detected (process start blacklist hit)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe
    Source: global trafficDNS query: name: maciascriminallaw.com
    Source: global trafficTCP traffic: 192.168.2.3:49716 -> 192.254.225.103:443
    Source: global trafficTCP traffic: 192.168.2.3:49716 -> 192.254.225.103:443
    Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
    Source: unknownDNS traffic detected: queries for: maciascriminallaw.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://api.aadrm.com/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://api.cortana.ai
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://api.diagnostics.office.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://api.microsoftstream.com/api/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://api.office.net
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://api.onedrive.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://apis.live.net/v5.0/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://augloop.office.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://augloop.office.com/v2
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://cdn.entity.
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://clients.config.office.net/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://config.edge.skype.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://cortana.ai
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://cortana.ai/api
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://cr.office.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://dataservice.o365filtering.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://dataservice.o365filtering.com/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://dev.cortana.ai
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://devnull.onenote.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://directory.services.
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://graph.ppe.windows.net
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://graph.ppe.windows.net/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://graph.windows.net
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://graph.windows.net/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://incidents.diagnostics.office.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://lifecycle.office.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://login.microsoftonline.com/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://login.windows.local
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://management.azure.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://management.azure.com/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://messaging.office.com/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://ncus.contentsync.
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://ncus.pagecontentsync.
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://officeapps.live.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://onedrive.live.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://onedrive.live.com/embed?
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://outlook.office.com/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://outlook.office365.com/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://powerlift.acompli.net
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://settings.outlook.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://shell.suite.office.com:1443
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://skyapi.live.net/Activity/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://staging.cortana.ai
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://store.office.cn/addinstemplate
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://store.office.com/addinstemplate
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://store.office.de/addinstemplate
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://tasks.office.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://templatelogging.office.com/client/log
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://web.microsoftstream.com/video/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://webshell.suite.office.com
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://wus2.contentsync.
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://wus2.pagecontentsync.
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
    Source: 6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drString found in binary or memory: https://www.odwebp.svc.ms
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
    Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
    Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
    Source: unknownHTTPS traffic detected: 192.254.225.103:443 -> 192.168.2.3:49716 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 216.172.184.23:443 -> 192.168.2.3:49718 version: TLS 1.2

    System Summary:

    barindex
    Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
    Source: Screenshot number: 4Screenshot OCR: Enable Content 14 15 16 17 18 WHY I CANNOT OPEN THIS DOCUMENT ? 19 20 21 W You are using iOS
    Found Excel 4.0 Macro with suspicious formulasShow sources
    Source: research-2012220787.xlsbInitial sample: EXEC
    Found abnormal large hidden Excel 4.0 Macro sheetShow sources
    Source: research-2012220787.xlsbInitial sample: Sheet size: 8595
    Source: research-2012220787.xlsbInitial sample: Sheet size: 7550
    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dll
    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dll
    Source: classification engineClassification label: mal68.expl.evad.winXLSB@5/9@2/2
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{40D5C9DA-827F-466E-AF56-01A5162E3AE5} - OProcSessId.datJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
    Source: C:\Windows\SysWOW64\regsvr32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
    Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\werty1.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\werty2.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\werty1.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\werty2.dll
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: research-2012220787.xlsbInitial sample: OLE zip file path = xl/media/image1.png
    Source: research-2012220787.xlsbInitial sample: OLE zip file path = xl/media/image2.png
    Source: research-2012220787.xlsbInitial sample: OLE zip file path = xl/media/image3.png
    Source: research-2012220787.xlsbInitial sample: OLE zip file path = xl/media/image4.png
    Source: research-2012220787.xlsbInitial sample: OLE zip file path = xl/media/image5.png
    Source: research-2012220787.xlsbInitial sample: OLE zip file path = xl/media/image6.png
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\werty1.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: regsvr32.exe, 00000004.00000002.225091610.00000000044C0000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.225875183.0000000004860000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
    Source: regsvr32.exe, 00000004.00000002.225091610.00000000044C0000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.225875183.0000000004860000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
    Source: regsvr32.exe, 00000004.00000002.225091610.00000000044C0000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.225875183.0000000004860000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
    Source: regsvr32.exe, 00000004.00000002.225091610.00000000044C0000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.225875183.0000000004860000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
    Source: Yara matchFile source: app.xml, type: SAMPLE

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsScripting2DLL Side-Loading1Process Injection1Regsvr321OS Credential DumpingSecurity Software Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsExploitation for Client Execution23Boot or Logon Initialization ScriptsDLL Side-Loading1Masquerading1LSASS MemoryFile and Directory Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Disable or Modify Tools1Security Account ManagerSystem Information Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection1NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptScripting2LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
    Replication Through Removable MediaLaunchdRc.commonRc.commonDLL Side-Loading1Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    No Antivirus matches

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    SourceDetectionScannerLabelLink
    maciascriminallaw.com1%VirustotalBrowse
    jeparainternational.com0%VirustotalBrowse

    URLs

    SourceDetectionScannerLabelLink
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://ofcrecsvcapi-int.azurewebsites.net/0%VirustotalBrowse
    https://ofcrecsvcapi-int.azurewebsites.net/0%Avira URL Cloudsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://officeci.azurewebsites.net/api/0%Avira URL Cloudsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://asgsmsproxyapi.azurewebsites.net/0%Avira URL Cloudsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://ovisualuiapp.azurewebsites.net/pbiagave/0%Avira URL Cloudsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe
    https://staging.cortana.ai0%URL Reputationsafe
    https://staging.cortana.ai0%URL Reputationsafe
    https://staging.cortana.ai0%URL Reputationsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    maciascriminallaw.com
    192.254.225.103
    truefalseunknown
    jeparainternational.com
    216.172.184.23
    truefalseunknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://api.diagnosticssdf.office.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
      high
      https://login.microsoftonline.com/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
        high
        https://shell.suite.office.com:14436C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
          high
          https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
            high
            https://autodiscover-s.outlook.com/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
              high
              https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                high
                https://cdn.entity.6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                unknown
                https://api.addins.omex.office.net/appinfo/query6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                  high
                  https://clients.config.office.net/user/v1.0/tenantassociationkey6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                    high
                    https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                      high
                      https://powerlift.acompli.net6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://rpsticket.partnerservices.getmicrosoftkey.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://lookup.onenote.com/lookup/geolocation/v16C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                        high
                        https://cortana.ai6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        unknown
                        https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                          high
                          https://cloudfiles.onenote.com/upload.aspx6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                            high
                            https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                              high
                              https://entitlement.diagnosticssdf.office.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                high
                                https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                  high
                                  https://api.aadrm.com/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  https://ofcrecsvcapi-int.azurewebsites.net/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                  • 0%, Virustotal, Browse
                                  • Avira URL Cloud: safe
                                  unknown
                                  https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                    high
                                    https://api.microsoftstream.com/api/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                      high
                                      https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                        high
                                        https://cr.office.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                          high
                                          https://portal.office.com/account/?ref=ClientMeControl6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                            high
                                            https://ecs.office.com/config/v2/Office6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                              high
                                              https://graph.ppe.windows.net6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                high
                                                https://res.getmicrosoftkey.com/api/redemptionevents6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                https://powerlift-frontdesk.acompli.net6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                https://tasks.office.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                  high
                                                  https://officeci.azurewebsites.net/api/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://sr.outlook.office.net/ws/speech/recognize/assistant/work6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                    high
                                                    https://store.office.cn/addinstemplate6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    unknown
                                                    https://outlook.office.com/autosuggest/api/v1/init?cvid=6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                      high
                                                      https://globaldisco.crm.dynamics.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                        high
                                                        https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                          high
                                                          https://store.officeppe.com/addinstemplate6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://dev0-api.acompli.net/autodetect6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://www.odwebp.svc.ms6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://api.powerbi.com/v1.0/myorg/groups6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                            high
                                                            https://web.microsoftstream.com/video/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                              high
                                                              https://graph.windows.net6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                high
                                                                https://dataservice.o365filtering.com/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://officesetup.getmicrosoftkey.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://analysis.windows.net/powerbi/api6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                  high
                                                                  https://prod-global-autodetect.acompli.net/autodetect6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  unknown
                                                                  https://outlook.office365.com/autodiscover/autodiscover.json6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                    high
                                                                    https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                      high
                                                                      https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                        high
                                                                        https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                          high
                                                                          https://ncus.contentsync.6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                          • URL Reputation: safe
                                                                          • URL Reputation: safe
                                                                          • URL Reputation: safe
                                                                          unknown
                                                                          https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                            high
                                                                            https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                              high
                                                                              http://weather.service.msn.com/data.aspx6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                high
                                                                                https://apis.live.net/v5.0/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                • URL Reputation: safe
                                                                                • URL Reputation: safe
                                                                                • URL Reputation: safe
                                                                                unknown
                                                                                https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                  high
                                                                                  https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                    high
                                                                                    https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                      high
                                                                                      https://management.azure.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                        high
                                                                                        https://wus2.contentsync.6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                        • URL Reputation: safe
                                                                                        • URL Reputation: safe
                                                                                        • URL Reputation: safe
                                                                                        unknown
                                                                                        https://incidents.diagnostics.office.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                          high
                                                                                          https://clients.config.office.net/user/v1.0/ios6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                            high
                                                                                            https://insertmedia.bing.office.net/odc/insertmedia6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                              high
                                                                                              https://o365auditrealtimeingestion.manage.office.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                high
                                                                                                https://outlook.office365.com/api/v1.0/me/Activities6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                  high
                                                                                                  https://api.office.net6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                    high
                                                                                                    https://incidents.diagnosticssdf.office.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                      high
                                                                                                      https://asgsmsproxyapi.azurewebsites.net/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      unknown
                                                                                                      https://clients.config.office.net/user/v1.0/android/policies6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                        high
                                                                                                        https://entitlement.diagnostics.office.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                          high
                                                                                                          https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                            high
                                                                                                            https://outlook.office.com/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                              high
                                                                                                              https://storage.live.com/clientlogs/uploadlocation6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                high
                                                                                                                https://templatelogging.office.com/client/log6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                  high
                                                                                                                  https://outlook.office365.com/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                    high
                                                                                                                    https://webshell.suite.office.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                      high
                                                                                                                      https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                        high
                                                                                                                        https://management.azure.com/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                          high
                                                                                                                          https://login.windows.net/common/oauth2/authorize6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                            high
                                                                                                                            https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                            • URL Reputation: safe
                                                                                                                            • URL Reputation: safe
                                                                                                                            • URL Reputation: safe
                                                                                                                            unknown
                                                                                                                            https://graph.windows.net/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                              high
                                                                                                                              https://api.powerbi.com/beta/myorg/imports6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                high
                                                                                                                                https://devnull.onenote.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                  high
                                                                                                                                  https://ncus.pagecontentsync.6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                  • URL Reputation: safe
                                                                                                                                  • URL Reputation: safe
                                                                                                                                  • URL Reputation: safe
                                                                                                                                  unknown
                                                                                                                                  https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                    high
                                                                                                                                    https://messaging.office.com/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                      high
                                                                                                                                      https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                        high
                                                                                                                                        https://augloop.office.com/v26C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                          high
                                                                                                                                          https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                            high
                                                                                                                                            https://skyapi.live.net/Activity/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            unknown
                                                                                                                                            https://clients.config.office.net/user/v1.0/mac6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                              high
                                                                                                                                              https://dataservice.o365filtering.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              unknown
                                                                                                                                              https://api.cortana.ai6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              unknown
                                                                                                                                              https://onedrive.live.com6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                                high
                                                                                                                                                https://ovisualuiapp.azurewebsites.net/pbiagave/6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                unknown
                                                                                                                                                https://visio.uservoice.com/forums/368202-visio-on-devices6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                                  high
                                                                                                                                                  https://directory.services.6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  unknown
                                                                                                                                                  https://login.windows-ppe.net/common/oauth2/authorize6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                                    high
                                                                                                                                                    https://staging.cortana.ai6C4F76BF-EEC6-427D-84F3-28D47D584D63.0.drfalse
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    unknown

                                                                                                                                                    Contacted IPs

                                                                                                                                                    • No. of IPs < 25%
                                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                                    • 75% < No. of IPs

                                                                                                                                                    Public

                                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                    192.254.225.103
                                                                                                                                                    maciascriminallaw.comUnited States
                                                                                                                                                    46606UNIFIEDLAYER-AS-1USfalse
                                                                                                                                                    216.172.184.23
                                                                                                                                                    jeparainternational.comUnited States
                                                                                                                                                    46606UNIFIEDLAYER-AS-1USfalse

                                                                                                                                                    General Information

                                                                                                                                                    Joe Sandbox Version:32.0.0 Black Diamond
                                                                                                                                                    Analysis ID:432145
                                                                                                                                                    Start date:09.06.2021
                                                                                                                                                    Start time:19:32:14
                                                                                                                                                    Joe Sandbox Product:CloudBasic
                                                                                                                                                    Overall analysis duration:0h 6m 54s
                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                    Report type:light
                                                                                                                                                    Sample file name:research-2012220787.xlsb
                                                                                                                                                    Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                    Number of analysed new started processes analysed:35
                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                                    Technologies:
                                                                                                                                                    • HCA enabled
                                                                                                                                                    • EGA enabled
                                                                                                                                                    • HDC enabled
                                                                                                                                                    • AMSI enabled
                                                                                                                                                    Analysis Mode:default
                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                    Detection:MAL
                                                                                                                                                    Classification:mal68.expl.evad.winXLSB@5/9@2/2
                                                                                                                                                    EGA Information:Failed
                                                                                                                                                    HDC Information:Failed
                                                                                                                                                    HCA Information:
                                                                                                                                                    • Successful, ratio: 100%
                                                                                                                                                    • Number of executed functions: 0
                                                                                                                                                    • Number of non-executed functions: 0
                                                                                                                                                    Cookbook Comments:
                                                                                                                                                    • Adjust boot time
                                                                                                                                                    • Enable AMSI
                                                                                                                                                    • Found application associated with file extension: .xlsb
                                                                                                                                                    • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                    • Attach to Office via COM
                                                                                                                                                    • Scroll down
                                                                                                                                                    • Close Viewer
                                                                                                                                                    Warnings:
                                                                                                                                                    Show All
                                                                                                                                                    • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
                                                                                                                                                    • Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 52.255.188.83, 92.122.145.220, 13.88.21.125, 52.109.76.68, 52.109.8.23, 52.109.8.22, 104.43.139.144, 184.30.20.56, 20.82.210.154, 2.20.142.209, 2.20.142.210, 20.54.26.129, 92.122.213.247, 92.122.213.194, 20.54.7.98, 20.54.104.15
                                                                                                                                                    • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, prod-w.nexus.live.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, nexus.officeapps.live.com, arc.trafficmanager.net, officeclient.microsoft.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, europe.configsvc1.live.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net
                                                                                                                                                    • Not all processes where analyzed, report is missing behavior information

                                                                                                                                                    Simulations

                                                                                                                                                    Behavior and APIs

                                                                                                                                                    No simulations

                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                    IPs

                                                                                                                                                    No context

                                                                                                                                                    Domains

                                                                                                                                                    No context

                                                                                                                                                    ASN

                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                    UNIFIEDLAYER-AS-1USviVrtGR9Wg.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.113.120
                                                                                                                                                    DEMLwnv0Nt.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.113.120
                                                                                                                                                    audit-367497006.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.113.120
                                                                                                                                                    analysis-31947858.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 108.167.156.223
                                                                                                                                                    analysis-1593377733.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 108.167.156.223
                                                                                                                                                    research-531942606.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.33.8
                                                                                                                                                    OM PHOENIX TRADERS.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.185.244
                                                                                                                                                    research-121105165.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.33.8
                                                                                                                                                    research-76934760.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.33.8
                                                                                                                                                    research-1960540844.xlsxGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.33.8
                                                                                                                                                    fm8m5vuj2w.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.26.241
                                                                                                                                                    research-1110827633.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.33.8
                                                                                                                                                    swift_08_06_21.exeGet hashmaliciousBrowse
                                                                                                                                                    • 162.241.61.204
                                                                                                                                                    INVOICES,PDF.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.224.94
                                                                                                                                                    Outstanding_Payments.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.129.69
                                                                                                                                                    xTnb7uPpSb.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.107.121
                                                                                                                                                    xTnb7uPpSb.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.145.162
                                                                                                                                                    SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.113.219
                                                                                                                                                    SecuriteInfo.com.__vbaHresultCheckObj.9138.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.113.219
                                                                                                                                                    MLJ.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.113.219
                                                                                                                                                    UNIFIEDLAYER-AS-1USviVrtGR9Wg.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.113.120
                                                                                                                                                    DEMLwnv0Nt.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.113.120
                                                                                                                                                    audit-367497006.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.113.120
                                                                                                                                                    analysis-31947858.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 108.167.156.223
                                                                                                                                                    analysis-1593377733.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 108.167.156.223
                                                                                                                                                    research-531942606.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.33.8
                                                                                                                                                    OM PHOENIX TRADERS.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.185.244
                                                                                                                                                    research-121105165.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.33.8
                                                                                                                                                    research-76934760.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.33.8
                                                                                                                                                    research-1960540844.xlsxGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.33.8
                                                                                                                                                    fm8m5vuj2w.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.26.241
                                                                                                                                                    research-1110827633.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.33.8
                                                                                                                                                    swift_08_06_21.exeGet hashmaliciousBrowse
                                                                                                                                                    • 162.241.61.204
                                                                                                                                                    INVOICES,PDF.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.224.94
                                                                                                                                                    Outstanding_Payments.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.129.69
                                                                                                                                                    xTnb7uPpSb.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.107.121
                                                                                                                                                    xTnb7uPpSb.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.145.162
                                                                                                                                                    SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.113.219
                                                                                                                                                    SecuriteInfo.com.__vbaHresultCheckObj.9138.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.113.219
                                                                                                                                                    MLJ.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.185.113.219

                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                    37f463bf4616ecd445d4a1937da06e19pd5S1Fiscq.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    7mC2DVkOx8.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    viVrtGR9Wg.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    eWiuOkCSSf.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    DEMLwnv0Nt.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    ushWNWLfGL.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    Nota Fiscal Eletronica 00111834.msiGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    snAtEF9kUq.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    Bills Pending Approval.htmlGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    Documents_13134976_1377491379.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    audit-367497006.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    Bills Pending Approval.htmlGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    GDrVYvtzuO.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    9E7YOr0kp1.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    aKdhpWlFPg.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    vSYEHJjK1G.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    FaceCheck - Installer.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    analysis-31947858.xlsbGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    Julie.randall Completed REFERRAL AGREEMENT 60926.htmlGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23
                                                                                                                                                    DPSGNwkO1Z.exeGet hashmaliciousBrowse
                                                                                                                                                    • 192.254.225.103
                                                                                                                                                    • 216.172.184.23

                                                                                                                                                    Dropped Files

                                                                                                                                                    No context

                                                                                                                                                    Created / dropped Files

                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\6C4F76BF-EEC6-427D-84F3-28D47D584D63
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):134915
                                                                                                                                                    Entropy (8bit):5.369291104164443
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:1536:acQIKNEeBXA3gBwlpQ9DQW+z7534ZlCKWXboOilX5ENLWME9:KEQ9DQW+zAXOe
                                                                                                                                                    MD5:D122A9D9ECD09E5A55B9D0E2221EEEA6
                                                                                                                                                    SHA1:AA6DDFC82088A944EA583EF89B76B89D25DA9B08
                                                                                                                                                    SHA-256:216E3391D34B0577ABA3158D3C8540D131AC404D39839629B6090E4B11AE5171
                                                                                                                                                    SHA-512:77815AAB1FE1B25E50496DBADE307AF2820D58A5070197379DEFC53C193C5C553FE6266CAB1001BBF9B28AA39E48D295D389E3D8A0FE32FF2145D2A336748A4F
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-06-09T17:33:06">.. Build: 16.0.14207.30526-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:
                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\587FE3E2.png
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:PNG image data, 490 x 30, 8-bit/color RGB, non-interlaced
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):18547
                                                                                                                                                    Entropy (8bit):7.9850486438978985
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:384:kBCIQCloAwCZDy0xOTn6/g6l4NpWfw9nHk6Ka01f7Y/H:kBCIQpAwODPMT6/gfOUKN70
                                                                                                                                                    MD5:ED31C7053D581EDC4C98D222CE02EDEF
                                                                                                                                                    SHA1:6BA7A49CC6FF8FE00E9C5BC75F48AB7E679536DD
                                                                                                                                                    SHA-256:0FCF61397154DF01CFAECA362BD643D88AAD5FEDD07B52DC8A921CC0D7236534
                                                                                                                                                    SHA-512:929BF13F2A050B33D0EABDAC97CAAFDDE612AD521027FEE4DD51E28A3CF61198D6C045E00AB85223C73D74D18BB4EAA1681C7AFA917946DC08A3C75FB2AB4935
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                    Preview: .PNG........IHDR.............l{......sRGB.........pHYs..........+....H.IDATx^...U............"x....U...."...Tc.{...M1M..In....TATb4F,`oD..Q..3......g.3..Lr.D....a8....~.z....Z...yyF..9...:.H.Q2..)/L.....Q.}....(J..,...w2>R.$..G2..m>..|...0.M.g.Xnjj...P.v..x....S......B..p.=.Lz.^..Wi..2U.V'.a..*DE.'..rT.z....#.;..]....[?.C...o.m`]..m][;.:<..]F.9..u..Q]c.Ue.9....(.F.Z.~s..Q:..B...)..LZ.TTo..P.gc.l.'.X.}..H....Q.h|....L..rcd.2dN..co..5.....w.U.4..}........{.Q.....D2.J.z~..:Y3,.H..(#.J.Q......N.._7....w.....].2w.6...._....u.......9-.7.f9...E9...p.A..f....=....Bqu....A.u.JG>b"...%..0..W.H=...G#.DR.....P.|FD).NJ....)>.;...M...T*.dW..t:[.xT..M.|S...O..."M.4u7.uS...]4..R.vK....*).ZK.. J.=.9C.].kr..ES..6..f.(.....N':..t..^.S....kn[s.#..(.....m.....~....6>....:u.J.mO.....%D...Q...6%....!......H.....v..^%....$.._..V........[o5.H8......n.~M.z.RL.0p:.iC.k.1..$...............3[....mS5..........E...2.&...k]...A.....K.8...5..O.@7.[-.F4*7...i....in...y....A
                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\589F4CBF.png
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):848
                                                                                                                                                    Entropy (8bit):7.595467031611744
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:24:NLJZbn0jL5Q3H/hbqzej+0C3Yi6yyuq53q:JIjm3pQCLWYi67lc
                                                                                                                                                    MD5:02DB1068B56D3FD907241C2F3240F849
                                                                                                                                                    SHA1:58EC338C879DDBDF02265CBEFA9A2FB08C569D20
                                                                                                                                                    SHA-256:D58FF94F5BB5D49236C138DC109CE83E82879D0D44BE387B0EA3773D908DD25F
                                                                                                                                                    SHA-512:9057CE6FA62F83BB3F3EFAB2E5142ABC41190C08846B90492C37A51F07489F69EDA1D1CA6235C2C8510473E8EA443ECC5694E415AEAF3C7BD07F864212064678
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                    Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8O.T]H.Q..;3...?..fk.lR..R$.R.Pb.Q...B..OA..T$.hAD...J../..-h...fj..+....;s.vg.Zsw.=...{.w.s.w.@.....;..s...O........;.y.p........,...s1@ Ir.:... .>.LLa..b?h...l.6..U....1....r.....T..O.d.KSA...7.YS..a.(F@....xe.^.I..$h....PpJ...k%.....9..QQ....h..!H*................./....2..J2..HG....A....Q&...k...d..&..Xa.t..E....E..f2.d(..v.~.P.+.pik+;...xEU.g....._xfw...+...(..pQ.(..(.U./..)..@..?..........f.'...lx+@F...+....)..k.A2...r~B,....TZ..y..9...`..0....q....yY....Q.......A.....8j[.O9..t..&...g. I@ ..;..X!...9S.J5..'.xh...8I.~.+...mf.m.W.i..{...+>P...Rh...+..br^$. q.^.......(..._.j...$..Ar...MZm|...9..E..!U[S.fDx7<....Wd.......p..C......^MyI:...c.^..SI.mGj,.......!...h..$..;...........yD./..a...-j.^:.}..v....RQY*.^......IEND.B`.
                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7751FFB4.png
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:PNG image data, 246 x 108, 8-bit/color RGB, non-interlaced
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):10270
                                                                                                                                                    Entropy (8bit):7.975714699744477
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:192:3sXvKLMbye/PEXiKTUgCto9h4F6NwfU6vGDpdYNbcQZgkbd4cgc:3iLh/gJ59CDfU6LocbGK
                                                                                                                                                    MD5:9C4F09E387EA7B36C8149EA7C5F8876E
                                                                                                                                                    SHA1:FF83384288EB89964C3872367E43F25FAFF007CC
                                                                                                                                                    SHA-256:A51C1D65092272DAEB2541D64A10539F0D04BC2F51B281C7A3296500CFCA56DE
                                                                                                                                                    SHA-512:0FDDE22CFDDE8BB1C04842D2810D0FD6D42192594E0D6120DE401B08B7E2CFFB5333792BC748E93CD70FA14734CC7D950620CB977DDBBDB52D92BDA8F35521F8
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                    Preview: .PNG........IHDR.......l...........sRGB.........pHYs..........+....'.IDATx^.].|.U...%...J.".....H.&Ui......E.........D.7....U.i..FH#=......3..$K....'{3....7........0.H......H..03..,....8.q........'@\...S@.../.0=....|....}|......0.... ...,LO........q._`az.....8......... .`..) @...X...q..>N...>.........q........'@\...S@.../.0=....|....}|......0.... ...,LO........q._`az.....8...l..m.i'Sj.W.i.S.TJ....D.D._%...]..i.;J..b..T.).Ik.L6..L.mN....!*..\..'{$.o._b..h....t"@.?...y...d..h..|..B9D..CJD..t."........bR"....I)H....z.......>|.....E.x..r....J.U..[...p:D....XF......A...E.....b..C...C..C......=.Z..$.=../....Y..x5CY.0l..,~.W. .?......;...$.'....<.H.2...z..6(.E........kw8w^.\~...".C,gl&.m..J2.).HI.....b.r...'.....r.H...P.....'...A.^.q..j).cZ.^1~.|.........dv^.^v..X..v..6/^.$rR. iK..H.Uu.Pvk....U.....'.Fd..Z.]mu\*1.Zb.\b...N..P..&tr;.W....J.K(@.^A..R.S.[~.v.R.YO...0-...2..h."..............7..Ng...R...e.&..@..t..N...{5...W.x./#.%..}t...F8-..M1..(4b1....&.....)B...6.
                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\925DB6C9.png
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:PNG image data, 521 x 246, 8-bit/color RGB, non-interlaced
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):32996
                                                                                                                                                    Entropy (8bit):7.975478139053759
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:768:N4k48AnTViUidx37OODgvnrxtxAudMN1VTRVHdB4K7K:NE8m+L37OOwrCXN1VTR1PK
                                                                                                                                                    MD5:4E69B72B0CE87CC7EE30AA1A062147FE
                                                                                                                                                    SHA1:09B0AA5414E08756E0AE53E1BE5C70DB4DEAF2E8
                                                                                                                                                    SHA-256:77A1F749389CBF771D5197FF0FF17113FCA1D91989ADCADF2852876A6CC14988
                                                                                                                                                    SHA-512:6246AF2137E773F7719033AFE75F0B00FF3A4B5543DBA53737FC8D33EE42478E3D8A5CF166E9EFD2F54A2F3E0D62417BDDC1CB824642305B59AB1229313D2D79
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                    Preview: .PNG........IHDR..............[.J....sRGB.........pHYs..........+......IDATx^.].`......{%.$..A...R.P@z....O...S.<;.VT.REA.(...I...{.......m...]..r./.......~.|]h.Z....P.(........E."@...P.(.v.P.@..E."@....#@y.......E."@y.......E."...*78C.~O...P.<....<o..).....3.(op...."@...x...7x...S.(...g.P...!.=E."@..<.(o.5.3..P.(.......B.{..E.".y.P..ykNgL...P..!@y.3.......E........."@...8C...g...)......!@y..9.1E."@.p........S.(....C....[s:c..E."......!D...P.(.........t.....E....78C.~O...P.<....<o..).....3.(op...."@...x...7x...S.(...g.P...!.=E."@..<.(o.5.3..P.(.......B.{..E.".y.P..ykNgL...P..!@y.3.......E........."@...8C...g...)......!@y..9.1E."@.p........S.(....C....[s:c..E."......!D...P.(.........t.....E....78C.~O...P.<....<o..).....3.(op...."@...x...7x...S.(...g.P...!.=E."@..<.(o.5.3..P.(.......B.{..E.".y.P..ykNgL...P..!@y.3.......E........."@...8C...g...)......!@y..9.1E."@.p........S.(....C....[s:c..E."......!D...P.(.........t.....E....78C.~O...P.<....<o..).....3.(op...."@...x..
                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\9F375E36.png
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):557
                                                                                                                                                    Entropy (8bit):7.343009301479381
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:12:6v/7aLMZ5I9TvSb5Lr6U7+uHK2yJtNJTNSB0qNMQCvGEvfvqVFsSq6ixPT3Zf:Ng8SdCU7+uqF20qNM1dvfSviNd
                                                                                                                                                    MD5:A516B6CB784827C6BDE58BC9D341C1BD
                                                                                                                                                    SHA1:9D602E7248E06FF639E6437A0A16EA7A4F9E6C73
                                                                                                                                                    SHA-256:EF8F7EDB6BA0B5ACEC64543A0AF1B133539FFD439F8324634C3F970112997074
                                                                                                                                                    SHA-512:C297A61DA1D7E7F247E14D188C425D43184139991B15A5F932403EE68C356B01879B90B7F96D55B0C9B02F6B9BFAF4E915191683126183E49E668B6049048D35
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                    Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8Oc.......l.9a._.X....@.`ddbc.]...........O..m7.r0|..."......?A.......w..;.N1u........_.[.\Y...BK=...F +.t.M~..oX..%....211o.q.P.".......y...../..l.r...4..Q]..h.....LL.d.......d....w.>{.e..k.7.9y.%.. .YpI...{.+Kv......./..\[...A....^.5c..O?.......G...VB..4HWY...9NU...?..S..$..1..6.U.....c... ....7..J. "M..5. ............_.......d.V.W.c.....Y.A..S....~.C.....q........t?..."n.....4......G_......Q..x..W.!L.a...3....MR.|.-P#P;..p._.......jUG....X........IEND.B`.
                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B39FB425.png
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:PNG image data, 934 x 29, 8-bit/color RGB, non-interlaced
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):42557
                                                                                                                                                    Entropy (8bit):7.992800895943226
                                                                                                                                                    Encrypted:true
                                                                                                                                                    SSDEEP:768:Pfsq4UmepRdblCFcXhw9KnRTRews6xD0FvBlwAS1A8x7BcS0OvD230:PR3ZblCF28KRsws6CFv0AYx7Bl3b230
                                                                                                                                                    MD5:B1F262A694930ADB699FA94E3394887F
                                                                                                                                                    SHA1:9C9B66D3A3F09AECA45DB94304CDD6FB3C5BD4C9
                                                                                                                                                    SHA-256:9C99EC61392B9022A38C1354124360147E8185065095BD2EC92B1416CF9F4B68
                                                                                                                                                    SHA-512:1CA7E6750178B88EC3AA7A0B83348EA389E26C27E0D7E919D807BE470714E5B4F04ACEB69D391F0498D4E465E6620E9449CA2F40755B5CE8196E683502EBF5F4
                                                                                                                                                    Malicious:false
                                                                                                                                                    Preview: .PNG........IHDR.............6......sRGB.........pHYs..........+......IDATx^....dU....S.:ON.0.0....s0 .....$..%#HR.T.......$..0C...Su...[.TM..{.......C.S}..^{......].^..ZX.Wb.W....X!..A.P....0..u...X.V.3.....z..tiO{GW..?...A.......ca2Y.... ...cAX..zZ..2M.$..g.O.e..r?z&................*....*.=..Z.A........a.Z..ka<..N.R.c......./.[..j.^...Nk.(..y.,..z"...R..Z+..D1Q....z....0..u~..jU_.b.Z.V....:..5:.(.......-...A2.O.{..p.j..].<........0..0..+...E...^...z....#..j.d...X._..1..M.5..O.^.."..l....G....U1........X.6.Z.\.&..h..m*..T..xH.j..3<$.H...a..n....}t.A.jT.6G.h@..<.x..x...cb......C..{.D.'QW<.o~..?.....4F_..B..h.\...y8..)....j.Z.d..#P..P..O.....(.0...f....B_z>.E .w../..(...'.Fw..yT..G..)...b9..g.AA`.a..v.zfY.F........._r.i.d.`....Q.g.m"..\..&.t.X.q1}.$.S....2..~...d."..1.. (.0.F....t...i..@f.. ...(..8..q.....I.....ad.....z%....;...y.O...X<Q..X.....B..H........<)....4.&9.4......1.h..#B.....g.....bO.59.A..M.....J..vX3*5..X....(G.A.u...8.. .{
                                                                                                                                                    C:\Users\user\AppData\Local\Temp\2B810000
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):157800
                                                                                                                                                    Entropy (8bit):7.96462540049159
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:3072:LdlQ9VlUBWA6CFvA7brCxAVIKMvlV1REyNEsAnexVymd1xXPwSq:Lw3liWA6FiYMvTfzTYexVyWxfY
                                                                                                                                                    MD5:2531CA5DCF148DF525B1C30A5952CA15
                                                                                                                                                    SHA1:3D99FAA6341B6342FD07EA97A81327C24D9F9810
                                                                                                                                                    SHA-256:58A86B4158C11A409804BB51048ACF1B2F7478DC8031448C241566CFC3C98769
                                                                                                                                                    SHA-512:67532806F3BEBCF04EA4C42E2709FA4DE6ABB4A08628A75F69A83BB2E68B9E7A7C9408B5ABD88D35A432123C9171F4E9CD7DA48EB056581420A7CCF3BE2F458A
                                                                                                                                                    Malicious:false
                                                                                                                                                    Preview: .U.N.0.}G.....J\@Z!....w.`?....U..1..=c7..JK)...'s.3.x|...z.....7#V..^i....u}.*L.)a...-.......n..+.v.>.p.9......p...hE.... .\t.OF._\z...:e.6._.L.T]-hy.d...~...T-.!.-E"....w$......%..C....H.4!jb.......o...{.m..7gD0......2K)..?...r.c........T7".?.[|a......f;H6.b....).5V........Y.......?A.v.l._.....Qt.B....b........c..t........\..g..a'...........6..].k..:T..Y.....}...K3.&..4.#....D..u .I.z.m..kF......@m...<.......PK..........!.[:..............[Content_Types].xml ...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                    C:\Users\user\Desktop\~$research-2012220787.xlsb
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):165
                                                                                                                                                    Entropy (8bit):1.6081032063576088
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:3:RFXI6dtt:RJ1
                                                                                                                                                    MD5:7AB76C81182111AC93ACF915CA8331D5
                                                                                                                                                    SHA1:68B94B5D4C83A6FB415C8026AF61F3F8745E2559
                                                                                                                                                    SHA-256:6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF
                                                                                                                                                    SHA-512:A09AB74DE8A70886C22FB628BDB6A2D773D31402D4E721F9EE2F8CCEE23A569342FEECF1B85C1A25183DD370D1DFFFF75317F628F9B3AA363BBB60694F5362C7
                                                                                                                                                    Malicious:true
                                                                                                                                                    Preview: .pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

                                                                                                                                                    Static File Info

                                                                                                                                                    General

                                                                                                                                                    File type:Microsoft Excel 2007+
                                                                                                                                                    Entropy (8bit):7.958178103795293
                                                                                                                                                    TrID:
                                                                                                                                                    • Excel Microsoft Office Binary workbook document (47504/1) 49.74%
                                                                                                                                                    • Excel Microsoft Office Open XML Format document (40004/1) 41.89%
                                                                                                                                                    • ZIP compressed archive (8000/1) 8.38%
                                                                                                                                                    File name:research-2012220787.xlsb
                                                                                                                                                    File size:157750
                                                                                                                                                    MD5:25d7775b163763cbd7f31dcfb5508df6
                                                                                                                                                    SHA1:f2194e73570b1868fda6237185aaf1035db042f7
                                                                                                                                                    SHA256:72fa58d32cca86eb881fb398e30796d5315cc4e535166ecde99ad51f4890b573
                                                                                                                                                    SHA512:b61a2ef7430a822021ae32bc86d0bb1196db730417fe0a85938ede72b8b600b482be2107833fcd4b710663182df6f6692f8e3c51e4c059506b6afb8bffce2bd9
                                                                                                                                                    SSDEEP:3072:OjTemXbxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIKxvI:sTecbxVyWxfMU3liWA6FsY+
                                                                                                                                                    File Content Preview:PK..........!...k.....".......[Content_Types].xml ...(.........................................................................................................................................................................................................

                                                                                                                                                    File Icon

                                                                                                                                                    Icon Hash:74f0d0d2c6d6d0f4

                                                                                                                                                    Static OLE Info

                                                                                                                                                    General

                                                                                                                                                    Document Type:OpenXML
                                                                                                                                                    Number of OLE Files:1

                                                                                                                                                    OLE File "research-2012220787.xlsb"

                                                                                                                                                    Indicators

                                                                                                                                                    Has Summary Info:
                                                                                                                                                    Application Name:
                                                                                                                                                    Encrypted Document:
                                                                                                                                                    Contains Word Document Stream:
                                                                                                                                                    Contains Workbook/Book Stream:
                                                                                                                                                    Contains PowerPoint Document Stream:
                                                                                                                                                    Contains Visio Document Stream:
                                                                                                                                                    Contains ObjectPool Stream:
                                                                                                                                                    Flash Objects Count:
                                                                                                                                                    Contains VBA Macros:

                                                                                                                                                    Macro 4.0 Code

                                                                                                                                                    "=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=FORMULA('Doc2'!BL28,'Doc3'!AY16)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=FORMULA(""U""&'Doc3'!AY16&'Doc2'!BL29&'Doc2'!BL30,'Doc3'!AY10)",,,"=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=FORMULA('Doc2'!BJ39&'Doc2'!BO28&'Doc3'!AY17&'Doc2'!BJ43&'Doc3'!AY10&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&'Doc3'!AY11&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&'Doc3'!AY12&'Doc2'!BJ41&'Doc2'!BJ45&'Doc2'!BJ42&'Doc2'!BJ41&""https://""&'Doc3'!AY13&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&before.4.6.53.sheet!BG23&'Doc2'!BJ41&'Doc2'!BJ45&'Doc2'!BJ45&'Doc2'!BJ44,'Doc3'!AW10)=SUMXMY2(452354,45245)",,,,,,,,,"=FORMULA('Doc2'!BO36,'Doc3'!AY13)",,,=GOTO('Doc3'!AW8),,,"=FORMULA('Doc2'!BM28&'Doc2'!BM29&'Doc2'!BM30&""B"",'Doc3'!AY12)",,,,,,"=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=A
                                                                                                                                                    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,R,J,,CAL,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,EXEC,,,0,,LM,JC,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,on,CB,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,wnl,,oadT,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Fil,,LDo,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,""")",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"""",,,,,o,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,&,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"(""r",,,,0,0,,,maciascriminallaw.com/lTU1Uw2i0P/fasol.html,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,eg,,,,,,,,jeparainternational.com/F8DLYhv4q/fasol.html,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,svr32 -s ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=,=,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"""",,,,,"=LEFT(""LdecvsbgvrsxLxrgxg"",1)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,",",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"(""",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,",0",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
                                                                                                                                                    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=HALT(),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

                                                                                                                                                    Network Behavior

                                                                                                                                                    Network Port Distribution

                                                                                                                                                    TCP Packets

                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                    Jun 9, 2021 19:33:10.166578054 CEST49716443192.168.2.3192.254.225.103
                                                                                                                                                    Jun 9, 2021 19:33:10.352735043 CEST44349716192.254.225.103192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:10.352900028 CEST49716443192.168.2.3192.254.225.103
                                                                                                                                                    Jun 9, 2021 19:33:10.354111910 CEST49716443192.168.2.3192.254.225.103
                                                                                                                                                    Jun 9, 2021 19:33:10.540224075 CEST44349716192.254.225.103192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:10.572550058 CEST44349716192.254.225.103192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:10.572604895 CEST44349716192.254.225.103192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:10.572643042 CEST44349716192.254.225.103192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:10.572681904 CEST49716443192.168.2.3192.254.225.103
                                                                                                                                                    Jun 9, 2021 19:33:10.572727919 CEST49716443192.168.2.3192.254.225.103
                                                                                                                                                    Jun 9, 2021 19:33:10.572734118 CEST49716443192.168.2.3192.254.225.103
                                                                                                                                                    Jun 9, 2021 19:33:10.586538076 CEST49716443192.168.2.3192.254.225.103
                                                                                                                                                    Jun 9, 2021 19:33:10.773426056 CEST44349716192.254.225.103192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:10.773598909 CEST49716443192.168.2.3192.254.225.103
                                                                                                                                                    Jun 9, 2021 19:33:10.774496078 CEST49716443192.168.2.3192.254.225.103
                                                                                                                                                    Jun 9, 2021 19:33:11.001211882 CEST44349716192.254.225.103192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:11.362966061 CEST44349716192.254.225.103192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:11.363121033 CEST49716443192.168.2.3192.254.225.103
                                                                                                                                                    Jun 9, 2021 19:33:11.363226891 CEST44349716192.254.225.103192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:11.363302946 CEST49716443192.168.2.3192.254.225.103
                                                                                                                                                    Jun 9, 2021 19:33:11.365504980 CEST49716443192.168.2.3192.254.225.103
                                                                                                                                                    Jun 9, 2021 19:33:11.552649021 CEST44349716192.254.225.103192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:11.580404997 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:33:11.744385958 CEST44349718216.172.184.23192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:11.744524956 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:33:11.745156050 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:33:11.909049034 CEST44349718216.172.184.23192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:11.909905910 CEST44349718216.172.184.23192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:11.909945965 CEST44349718216.172.184.23192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:11.909993887 CEST44349718216.172.184.23192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:11.910037994 CEST44349718216.172.184.23192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:11.910053015 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:33:11.910088062 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:33:11.910104036 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:33:11.912847996 CEST44349718216.172.184.23192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:11.913929939 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:33:11.923938036 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:33:12.088114977 CEST44349718216.172.184.23192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:12.090564966 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:33:12.091365099 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:33:12.295516014 CEST44349718216.172.184.23192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:12.472979069 CEST44349718216.172.184.23192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:12.473079920 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:33:12.473263979 CEST44349718216.172.184.23192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:12.473432064 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:34:56.457046986 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:34:56.861350060 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:34:57.564743996 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:34:58.971065998 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:35:01.768094063 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:35:07.362329006 CEST49718443192.168.2.3216.172.184.23
                                                                                                                                                    Jun 9, 2021 19:35:18.535204887 CEST49718443192.168.2.3216.172.184.23

                                                                                                                                                    UDP Packets

                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                    Jun 9, 2021 19:32:53.762542963 CEST5062053192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:32:53.821918011 CEST53506208.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:32:54.287473917 CEST6493853192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:32:54.338772058 CEST53649388.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:32:55.047642946 CEST6015253192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:32:55.101212025 CEST53601528.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:32:56.369980097 CEST5754453192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:32:56.421783924 CEST53575448.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:32:56.911271095 CEST5598453192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:32:56.971674919 CEST53559848.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:32:57.260831118 CEST6418553192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:32:57.311825037 CEST53641858.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:32:58.152271986 CEST6511053192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:32:58.205354929 CEST53651108.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:32:59.594073057 CEST5836153192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:32:59.646205902 CEST53583618.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:03.378062963 CEST6349253192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:03.439562082 CEST53634928.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:05.469175100 CEST6083153192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:05.523925066 CEST53608318.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:06.484613895 CEST6010053192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:06.582709074 CEST53601008.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:07.035094023 CEST5319553192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:07.108300924 CEST53531958.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:08.040447950 CEST5319553192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:08.098889112 CEST53531958.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:09.047076941 CEST5319553192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:09.106662035 CEST5014153192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:09.119862080 CEST53531958.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:09.157202959 CEST53501418.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:09.959563017 CEST5302353192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:10.164220095 CEST53530238.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:10.310817957 CEST4956353192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:10.361365080 CEST53495638.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:11.102533102 CEST5319553192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:11.162839890 CEST53531958.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:11.383033037 CEST5135253192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:11.577682972 CEST53513528.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:11.671977997 CEST5934953192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:11.722166061 CEST53593498.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:12.977109909 CEST5708453192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:13.028587103 CEST53570848.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:13.890763044 CEST5882353192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:13.940834999 CEST53588238.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:14.835393906 CEST5756853192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:14.893990040 CEST53575688.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:15.242027998 CEST5319553192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:15.301796913 CEST53531958.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:18.047219038 CEST5054053192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:18.100261927 CEST53505408.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:19.326596022 CEST5436653192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:19.377290010 CEST53543668.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:31.425473928 CEST5303453192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:31.490493059 CEST53530348.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:32.536747932 CEST5776253192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:32.606153965 CEST53577628.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:48.978033066 CEST5543553192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:49.036303997 CEST53554358.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:52.997307062 CEST5071353192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:53.049124956 CEST53507138.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:54.258961916 CEST5613253192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:54.309498072 CEST53561328.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:33:55.904114962 CEST5898753192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:33:55.978985071 CEST53589878.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:34:13.285278082 CEST5657953192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:34:13.359611988 CEST53565798.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:34:17.188858032 CEST6063353192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:34:17.253734112 CEST53606338.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:34:48.823302031 CEST6129253192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:34:48.873537064 CEST53612928.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:34:50.072597027 CEST6361953192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:34:50.133996964 CEST53636198.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:35:48.424705029 CEST6493853192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:35:48.637662888 CEST53649388.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:35:49.330915928 CEST6194653192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:35:49.475464106 CEST53619468.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:35:50.089886904 CEST6491053192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:35:50.151417017 CEST53649108.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:35:50.785981894 CEST5212353192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:35:50.847698927 CEST53521238.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:35:51.635261059 CEST5613053192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:35:51.694066048 CEST53561308.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:35:52.388101101 CEST5633853192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:35:52.446377039 CEST53563388.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:35:53.083235979 CEST5942053192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:35:53.145109892 CEST53594208.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:35:53.939708948 CEST5878453192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:35:53.998282909 CEST53587848.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:35:55.279700041 CEST6397853192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:35:55.339688063 CEST53639788.8.8.8192.168.2.3
                                                                                                                                                    Jun 9, 2021 19:35:55.836272955 CEST6293853192.168.2.38.8.8.8
                                                                                                                                                    Jun 9, 2021 19:35:55.896214008 CEST53629388.8.8.8192.168.2.3

                                                                                                                                                    DNS Queries

                                                                                                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                                                    Jun 9, 2021 19:33:09.959563017 CEST192.168.2.38.8.8.80xf8f3Standard query (0)maciascriminallaw.comA (IP address)IN (0x0001)
                                                                                                                                                    Jun 9, 2021 19:33:11.383033037 CEST192.168.2.38.8.8.80x1c54Standard query (0)jeparainternational.comA (IP address)IN (0x0001)

                                                                                                                                                    DNS Answers

                                                                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                                                    Jun 9, 2021 19:33:10.164220095 CEST8.8.8.8192.168.2.30xf8f3No error (0)maciascriminallaw.com192.254.225.103A (IP address)IN (0x0001)
                                                                                                                                                    Jun 9, 2021 19:33:11.577682972 CEST8.8.8.8192.168.2.30x1c54No error (0)jeparainternational.com216.172.184.23A (IP address)IN (0x0001)

                                                                                                                                                    HTTPS Packets

                                                                                                                                                    TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                                                                                                                                    Jun 9, 2021 19:33:10.572604895 CEST192.254.225.103443192.168.2.349716CN=*.maciascriminallaw.com CN=R3, O=Let's Encrypt, C=USCN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Fri Apr 16 18:01:50 CEST 2021 Wed Oct 07 21:21:40 CEST 2020Thu Jul 15 18:01:50 CEST 2021 Wed Sep 29 21:21:40 CEST 2021771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                                                                                                                                                    CN=R3, O=Let's Encrypt, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Oct 07 21:21:40 CEST 2020Wed Sep 29 21:21:40 CEST 2021
                                                                                                                                                    Jun 9, 2021 19:33:11.912847996 CEST216.172.184.23443192.168.2.349718CN=*.republicfurnitures.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Sat May 15 11:50:01 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Fri Aug 13 11:50:01 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                                                                                                                                                    CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                                                                                                                                    CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024

                                                                                                                                                    Code Manipulations

                                                                                                                                                    Statistics

                                                                                                                                                    Behavior

                                                                                                                                                    Click to jump to process

                                                                                                                                                    System Behavior

                                                                                                                                                    General

                                                                                                                                                    Start time:19:33:05
                                                                                                                                                    Start date:09/06/2021
                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                    Commandline:'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
                                                                                                                                                    Imagebase:0x9f0000
                                                                                                                                                    File size:27110184 bytes
                                                                                                                                                    MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                    Reputation:high

                                                                                                                                                    General

                                                                                                                                                    Start time:19:33:12
                                                                                                                                                    Start date:09/06/2021
                                                                                                                                                    Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                    Commandline:regsvr32 -s ..\werty1.dll
                                                                                                                                                    Imagebase:0x180000
                                                                                                                                                    File size:20992 bytes
                                                                                                                                                    MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                    Reputation:high

                                                                                                                                                    General

                                                                                                                                                    Start time:19:33:12
                                                                                                                                                    Start date:09/06/2021
                                                                                                                                                    Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                    Commandline:regsvr32 -s ..\werty2.dll
                                                                                                                                                    Imagebase:0x180000
                                                                                                                                                    File size:20992 bytes
                                                                                                                                                    MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                    Reputation:high

                                                                                                                                                    Disassembly

                                                                                                                                                    Code Analysis

                                                                                                                                                    Reset < >